blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-85005

MEDIUM 5.4 CVSS 3.1
Published
October 2, 2026
Last modified
October 2, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Description

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.

Affected products and versions

  • Unknown Popup Maker WP — From 1.2.2.1 (including) to 1.4.5 (including)

References

  • wpscan.com https://wpscan.com/vulnerability/bddba59e-ab36-427f-9b21-98144bf783ff/
  • nvd.nist.gov Official NVD record