CVE-2026-87915 Overview
CVE-2026-87915 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Popup Maker WordPress plugin. The flaw affects all versions up to and including 1.24.0. Unauthenticated attackers can inject arbitrary web scripts through the values[Name] parameter due to insufficient input sanitization and output escaping. The injected script executes when a user accesses an affected admin page and interacts with a contextual help tab anchor.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in the context of authenticated WordPress administrators, enabling session theft, account takeover, and further site compromise.
Affected Products
- Popup Maker – Boost Sales, Conversions, Optins, Subscribers plugin for WordPress
- All versions up to and including 1.24.0
- Fixed in version 1.25.0
Discovery Timeline
- 2026-09-18 - CVE-2026-87915 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-87915
Vulnerability Analysis
The vulnerability resides in how the Popup Maker plugin handles subscriber data submitted through the values[Name] parameter. Attacker-controlled input is stored in the database and later rendered in the WordPress admin Subscribers table. The plugin applies wp_kses on output, but this sanitization is insufficient in this specific rendering context.
HTML entities within allowed attribute values survive wp_kses normalization intact. The stored payload is later evaluated by the jQuery(link.attr('href')) sink in wp-admin/js/common.js when a contextual help tab anchor is clicked. This DOM sink treats the attribute value as a jQuery selector, allowing HTML fragments containing script content to be parsed and executed.
The combination of stored input, entity-preserving output filtering, and an unsafe jQuery sink downstream forms the complete exploitation chain. The vulnerability is classified as stored XSS with a scope change, reflecting cross-boundary impact from an unauthenticated context into the administrative interface.
Root Cause
The root cause is the mismatch between the wp_kses allow-list sanitization applied at output time and the downstream JavaScript sink that interprets attribute content as executable markup. wp_kses permits certain attributes and entities in the rendered HTML, but it does not account for the link.attr('href') value being passed directly to the jQuery constructor, which treats strings starting with < as HTML to parse.
Attack Vector
An unauthenticated attacker submits a crafted values[Name] value through the plugin's subscriber intake path. The malicious value is persisted in the database via the Newsletters and Subscribers subsystems referenced in classes/Newsletters.php and classes/Admin/Subscribers/Table.php. When an administrator views the Subscribers list and clicks a contextual help tab anchor, wp-admin/js/common.js invokes jQuery(link.attr('href')), parsing the attacker payload as HTML and executing the injected script in the admin's browser session.
See the Wordfence Vulnerability Report and the WordPress Popup Maker Subscribers Table source for the affected code paths.
Detection Methods for CVE-2026-87915
Indicators of Compromise
- Subscriber records containing HTML entities, angle brackets, or href attribute values beginning with < in the values[Name] field.
- Unexpected outbound HTTP requests from WordPress administrator browser sessions after visiting the Subscribers admin page.
- New administrator accounts, modified user roles, or altered plugin/theme files following admin sessions on vulnerable sites.
- Presence of Popup Maker plugin version 1.24.0 or earlier on internet-facing WordPress installations.
Detection Strategies
- Inspect the Popup Maker subscribers database table for stored values containing script tags, event handlers, or encoded HTML entities in the Name column.
- Review web server access logs for POST requests to newsletter or subscriber endpoints containing suspicious payloads in values[Name].
- Correlate admin panel access with subsequent unexpected DOM modifications or AJAX activity in browser telemetry.
Monitoring Recommendations
- Enable WordPress activity logging to capture subscriber submissions and administrator page views on the Subscribers listing.
- Monitor for unauthorized changes to WordPress user accounts, options, and installed plugins after admin sessions.
- Alert on file integrity changes to wp-admin/, wp-content/plugins/, and wp-content/themes/ directories.
How to Mitigate CVE-2026-87915
Immediate Actions Required
- Update the Popup Maker plugin to version 1.25.0 or later on all WordPress installations.
- Audit the subscribers table for existing malicious payloads and remove or sanitize any entries containing HTML markup in the Name field.
- Rotate credentials for any WordPress administrator who accessed the Subscribers admin page while the vulnerable version was installed.
Patch Information
The vendor addressed this vulnerability in Popup Maker 1.25.0. The fix is applied in changeset 3690634, with the full diff between 1.24.0 and 1.25.0 available in the WordPress Popup Maker Version Update 1.25.0 changeset.
Workarounds
- Deactivate and remove the Popup Maker plugin until it can be updated to 1.25.0 or later.
- Restrict access to the WordPress admin interface using IP allow-lists or a web application firewall.
- Deploy WAF rules to block requests containing HTML markup or script content in the values[Name] parameter.
- Advise administrators to avoid interacting with contextual help tabs on the Subscribers page until patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.