What is the CVSS score of CVE-2026-27537?

CVE-2026-27537 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Popup by Supsystic CVE-2026-27537

EUVD-2026-57935 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-qrg3-qvgr-8m6x

WordPress XSS Wordpress Plugin Popup By Supsystic Supsystic

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Description states unauthenticated, so PR:N; XSS has no availability impact warranting A:N; S:C retained for browser scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:20 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

AnalysisAI

Cross-site scripting in the Popup by Supsystic WordPress plugin (all versions up to and including 1.11.2) enables script injection into pages viewed by other users, with the injected code executing in the victim's browser under a changed scope. Reported by Patchstack and tracked as EUVD-2026-57935, the vulnerability carries a CVSS base score of 6.5 with Changed Scope, meaning successful exploitation crosses the security boundary between the plugin and the victim's browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible attack vector make it straightforward to weaponize given the right conditions.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-controlled input is rendered in an HTML context without adequate sanitization or encoding. The affected component is the Popup by Supsystic WordPress plugin (CPE: cpe:2.3:a:supsystic:popup_by_supsystic:*:*:*:*:*:*:*:*), a plugin that allows site owners to create and display configurable popup windows. WordPress plugins in this category frequently expose input fields for popup content, trigger rules, or configuration labels that, if not sanitized, can become XSS injection points. The Changed Scope (S:C) in the CVSS vector confirms the exploit crosses from the plugin's execution context into the victim's browser environment, the classic hallmark of reflected or stored XSS in WordPress plugin UI components.

RemediationAI

The primary remediation is to update the Popup by Supsystic plugin to a version above 1.11.2 via the WordPress admin dashboard or by downloading directly from the WordPress plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/popup-by-supsystic/vulnerability/wordpress-popup-by-supsystic-plugin-1-11-2-cross-site-scripting-xss-vulnerability should be consulted to confirm the exact patched version once available; the input data does not specify a fixed release version, so the patch version is not independently confirmed at time of analysis. If an immediate update is not possible, a compensating control is to disable the Popup by Supsystic plugin entirely until patched - this eliminates the attack surface with no functional side effect beyond disabling popup functionality. Deploying a Web Application Firewall rule targeting XSS payloads in plugin-related request parameters can reduce exposure but is not a substitute for patching. WordPress site administrators using Patchstack's virtual patching feature will receive automatic protection without requiring a plugin update.