CVE-2026-39666

MediumCVSS 6.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

A DOM-based Cross-site Scripting vulnerability in the Hello Bar Popup Builder plugin allows injection of malicious client-side scripts. The issue affects versions up to and including 1.5.1.

Risk Assessment

An attacker could execute arbitrary scripts in the victim's browser, potentially leading to session theft, redirects, or data theft.

Recommendation

Update the Hello Bar Popup Builder plugin to the latest version that includes input sanitization fixes.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.This issue affects Hello Bar Popup Builder: from n/a through <= 1.5.1.