CVE-2026-77115 is a reflected cross-site scripting vulnerability in a WordPress popup builder plugin (version 0.8.5). The plugin reflects UTM parameters from the URL query string directly into popup HTML without escaping—an attacker can craft a URL like example.com/?utm_source=<script>malicious()</script> and, if a visitor clicks it, the payload executes in their browser context.
This is not a theoretical bug. The exploitation path requires nothing more than getting a user to click a link—the same mechanism that makes phishing effective. The marketing context actually amplifies the risk: users are conditioned to click tracked links from email campaigns, ads, and influencer partnerships. The popup displays their attribution source, making the social engineering angle ('look where you came from') more plausible than generic URL payloads.
The deeper problem is that this is a structural attractor in marketing tools. Popup builders, conversion trackers, and analytics plugins must read UTM parameters and display them to users—that's the job. And the most naive implementation of that job is exactly echo $_GET['utm_source'] into innerHTML. WordPress provides esc_html() and esc_attr() for exactly this purpose, but the unsafe pattern persists because the feature itself puts developers one step from the vulnerable code.
What to check: audit any plugin or theme that displays UTM parameters, referrer data, or query string values in HTML. Look for direct concatenation of $_GET or $_REQUEST values into output without escaping functions. If your site runs a popup builder, conversion tracker, or any marketing-related plugin that displays attribution data, verify it's escaping these parameters. The CVSS 7.1 rating undersells the risk—the blast radius extends beyond the initial victim because UTM data typically flows through analytics pipelines, potentially contaminating data your team trusts in reports.