CVE-2026-15797 Overview
The Popup Maker WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.24.0. The flaw resides in the handling of the post_title parameter, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or above to inject arbitrary web scripts. The injected payload executes in the browser of any user who accesses an affected page. This weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can plant persistent JavaScript that executes in administrator sessions, enabling session hijacking, privilege escalation, and site defacement.
Affected Products
- Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress
- All versions up to and including 1.24.0
- Fixed in version 1.25.0
Discovery Timeline
- 2026-09-18 - CVE-2026-15797 published to NVD
- 2026-09-19 - Last updated in NVD database
Technical Details for CVE-2026-15797
Vulnerability Analysis
The vulnerability is a stored XSS defect in the Popup Maker plugin's AJAX-driven Select2 dropdown component. An authenticated contributor can create a post whose title contains an HTML entity-encoded JavaScript payload. On save, WordPress applies sanitize_text_field to the title, which does not strip HTML entities because they are already encoded and appear inert. The plugin later retrieves post titles through its AJAX endpoint defined in classes/Admin/Ajax.php and returns them to the browser, where the Select2 component decodes the entities and renders them into the DOM. This decoding step reintroduces the original script content, causing the payload to execute in the context of any administrator or editor who opens a Popup Maker admin screen.
Root Cause
The root cause is a mismatch between server-side sanitization and client-side rendering. sanitize_text_field in the save path does not neutralize HTML entities, and the Select2 renderer in dist/assets/admin-general.js performs HTML decoding before insertion. The helper function in classes/Helpers.php at line 192 forwards the untrusted title without additional escaping suitable for HTML contexts.
Attack Vector
Exploitation requires an authenticated account with contributor-level privileges or higher on the target WordPress site. The attacker creates or edits a post using an HTML entity-encoded title such as an encoded <script> sequence. When a privileged user opens an admin page that populates the Popup Maker Select2 control, the browser decodes the entities and executes the injected script under the victim's session context. The scope changes from the low-privilege contributor to the higher-privilege administrator, matching the scope-changed nature of the flaw.
See the Wordfence advisory and the upstream patch changeset 3690634 for verified technical details.
Detection Methods for CVE-2026-15797
Indicators of Compromise
- WordPress posts authored by contributor-role accounts containing HTML entity sequences such as <script>, <script>, or <script> in the post_title field.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after opening Popup Maker admin screens.
- Newly created administrator accounts or modified user roles following contributor activity on affected sites.
Detection Strategies
- Query the wp_posts table for titles containing encoded angle brackets, javascript:, or common XSS sink strings like onerror= and onload=.
- Monitor WordPress audit logs for post creation events by contributor accounts followed by administrator visits to plugin admin pages.
- Inspect HTTP responses from the plugin's AJAX endpoints in classes/Admin/Ajax.php for encoded payloads returned to the browser.
Monitoring Recommendations
- Enable a Content Security Policy (CSP) that blocks inline scripts in the WordPress admin and log CSP violation reports.
- Alert on privilege changes, plugin installations, and option updates originating from admin sessions immediately after Popup Maker screens load.
- Forward WordPress and web-server logs to a centralized SIEM and correlate contributor post activity with subsequent administrator actions.
How to Mitigate CVE-2026-15797
Immediate Actions Required
- Upgrade Popup Maker to version 1.25.0 or later on every WordPress site that runs the plugin.
- Audit all posts authored by contributor and author roles for HTML entity-encoded payloads in titles and revert or delete suspicious entries.
- Rotate administrator passwords and invalidate active sessions if the plugin has been running an affected version with untrusted contributors.
Patch Information
The vendor addressed the issue in Popup Maker 1.25.0. Review the diff between 1.24.0 and 1.25.0 and the committed fix in changeset 3690634 to confirm the sanitization and escaping updates applied to the AJAX handler.
Workarounds
- Temporarily deactivate the Popup Maker plugin until the upgrade to 1.25.0 is completed.
- Restrict post creation and editing to trusted users by removing the edit_posts capability from the contributor role.
- Deploy a web application firewall rule that blocks HTML entity-encoded <script> patterns in the post_title request parameter.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
