CVE-2020-36715

The Login/Signup Popup plugin for WordPress has a security flaw that allows attackers to bypass authorization checks. In affected versions, including 1.4, certain plugin functions lack necessary permission checks, enabling malicious users to inject malicious scripts into the plugin settings. If a user is tricked into performing a specific action, such as clicking a link, the injected scripts can execute.

Based on public CVE data (MITRE/NVD).