{"vulnerability": "CVE-2026-109989", "sightings": [{"uuid": "e7ac3177-23c5-4ebe-8dd7-275fdbc11e52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-109989", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117454228440357755", "content": "CVE-2026-109989 Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109989https://www.wordfence.com/threat-intel/vulnerabilities/id/da003985-7fb2-4f5b-bb70-6ec3578ef3e8?source=cvehttps://plugins.trac.wordpress.org/browser/themify-popup/tags/1.4.7/views/styles.php#L29https://plugins.trac.wordpress.org/browser/themify-popup/tags/1.4.7/includes/themify-metabox/includes/themify-metabox-core.php#L209https://plugins.trac.wordpress.org/browser/themify-popup/tags/1.4.7/includes/themify-metabox/includes/themify-metabox-core.php#L151https://plugins.trac.wordpress.org/changeset?reponame=&old=3749602%40themify-popup&new=3749602%40themify-popup#wordpress #themifyme #ThemifyPopup#CVE_2026_109989#bot", "creation_timestamp": "2026-10-17T03:54:56.799652Z"}]}