CVE-2025-9490

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9490", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-26T13:36:25.900Z", "datePublished": "2025-09-26T05:27:21.171Z", "dateUpdated": "2026-04-08T17:04:25.526Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:25.526Z"}, "affected": [{"vendor": "danieliser", "product": "Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.20.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018title\u2019 parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84861460-5257-466e-b2c1-4b8abcf86bd1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.20.6/includes/importer/easy-modal-v2.php#L259"}, {"url": "https://wordpress.org/plugins/popup-maker/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362078%40popup-maker&new=3362078%40popup-maker&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-09-25T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-26T19:49:08.537886Z", "id": "CVE-2025-9490", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T19:49:21.771Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9490", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-26T19:49:08.537886Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T19:49:16.723Z"}}], "cna": {"title": "Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "danieliser", "product": "Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.20.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-25T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84861460-5257-466e-b2c1-4b8abcf86bd1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.20.6/includes/importer/easy-modal-v2.php#L259"}, {"url": "https://wordpress.org/plugins/popup-maker/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362078%40popup-maker&new=3362078%40popup-maker&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018title\u2019 parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-26T05:27:21.171Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9490", "state": "PUBLISHED", "dateUpdated": "2025-09-26T19:49:21.771Z", "dateReserved": "2025-08-26T13:36:25.900Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-26T05:27:21.171Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder", "vendor": "danieliser", "versions": [{"lessThanOrEqual": "1.20.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018title\u2019 parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Popup Maker para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'title' en todas las versiones hasta la 1.20.6, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel Colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-9490", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9490", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-26T19:49:08.537886Z", "version": "2.0.3"}}]}, "published": "2025-09-26T06:15:36.633", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.20.6/includes/importer/easy-modal-v2.php#L259"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362078%40popup-maker&new=3362078%40popup-maker&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/popup-maker/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84861460-5257-466e-b2c1-4b8abcf86bd1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:00:23.424567+00:00", "value": {"mitigation_remediation": ["Upgrade to Popup Maker version 1.20.7 or later to remove the stored XSS vulnerability.", "If an upgrade is not immediately possible, restrict Contributor and higher roles to the minimal set of permissions needed for their tasks and consider revoking the ability to edit popup titles through plugin settings or custom code hooks.", "Implement an input filter or sanitization layer that strips potentially dangerous script content from the title field before saving."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting that allows an authenticated Contributor or higher to inject and execute arbitrary scripts on pages containing the popup"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the Popup Maker plugin developed by danieliser installed in any release up to and including version 1.20.6. The vulnerability requires a user account with at least Contributor access; any authenticated Contributor can trigger it.", "description_and_impact": "The Popup Maker plugin for WordPress contains a stored cross\u2011site scripting flaw in the title parameter of its popup editor. Because the value is not properly sanitized or escaped, an authenticated user with Contributor or higher permissions can inject malicious scripts that are later executed by any visitor who opens a page containing the vulnerable popup. This flaw is classified as CWE\u201179 and provides attackers with direct code execution in the context of the visited site, potentially leading to session hijacking, defacement, or further attacks on other users.", "risk_and_exploitability": "The CVSS score of 6.4 reflects a moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Attackers would need to log in with appropriate permissions, edit a popup title to include malicious script code, and then save the change. Once saved, the script runs whenever any user loads a page that displays the popup, allowing the attacker to execute arbitrary code in the victim's browser context."}}}}, "created": "2025-09-29T09:31:27.262572+00:00", "updated": "2026-04-21T19:00:36.146502+00:00", "vendors": ["popup_maker", "popup_maker$PRODUCT$popup_maker_wp", "wordpress", "wordpress$PRODUCT$wordpress"]}