CVE-2026-54192: WordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected Cross-Site Scripting (XSS) in the Popup box WordPress plugin (versions up to and including 6.2.9) allows an unauthenticated attacker to inject malicious JavaScript into a victim's browser by tricking them into clicking a crafted link. The attack is delivered over the network and requires no authentication, but does require the victim to follow the attacker-controlled URL. Successful exploitation gives the attacker script execution in the victim's browser session, enabling session theft, page content manipulation, or unauthorized actions on the victim's behalf. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a crafted URL to a victim who has network access to the WordPress site, making over-the-network exposure a prerequisite.

• AuthenticationNot required

  No account or credentials are needed; the malicious payload can be embedded in a link sent to any user, including unauthenticated visitors.

• Victim interactionRequired

  The victim must click or follow the attacker-crafted URL, making social engineering (for example, phishing or a malicious redirect) a necessary step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental factors beyond delivering the link.

Blast Radius

• The attacker executes arbitrary JavaScript in the victim's browser session, giving access to session cookies and authentication tokens stored for that origin.
• The attacker can read and exfiltrate any page content visible to the victim, including personal data, form inputs, or WordPress admin information if the victim is a logged-in administrator.
• The attacker can modify page content rendered in the victim's browser, enabling credential-harvesting overlays or redirection to external sites.
• Because the scope is changed (S:C in the CVSS vector), the injected script can interact with resources beyond the vulnerable plugin itself, including other components loaded on the same WordPress installation.