In noscript's settings, I set the sister site's URL itself and cloudfare (which hosts the thumbnails) to trusted, while leaving everything else default. No pop-ups, and so far everything seems to be working fine.