CVE-2026-102398
HighCVSS 7.1Summary
The Popup by Supsystic plugin versions 1.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
Risk of session theft, cookie theft, or other user data compromise, as well as account takeover.
Recommendation
Update the Popup by Supsystic plugin to the latest version that includes the fix.
Other vulnerabilities in Popup by Supsystic
See all- CVE-2026-73381Critical
Unauthenticated Broken Authentication vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can bypass authentication mechanisms.
- CVE-2026-73380Critical
Unauthenticated PHP Object Injection vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
- CVE-2026-27537Medium
Unauthenticated Cross Site Scripting (XSS) vulnerability in Popup by Supsystic up to version 1.11.2 allows an unauthenticated attacker to inject malicious scripts.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS