What the vulnerability does
01Description
The Popup Box – Easily Create WordPress Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Explanation of Vulnerability in Simple Terms
02Summary
The Popup Box plugin for WordPress contains an OS command injection vulnerability in versions up to 3.2.12. An authenticated attacker with low privileges can execute arbitrary system commands on the server by injecting malicious input into an unvalidated parameter. The vulnerability has scope impact, meaning it may affect other components or users on the site.
What an attacker can do
03Attacker Capabilities
Run arbitrary system commands on the web server with the privileges of the WordPress process.
Potential impact on your site
04Site Impact
An attacker with a basic WordPress account can execute code on your server, potentially compromising your entire site and hosting account.
Conditions required to exploit
05Prerequisites
Attacker must have a WordPress user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
February 18, 2026
CVE published
April 8, 2026
Record updated
