CVE-2026-15797 danieliser CVE debrief

Who should care

WordPress administrators, security teams, and users with contributor-level access to WordPress sites using the Popup Maker plugin should assess exposure and apply updates. Additionally, operators of WordPress platforms and vulnerability management teams should review the vulnerability's impact on their environments and implement necessary mitigations. Security teams responsible for monitoring and incident response should also be aware of the potential for

Why it matters

CVE-2026-15797 allows authenticated attackers to inject web scripts via post_title in Popup Maker plugin versions up to 1.24.0. WordPress administrators and security teams should assess exposure and apply updates.

• Attackers can inject web scripts that execute on page access.
• Contributor-level access is sufficient for exploitation.
• Requires creation of a post with an HTML entity-encoded payload.

Technical summary

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to, and including, 1.24.0. This is due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability requires the attacker to create a post with an HTML entity-encoded payload in the title, which bypasses sanitize_text_field on save and is later decoded and executed by the browser when rendered by the Select2 component. The issue affects WordPress administrators, security teams, and users with contributor-level access to

Defensive priority

Medium priority for WordPress administrators and security teams to assess exposure and apply updates.

Recommended defensive actions

• Assess exposure by checking if the Popup Maker plugin version is 1.24.0 or earlier.
• Verify that contributor-level access controls are properly implemented.
• Apply updates to the Popup Maker plugin as soon as available.
• Monitor for suspicious post_title activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows authenticated attackers with contributor-level access to inject arbitrary web scripts. The issue requires the attacker to create a post with an HTML entity-encoded payload in the title.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.