CVE-2022-1104: Popup Maker WordPress plugin stored XSS via unsanitised popup settings

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityRequires high privileges and user interaction, but public exploit code and a very high EPSS score raise the likelihood of attempted abuse.

What it is

The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its popup settings, allowing stored cross-site scripting. The flaw matters because the injected script persists in the site and executes for other users, even when the unfiltered_html capability is disallowed.

Impact

An attacker with high privileges such as admin can store script in popup settings that runs in the browser of anyone viewing the affected popup, enabling session theft or actions in the victim's context.

Attack surface

Reached over the network through the plugin's popup settings interface; the CVSS vector requires high privileges (PR:H) and user interaction (UI:R), so an authenticated admin-level user must submit the malicious setting and a victim must view the popup.

Exploitation

Not listed in CISA KEV, but EPSS is 0.56407 (99th percentile) and both references are tagged Exploit, indicating public exploit code exists.

What to do

• Update Popup Maker to version 1.16.5 or later.
• Restrict admin and other high-privilege WordPress accounts to trusted users and enforce least privilege.
• Review and remove any untrusted or unnecessary popup settings content after patching.
• Apply a web application firewall rule to block script payloads in popup settings submissions.

Detection

• Search the WordPress database for script tags or event handler attributes in Popup Maker popup settings.
• Monitor admin-side requests that modify popup settings for suspicious HTML or JavaScript content.
• Review web server and WAF logs for XSS payload patterns targeting Popup Maker endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.