CVE-2026-28177

HighCVSS 7.1

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Unauthenticated Cross Site Scripting (XSS) in Popup Maker versions up to and including 1.23.0.

An attacker can inject malicious script, potentially leading to data theft or session hijacking.

Update the Popup Maker plugin to the latest version that includes the security fix.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.