XSS vulnerability

Magnific Popup uses a parameter called preloader, which by default is set to true.

Using a specifically crafted payload (in src URL) two things happen:

Initially, the text variable in the updateStatus function is set to “Loading…”

Then it takes the value passed to it by the default error handling function (which contains the URL).

mfp.updateStatus('error', imgSt.tError.replace('%url%', item.src) );

The problem here is that the .html() function does not escape HTML and could be used to inject code.

The vulnerability, if exploitable, can even lead to "stored XSS".