Popup Maker — Vulnerabilities & Security Advisories 4

Popup Maker is a WordPress plugin for creating custom popups and modals. Historically, it has been vulnerable to multiple security issues including stored cross-site scripting (XSS) through improper input sanitization, arbitrary file deletion leading to privilege escalation, and remote code execution via unsafe deserialization. The plugin's four recorded CVEs highlight risks from insufficient access controls and insecure data handling. While no major public incidents have been widely documented, the consistent pattern of vulnerabilities in a popular plugin with over 1 million active installations makes it a persistent target for attackers seeking to exploit WordPress sites.