{"metadata": {"vulnerability": "CVE-2026-109989", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-13T12:33:27.631Z", "date_only": false, "value": "2026-10-13T12:33:27.631Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109989", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T12:49:09Z", "date_only": false, "value": "2026-10-13T12:49:09.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109989", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-16T14:36:36Z", "date_only": false, "value": "2026-10-16T14:36:36.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109989", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-17T03:43:30.393Z", "date_only": false, "value": "2026-10-17T03:43:30.393Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109989", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-17T03:43:30.393Z", "date_only": false, "value": "2026-10-17T03:43:30.393Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109989", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-17T03:54:56.799Z", "date_only": false, "value": "2026-10-17T03:54:56.799652Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117454228440357755", "record": "CVE-2026-109989", "field": "creation_timestamp", "uuid": "e7ac3177-23c5-4ebe-8dd7-275fdbc11e52", "content": "CVE-2026-109989 Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109989https://www.wordfence.com/threat-intel/vulnerabilities/id/da003985-7fb2-4f5b-bb70-6ec3578ef3e8?source=cvehttps://plugins.trac.wordpress.org/browser/themify-popup/tags/1.4.7/views/styles.php#L29https://plugins.trac.wordpress.org/browser/themify-popup/tags/1.4.7/includes/themify-metabox/includes/themify-metabox-core.php#L209https://plugins.trac.wordpress.org/browser/themify-popup/tags/1.4.7/includes/themify-metabox/includes/themify-metabox-core.php#L151https://plugins.trac.wordpress.org/changeset?reponame=&old=3749602%40themify-popup&new=3749602%40themify-popup#wordpress #themifyme #ThemifyPopup#CVE_2026_109989#bot", "url": "https://infosec.exchange/users/cve/statuses/117454228440357755"}, {"timestamp": "2026-10-17T04:16:51Z", "date_only": false, "value": "2026-10-17T04:16:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5JFW-8M7V-H73M", "record": "GHSA-5JFW-8M7V-H73M", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-17T04:16:51.907Z", "date_only": false, "value": "2026-10-17T04:16:51.907", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109989", "record": "FKIE_CVE-2026-109989", "field": "published"}, {"timestamp": "2026-10-17T06:30:33Z", "date_only": false, "value": "2026-10-17T06:30:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5JFW-8M7V-H73M", "record": "GHSA-5JFW-8M7V-H73M", "field": "published"}, {"timestamp": "2026-10-17T06:30:33Z", "date_only": false, "value": "2026-10-17T06:30:33Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5JFW-8M7V-H73M", "record": "GHSA-5JFW-8M7V-H73M", "field": "modified"}, {"timestamp": "2026-10-18T11:06:59.962Z", "date_only": false, "value": "2026-10-18T11:06:59.962713Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109989", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-18T11:06:59.962Z", "date_only": false, "value": "2026-10-18T11:06:59.962713Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109989", "record": "FKIE_CVE-2026-109989", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-18T11:12:34.106Z", "date_only": false, "value": "2026-10-18T11:12:34.106Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109989", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-18T11:12:34.106Z", "date_only": false, "value": "2026-10-18T11:12:34.106Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109989", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T15:16:45.150Z", "date_only": false, "value": "2026-10-19T15:16:45.150", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109989", "record": "FKIE_CVE-2026-109989", "field": "lastModified"}]}