Unauthenticated XSS in Popup Maker

Executive Summary

This is an Unauthenticated Cross Site Scripting (XSS) vulnerability in the Popup Maker WordPress plugin versions 1.23.0 and below. It allows attackers to inject malicious scripts into websites that execute when visitors access the site, potentially causing redirects or unwanted content display. The exploit requires user interaction like clicking a malicious link.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress site is running Popup Maker version 1.23.0 or below. You can do this by inspecting the plugin version in the WordPress admin panel or via the command line using: wp plugin list | grep popup-maker. If the version is 1.23.0 or lower, the site is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

Attackers could steal user sessions, redirect visitors to malicious sites, or display harmful content. Since it requires user interaction, victims must click a malicious link or visit a crafted page. The impact includes potential data theft, compromised user accounts, and reputational damage to the website owner.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance risks include fines, legal action, and loss of trust due to compromised user data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Popup Maker to version 1.24.0 or later. If updating is not possible, apply the mitigation rule provided by Patchstack to block the exploit. Remove any suspicious scripts or content injected by attackers.

Useful 0 Not Useful 0