CVE-2026-7850 — WP Magnific Popup <= 1.0 - Author+ Stored XSS via href Attribute

CVE-2026-7850

WP Magnific Popup <= 1.0 - Author+ Stored XSS via href Attribute PUBLISHED

Description (CNA)

The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Magnific Popup	affected 0 through 1.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/30f408dd-4b9a-438c-8dc4-c6daafe237fe/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.