CVE-2026-15797 danieliser CVE debrief

Who should care

Defenders responsible for WordPress installations using the Popup Maker plugin, especially those with users having contributor-level access, should assess exposure and prioritize verification and potential remediation.

Why it matters

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing authenticated attackers with contributor-level access to inject arbitrary web scripts. Defenders should prioritize verifying exposure, especially for users with contributor-level access, and consider upgrading to a patched version.

• Defenders need to verify the presence of this vulnerability in their WordPress installations.
• Exposure could lead to unauthorized script injection and execution.
• Remediation priority is medium due to the CVSS score of 6.4.
• Further verification is required to determine the full scope of affected versions and potential exploitation.

Technical summary

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_title field in versions up to and including 1.24.0. This is due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access can inject arbitrary web scripts by creating a post with an HTML entity-encoded payload in the title. The browser will decode and execute the script when a user accesses the injected page.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure, especially for users with contributor-level access.

Recommended defensive actions

• Verify the presence of the Popup Maker plugin in your WordPress installation and check if the version is 1.24.0 or earlier.
• Assess exposure for users with contributor-level access and above.
• Consider upgrading to a patched version of the plugin, if available.
• Monitor for suspicious activity, especially related to post creation and user interactions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Multiple source references from Wordfence provide additional context and code snippets related to the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.