{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2420", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-12T20:04:14.840Z", "datePublished": "2026-03-07T07:22:03.351Z", "dateUpdated": "2026-04-08T16:35:39.957Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:39.957Z"}, "affected": [{"vendor": "lotekmedia", "product": "LotekMedia Popup Form", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LotekMedia Popup Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the frontend of the site where the popup is displayed."}], "title": "LotekMedia Popup Form <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f45583e-1438-47af-871c-efd59345c727?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ltm-popup-form/trunk/ltm-popup-form.php#L80"}, {"url": "https://plugins.trac.wordpress.org/browser/ltm-popup-form/tags/1.0.6/ltm-popup-form.php#L80"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "trung Hieu"}], "timeline": [{"time": "2026-03-06T18:48:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T17:31:36.293572Z", "id": "CVE-2026-2420", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:29:11.600Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2420", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T17:31:36.293572Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T17:31:37.290Z"}}], "cna": {"title": "LotekMedia Popup Form <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings", "credits": [{"lang": "en", "type": "finder", "value": "trung Hieu"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "lotekmedia", "product": "LotekMedia Popup Form", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-06T18:48:27.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f45583e-1438-47af-871c-efd59345c727?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ltm-popup-form/trunk/ltm-popup-form.php#L80"}, {"url": "https://plugins.trac.wordpress.org/browser/ltm-popup-form/tags/1.0.6/ltm-popup-form.php#L80"}], "descriptions": [{"lang": "en", "value": "The LotekMedia Popup Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the frontend of the site where the popup is displayed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-07T07:22:03.351Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2420", "state": "PUBLISHED", "dateUpdated": "2026-03-09T18:29:11.600Z", "dateReserved": "2026-02-12T20:04:14.840Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-07T07:22:03.351Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The LotekMedia Popup Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the frontend of the site where the popup is displayed."}, {"lang": "es", "value": "El plugin LotekMedia Popup Form para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n del plugin en todas las versiones hasta la 1.0.6, inclusive, debido a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida deficiente. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda al frontend del sitio donde se muestra la ventana emergente."}], "id": "CVE-2026-2420", "lastModified": "2026-04-22T21:27:27.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-03-07T08:16:11.023", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ltm-popup-form/tags/1.0.6/ltm-popup-form.php#L80"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ltm-popup-form/trunk/ltm-popup-form.php#L80"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f45583e-1438-47af-871c-efd59345c727?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LotekMedia Popup Form", "source": "cna", "vendor": "lotekmedia"}, "product": "lotekmedia_popup_form", "vendor": "lotekmedia"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T19:51:58.840046+00:00", "value": {"mitigation_remediation": ["Upgrade the LotekMedia Popup Form plugin to the latest version or uninstall it if it is no longer required.", "If updating is delayed, remove or reduce administrator privileges on accounts that do not need them and consider setting the lowest privilege role that can use the plugin.", "Manually review and sanitize the plugin settings on the site, removing any embedded script tags, and add input sanitization routines to prevent future injection."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "Affected systems are WordPress sites that have the LotekMedia Popup Form plugin installed, versions 1.0.6 and earlier. The plugin may appear in any WordPress installation that relies on it to display pop\u2011ups. No specific operating system or PHP version constraints are listed.", "description_and_impact": "The LotekMedia Popup Form plugin for WordPress allows logged\u2011in administrators to modify plugin settings. A flaw in the input handling makes it possible for these privileged users to inject arbitrary JavaScript into the stored settings. When a user visits a page that displays the popup, the malicious script executes in the visitor\u2019s browser, enabling hijacking of sessions, theft of cookies, or defacement of the site. This is a classic stored cross\u2011site scripting vulnerability (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. Because the flaw requires administrator authentication, an attacker must first compromise or be granted admin access to the site. Once authenticated, injecting script into the plugin settings is trivial. Though not listed in CISA\u2019s KEV catalog, the vulnerability remains a risk for sites that have not applied an official patch or do not restrict administrator access appropriately."}}}}, "created": "2026-03-09T10:05:43.392115+00:00", "updated": "2026-04-15T20:00:06.614671+00:00", "vendors": ["lotekmedia", "lotekmedia$PRODUCT$lotekmedia_popup_form", "wordpress", "wordpress$PRODUCT$wordpress"]}