CVE-2026-7850: WP Magnific Popup Stored XSS (CVSS 5.9)

Technical summary

The vulnerability stems from improper output encoding of user-controlled URLs in DOM injection contexts. When the plugin displays an error message for a failed image load, it takes a URL parameter (likely from post or page content edited by Authors) and inserts it directly into the DOM without sanitization or escaping. An attacker with Author role or above can craft a URL containing JavaScript—such as javascript: or event handler attributes—which the plugin then injects unsanitized. Modern browsers will execute this JavaScript in the security context of the WordPress site, allowing session hijacking, credential theft, or malware distribution. The attack surface is stored rather than reflected, meaning the payload persists in the database and affects all subsequent page loads until remediated.

Business impact

A compromised Author account on a multi-user WordPress site can distribute malware or steal credentials from all site visitors, including administrators. For sites with payment processing, customer data collection, or sensitive business workflows, this can lead to data breaches, compliance violations (GDPR, PCI-DSS), and reputational damage. The stored nature of the XSS means a single compromised account can compromise the entire site audience. Organizations running WordPress with user-generated content or collaborative editing workflows face elevated risk if they do not control Author-level access carefully.

Affected systems

WP Magnific Popup plugin through version 1.0 running on WordPress sites. The vulnerability requires an authenticated attacker with Author role or above, limiting the attack surface to internal users (staff, contributors, or community members granted publishing rights). WordPress instances without strict Author access controls are at higher risk. The plugin's popularity and typical use in image galleries and lightbox scenarios means exposure could be moderate depending on plugin adoption rates.

Exploitability

Exploitation requires a valid WordPress user account with Author-level permissions or higher. While this is not public/unauthenticated exploitation, compromised Author accounts—whether through credential theft, insider threat, or plugin vulnerabilities in other plugins—can be leveraged to inject the payload. Once injected, no further user interaction is required for the payload to spread; every visitor to the affected page will execute the malicious script. The CVSS vector (AV:N/AC:L/PR:H/UI:R) reflects network accessibility, low complexity, high privilege requirement, and required user interaction (visiting the page), yielding a base score of 5.9 (Medium). In practice, Author compromise is a real threat vector in collaborative WordPress environments.

Remediation

Update WP Magnific Popup to a patched version that properly escapes URLs before DOM injection. Until a patch is available, disable or remove the plugin. If the plugin is critical to site function, implement restrictive Author-level access controls: audit which users have Author or Editor roles, restrict assignment to trusted staff, and monitor user activity for unusual content modifications. As an interim measure, consider using a Web Application Firewall (WAF) rule to detect or block script injection patterns in image error parameters, though this is not a substitute for patching.

Patch guidance

Check the WP Magnific Popup plugin repository and the vendor's security advisories for a patched version later than 1.0. When a patch becomes available, test it in a staging environment to ensure compatibility with your WordPress version and other active plugins, then deploy to production. If no patch is released within a reasonable timeframe or the vendor has abandoned the plugin, consider switching to a maintained alternative lightbox/popup plugin that follows secure coding practices.

Detection guidance

Look for suspicious modifications to image URLs or error message content in post/page metadata within the WordPress database. Search the wp_posts and wp_postmeta tables for anomalous script tags or javascript: URIs associated with recent Author edits. Monitor admin audit logs (if a logging plugin is active) for unexpected post revisions or metadata changes by Author-level users. On the front-end, check browser console and network logs for unexpected script execution or external resource loads triggered by the image error handler. Correlate Author account login times with suspicious database changes.

Why prioritize this

Prioritize patching if your WordPress site has multiple Author-level users, publicly accessible content, or financial/sensitive data. The 5.9 Medium CVSS score reflects limited attack surface (requires high privilege), but the stored XSS impact is severe: full compromise of visitor sessions. If your site grants Author access only to fully-trusted internal staff and uses robust access controls, risk is lower. Conversely, community-driven or multi-tenant WordPress setups should treat this as high priority given the ease of leveraging a compromised Author account.

Risk score, explained

CVSS 3.1 score of 5.9 (Medium) reflects the attack vector (network-accessible), complexity (low), privilege level (high—Author required), and user interaction (required—victim must visit the page). The scope is changed (affects resources beyond the vulnerable component), and confidentiality, integrity, and availability impacts are all low (L). The score appropriately captures that while the attack requires authentication, the stored nature and cross-user impact elevate it beyond a simple low-severity flaw. Real-world severity depends on your user access model: highly restrictive Author access lowers practical risk; permissive access models raise it.

Frequently asked questions