The Popup Maker plugin for WordPress, versions up to and including 1.24.0, is vulnerable to Stored Cross-Site Scripting via the values[Name] parameter. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability stems from insufficient input sanitization and output escaping. The wp_kses sanitization applied on output is insuff [truncated]
The Popup Maker plugin for WordPress, versions up to and including 1.24.0, is vulnerable to Stored Cross-Site Scripting via the post_title field. This vulnerability allows authenticated attackers with contributor-level access to inject arbitrary web scripts by creating a post with an HTML entity-encoded payload in the title. The browser decodes and executes the script when a user accesses the injected pag [truncated]
