CVE-2026-27537
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) vulnerability in Popup by Supsystic up to version 1.11.2 allows an unauthenticated attacker to inject malicious scripts.
Risk Assessment
An attacker may execute scripts in the user's browser, potentially leading to session theft or other attacks.
Recommendation
Update Popup by Supsystic to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Popup by Supsystic
See all- CVE-2026-102398High
The Popup by Supsystic plugin versions 1.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-73381Critical
Unauthenticated Broken Authentication vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can bypass authentication mechanisms.
- CVE-2026-73380Critical
Unauthenticated PHP Object Injection vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS