What is the CVSS score of CVE-2026-102398?

CVE-2026-102398 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Popup by Supsystic are affected by CVE-2026-102398?

WordPress sites running the Popup by Supsystic plugin at version 1.13.1 or earlier are exposed to a reflected cross-site scripting flaw for which no vendor patch is currently available, so the…

How to fix or mitigate CVE-2026-102398?

Within 24 hours, confirm exposure by inventorying every WordPress instance running Popup by Supsystic 1.13.1 or earlier through the plugin console, a CMS asset scan, or WPScan, and confirm whether the plugin is active on any internet-facing page. For confirmed instances, deactivate or remove the plugin where functionality permits; where it must stay live, apply a WAF or reverse-proxy rule that blocks script tags and event-handler payloads in the plugin's reflected parameters, and confirm the WAF is in blocking rather than monitor-only mode. Within 7 days, for any site that cannot remove the plugin, harden the surrounding controls: enforce Content Security Policy headers that disallow inline script where feasible, require re-authentication and shorten session lifetimes for editors and administrators, review administrative accounts for least privilege and enable multi-factor authentication on all WordPress logins, and add alerting on parameter payloads and unexpected script inclusion in the affected pages. Within 30 days, complete migration to an alternative popup or opt-in plugin for sites that deactivated Popup by Supsystic, or re-evaluate the plugin once the vendor publishes a fixed release and patch to that exact version as soon as it is confirmed in the vendor advisory. Note that no vendor-released patch has been identified at the time of analysis, and no public exploit code or active exploitation has been identified, so the interim controls above remain the primary risk reduction path; continue to track the vendor advisory and the CISA KEV catalog for changes in that status.

Popup by Supsystic CVE-2026-102398

EUVD-2026-89945 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-09-30 Patchstack

GHSA-rvfw-xwr3-r2c8

WordPress XSS Wordpress Plugin Popup By Supsystic Supsystic

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated remote reflected XSS needing victim click (UI:R) with cross-origin script execution (S:C) yielding limited confidentiality/integrity/availability impact in browser context.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Sep 30, 2026 - 13:38 vuln.today

CVE Published

Sep 30, 2026 - 12:28 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.

AnalysisAI

Unauthenticated reflected cross-site scripting (XSS) in Popup by Supsystic versions 1.13.1 and earlier allows remote attackers to inject malicious scripts that execute in a victim's browser when they interact with a crafted link or page. This affects WordPress sites with the plugin active, potentially leading to session hijacking, defacement, or data theft. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a victim to interact with attacker-supplied content (UI:R) - typically clicking a crafted link or loading a page carrying the injected parameter - against a WordPress site running Popup by Supsystic version 1.13.1 or earlier with the plugin active. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score is 7.1 (High) driven by AV:N/AC:L/PR:N with a scope change (S:C) and low tripartite impact (C:L/I:L/A:L), tempered by required user interaction (UI:R) - a fingerprint consistent with reflected/social-engineered Cross-Site Scripting rather than a server-side compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Popup by Supsystic to the latest version once a patch is released; as of analysis, no fixed version is specified in the advisory. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm exposure by inventorying every WordPress instance running Popup by Supsystic 1.13.1 or earlier through the plugin console, a CMS asset scan, or WPScan, and confirm whether the plugin is active on any internet-facing page. …

Threat intelligence, references, and detailed analysis are available after sign-in.