We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder Plugin Vulnerability (CVE-2026-15797)

Nick Paliughi
On this page

Security Alert Summary

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the post_title field in affected versions. Authenticated users with contributor-level access and above can inject an HTML entity-encoded payload into a post title that bypasses sanitize_text_field on save and is later decoded and executed by the browser when rendered by the Select2 component, causing arbitrary script execution for users who view the injected page.

CVE Details

  • CVE ID: CVE-2026-15797
  • Affected component: Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder (plugin)
  • Affected versions: All versions up to and including 1.24.0
  • Published: September 18, 2026 at 10:17:06 AM UTC
  • Last modified: September 18, 2026 at 1:23:37 PM UTC
  • CVSS v3.1: Base score 6.4, MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • Authentication / Privileges / User interaction: Requires authenticated user with low privileges (contributor-level or higher). No user interaction required once payload is stored.
  • Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
  • Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)

Technical Details

This vulnerability is a stored cross-site scripting issue in the plugin’s handling of post titles. Insufficient input sanitization and output escaping allow an attacker with contributor-level access or higher to store an HTML entity-encoded payload in a post title. The payload bypasses sanitize_text_field on save and is later decoded by the browser when the title is rendered via the Select2 component, resulting in arbitrary script execution in the context of a user’s browser when they view the affected page.

The core cause is a mismatch between server-side sanitization and the client-side rendering behavior that decodes entity-encoded content. The vulnerability description names sanitize_text_field and the Select2 component as relevant to how the payload is saved and later rendered. When the browser decodes and executes the stored payload, a range of client-side attacks become possible within the bounds of the user’s permissions.

How This Could Impact Your Website

Consider a typical site with an owner, internal staff editors, and external contributors. A malicious contributor could create a post whose title contains an entity-encoded script. When an editor or site administrator visits the post listing or any admin interface that renders the title via Select2, that script could execute in their browser session.

Practical consequences include exposure of information visible to the rendered page (for example, browser-accessible profile data), and an increased risk of targeted phishing or social engineering against staff whose accounts are accessible in the admin interface. This type of stored XSS can also be used to perform actions in the context of the victim user if those actions are available in the browser and not further protected by additional checks.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially contributor-level accounts.
  • Enforce strong passwords and two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins.
  • Monitor site activity and admin logs for unusual behavior, including unexpected posts created by low-privilege accounts.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Newsletter – Send awesome emails from WordPress plugin for WordPress Vulnerability (CVE-2026-90981)
Next Post
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin Vulnerability (CVE-2026-92554)