CVE-2026-28177
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Popup Maker plugin by Code Atlantic LLC contains an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that allows DOM-Based XSS. The issue affects versions up to and including 1.23.0.
Risk Assessment
DOM-Based XSS may allow an attacker to execute malicious script in a site visitor's browser. This can lead to session theft or actions performed on behalf of the victim.
Recommendation
Update the Popup Maker plugin to a version later than 1.23.0. Consider deploying Content-Security-Policy headers to limit script execution.
Other vulnerabilities in Popup Maker
See all- CVE-2026-85004Medium
The Popup Maker WordPress plugin through version 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce. This allows authenticated users with minimal privileges such as Subscribers to overwrite a site-wide option (the linked service account and API configuration) that should only be modifiable by administrators.
- CVE-2026-15797Medium
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to and including 1.24.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject scripts using HTML entity-encoded payloads.
- CVE-2026-8848High
The Popup Maker plugin for WordPress up to version 1.22.0 contains an authorization bypass vulnerability. It allows authenticated attackers with editor-level access or higher to install and activate arbitrary plugins from an external URL, leading to remote code execution.
- CVE-2025-9490Medium
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to and including 1.20.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS