CVE-2021-24883: Essentialplugin Popup Anything

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

Affected products

• Essentialplugin Popup Anything: before 2.0.4 (fixed in 2.0.4)

Published 2021-11-29. Last modified 2026-06-17.