CVE-2026-7850
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk9th percentile — higher than 9% of all known CVEs
Summary
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM, allowing for Stored Cross-Site Scripting attacks.
Risk Assessment
The risk affects authenticated attackers with Author-level access who can perform attacks against any visiting user.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability.
Original NVD description (English source)
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.