Nelio Popups Vulnerabilities

The Nelio Popups plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.3.5

Fixed in:

1.3.6

Disclosed:

Jan 29, 2026

CVE-2026-25016 on NVD →

The Nelio Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha...

CVSS:

6.4

Affected:

up to 1.3.0

Fixed in:

1.3.1

Disclosed:

Dec 10, 2025

CVE-2025-66111 on NVD →