Input validation vulnerability in Popularis Extra 1.2.6

The Popularis Extra plugin for WordPress has a security issue called Reflected Cross-Site Scripting, which affects all versions including 1.2.6. This allows attackers to insert harmful web scripts into pages that can be executed if a user clicks on a link. The vulnerability is caused by the plugin’s use of add_query_arg and remove_query_arg without properly securing the URL. This means that even users who are not logged in can be targeted.