CVE-2026-15797

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to create a post with an HTML entity-encoded payload in the title, which bypasses sanitize_text_field on save and is later decoded and executed by the browser when rendered by the Select2 component.

• CWE-79

• https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/classes/Admin/Ajax.php#L152
• https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/classes/Admin/Ajax.php#L163
• https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/classes/Helpers.php#L192
• https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/dist/assets/admin-general.js#L1
• https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.23.0/classes/Admin/Ajax.php#L152
• https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.23.0/classes/Admin/Ajax.php#L163
• https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.23.0/classes/Helpers.php#L192
• https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.23.0/dist/assets/admin-general.js#L1
• https://plugins.trac.wordpress.org/changeset/3690634/popup-maker/trunk/classes/Admin/Ajax.php
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3690634%40popup-maker%2Ftags%2F1.25.0&old=3648112%40popup-maker%2Ftags%2F1.24.0
• https://www.wordfence.com/threat-intel/vulnerabilities/id/973b23c6-4edd-4f89-b5cf-68e83cfdb8ac?source=cve

Published

Sep 18, 2026

Last Modified

Sep 19, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15790The Youtube Showcase plugin for WordPress is vulnerable to S…6.4
• CVE-2026-15791A crafted message in the BuildKit low-level build API can be…7.5
• CVE-2026-15792A malicious BuildKit client or frontend could craft a reques…7.5
• CVE-2026-15793BuildKit custom frontends or clients using the raw low-level…7.5
• CVE-2026-15794The Grid/List View for WooCommerce plugin for WordPress is v…6.4
• CVE-2026-15796The Builderall for WordPress plugin for WordPress is vulnera…6.4
• CVE-2026-15798The Smart Slider 3 plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-15799Rejected reason: This is a duplicate.
• CVE-2026-1580A security issue was discovered in ingress-nginx where the `…8.8
• CVE-2026-15801A vulnerability was found in CRI-O related to the container …8
• CVE-2026-15802The WP Foodbakery plugin for WordPress is vulnerable to arbi…8.1
• CVE-2026-15803In Eclipse RDF4J, several XML parser entry points do not ful…8.7