CVE-2023-3226

The Popup Builder plugin for WordPress prior to version 4.2.2 contains a stored cross-site scripting vulnerability in its administrative settings that allows authenticated administrators to inject malicious scripts due to inadequate input validation and output encoding. These injected scripts execute when users visit affected pages, though the vulnerability is limited to multisite WordPress installations or those where the unfiltered_html capability has been restricted. The flaw requires administrator-level access or higher privileges to exploit.

Based on public CVE data (MITRE/NVD).