Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
CVSS Details
- CVSS 3.1 Base Score: 6.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Addons For Divi Plugin | — | Update addons-for-divi plugin to version 4.0.6, or a newer patched version | Jul 9, 2025 | Jul 2, 2025 |
| Bold Page Builder Plugin | — | Update bold-page-builder plugin to version 5.1.3, or a newer patched version | Jul 9, 2025 | Jul 2, 2025 |
| Carousel Slider Plugin | — | Update carousel-slider plugin to version 2.2.15, or a newer patched version | Jul 9, 2025 | Jul 2, 2025 |
| Divi Builder Plugin | — | Update divi-builder plugin to version 4.27.2, or a newer patched version | Jul 9, 2025 | Jul 2, 2025 |
| Divi Theme | — | Update Divi theme to version 4.27.2, or a newer patched version | Dec 8, 2025 | Jul 2, 2025 |
| Essential Addons For Elementor Lite Plugin | — | Update essential-addons-for-elementor-lite plugin to version 6.0.5, or a newer patched version | Jul 9, 2025 | Jul 2, 2025 |
| Extra Theme | — | Update extra theme to version 4.27.2, or a newer patched version | Dec 8, 2025 | Jul 2, 2025 |
| Happy Elementor Addons Plugin | — | Update happy-elementor-addons plugin to version 3.12.3, or a newer patched version | Jul 9, 2025 | Jul 2, 2025 |
| Oceanwp Theme | — | Update oceanwp theme to version 3.6.1, or a newer patched version | Dec 8, 2025 | Jul 2, 2025 |
| Robo Gallery Plugin | — | Update robo-gallery plugin to version 3.2.23, or a newer patched version | Jul 9, 2025 | Jul 2, 2025 |
| Shortcodes Ultimate Plugin | — | Update shortcodes-ultimate plugin to version 7.4.3, or a newer patched version | May 25, 2026 | Jul 2, 2025 |
| Supreme Modules For Divi Plugin | — | Update supreme-modules-for-divi plugin to version 2.5.53, or a newer patched version | Jul 9, 2025 | Jul 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub