6.4 Moyenne

CVE-2026-109989 The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter…

Description

The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Themify Popup 1.4	premières → 1.4.7	Pas de correctif indiqué

Les 2 CVE de Themify Popup →

CVE-2025-58787 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme… 6.5 Moyenne

Vous utilisez Themify Popup ?

Suivre cette CVE Surveiller Themify Popup Vérifier mes SBOM

www.cveye.io/fr/cve/CVE-2026-109989

Chronologie

Publiée 17 octobre 2026
Dernière modification 18 octobre 2026

Références

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org

Suivre cette CVE

CVE-2026-109989 The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter…

Description

Produits et versions touchés

Autres CVE de Themify Popup