CVE-2026-77115

CVE-2026-77115 is a reflected cross-site scripting vulnerability in a WordPress popup builder plugin (version 0.8.5). The plugin reflects UTM parameters from the URL query string directly into popup HTML without escaping—an attacker can craft a URL like `example.com/?utm_source=<script>malicious()</script>` and, if a visitor clicks it, the payload executes in their browser context. This is not a theoretical bug. The exploitation path requires nothing more than getting a user to click a link—the same mechanism that makes phishing effective. The marketing context actually amplifies the risk: users are conditioned to click tracked links from email campaigns, ads, and influencer partnerships. The popup displays their attribution source, making the social engineering angle ('look where you came from') more plausible than generic URL payloads. The deeper problem is that this is a structural attractor in marketing tools. Popup builders, conversion trackers, and analytics plugins must read UTM parameters and display them to users—that's the job. And the most naive implementation of that job is exactly `echo $_GET['utm_source']` into innerHTML. WordPress provides `esc_html()` and `esc_attr()` for exactly this purpose, but the unsafe pattern persists because the feature itself puts developers one step from the vulnerable code. What to check: audit any plugin or theme that displays UTM parameters, referrer data, or query string values in HTML. Look for direct concatenation of `$_GET` or `$_REQUEST` values into output without escaping functions. If your site runs a popup builder, conversion tracker, or any marketing-related plugin that displays attribution data, verify it's escaping these parameters. The CVSS 7.1 rating undersells the risk—the blast radius extends beyond the initial victim because UTM data typically flows through analytics pipelines, potentially contaminating data your team trusts in reports.

Reviewed through automated stages and approved by a human before publication.