{"id":"CVE-2026-109989","kind":"vulnerability","aliases":["CVE-2026-109989"],"related":[],"title":"Themify Popup for WordPress: stored script injection via popup width setting","description":"The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The Themify Popup WordPress plugin up to and including 1.4.7 does not sanitize the 'popup_width_unit' parameter. An author-level user can store script that runs in the browser of any visitor who opens a page carrying the injected popup.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","themify","wordpress"],"not_affected_if":["only-trusted-editors","plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed Themify Popup plugin version in the WordPress admin plugins list or with `wp plugin get themify-popup --field=version` (plugin slug unknown from sources; confirm the slug).\n- Look for the plugin's popup settings in posts or pages created by authors for `popup_width_unit` values containing script tags.","fix":"- Update the Themify Popup plugin to a version later than `1.4.7` (exact fixed version unknown from sources).\n- Until updated, restrict author accounts to trusted users only.","status":"open","published_at":"2026-10-17T04:16:51+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:59:37+00:00","updated_at":"2026-10-25T03:59:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:59:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Themify Popup plugin to a version later than `1.4.7` (exact fixed version unknown from sources).\n- Until updated, restrict author accounts to trusted users only.","reach":"internet","title":"Themify Popup for WordPress: stored script injection via popup width setting","impact":"medium","summary":"The Themify Popup WordPress plugin up to and including 1.4.7 does not sanitize the 'popup_width_unit' parameter. An author-level user can store script that runs in the browser of any visitor who opens a page carrying the injected popup.","category":"package","nicknames":[],"who_cares":["wordpress","themify","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Injected script runs in visitors' browsers, stealing sessions or actions.","analyst_note":"","how_to_check":"- Check the installed Themify Popup plugin version in the WordPress admin plugins list or with `wp plugin get themify-popup --field=version` (plugin slug unknown from sources; confirm the slug).\n- Look for the plugin's popup settings in posts or pages created by authors for `popup_width_unit` values containing script tags.","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-updated","only-trusted-editors"],"who_is_affected":"Sites running the Themify Popup plugin at version `1.4.7` or earlier where author-level or higher accounts can edit content. Sites without the plugin, or where only trusted administrators publish content, face much lower risk. unknown whether managed hosting changes exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000629,"input_tokens":3367,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109989':14A,17A '-2026':13A,16A '1.4.7':33B,93C 'access':113C,129C 'arbitrari':118C 'attack':108C 'authent':107C 'author':44B,111C 'author-level':43B,110C 'browser':54B 'carri':62B 'cross':77C 'cross-sit':76C 'cve':12A,15A 'due':94C 'escap':101C 'execut':125C 'host':21B 'includ':32B,92C 'inject':7A,64B,117C,131C 'input':97C 'insuffici':96C 'level':45B,112C 'make':103C 'open':59B 'output':100C 'packag':18B 'page':61B,122C,132C 'paramet':41B,85C 'plugin':28B,69C 'popup':2A,9A,26B,38B,65B,68C,82C 'possibl':105C 'run':51B 'sanit':36B,98C 'script':6A,49B,79C,120C 'self':20B 'self-host':19B 'set':11A 'site':78C 'store':5A,48B,75C 'themifi':1A,22B,25B,67C 'unit':40B,84C 'user':46B,128C 'version':88C 'via':8A,80C 'visitor':57B 'vulner':73C 'web':119C 'whenev':126C 'width':10A,39B,83C 'wordpress':4A,23B,27B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Themify Popup plugin at version `1.4.7` or earlier where author-level or higher accounts can edit content. Sites without the plugin, or where only trusted administrators publish content, face much lower risk. unknown whether managed hosting changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T04:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109989","severity":null,"published_at":"2026-10-17T04:16:51+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}