What is the CVSS score of CVE-2026-28177?

CVE-2026-28177 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Popup Maker are affected by CVE-2026-28177?

The Popup Maker WordPress plugin (versions ≤1.23.0) contains an unauthenticated cross-site scripting vulnerability that affects any visitor to a WordPress site running the affected plugin.

How to fix or mitigate CVE-2026-28177?

Within 24 hours: Audit all WordPress installations to identify sites running Popup Maker plugin versions 1.23.0 or earlier; immediately disable the plugin as a protective measure and document affected sites. Within 7 days: Implement Web Application Firewall rules to block common XSS payloads targeting popup functionality, deploy Content Security Policy headers to prevent inline script execution, and establish monitoring for suspicious admin activity or user session anomalies. Within 30 days: Once Popup Maker releases patched version (expected 1.24.0 or later), evaluate and apply the vendor update; conduct security audit of affected sites for signs of prior exploitation; if no patched version is available, evaluate alternative popup solutions and complete migration.

Popup Maker CVE-2026-28177

EUVD-2026-53949 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-3c69-9fr4-r5j6

WordPress XSS Popup Maker Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS with unauthenticated network trigger and scope change; availability impact assessed N as XSS does not directly cause service disruption.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:22 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.

AnalysisAI

Unauthenticated Cross-Site Scripting in the Popup Maker WordPress plugin (versions up to and including 1.23.0) allows any remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who views the affected popup content. The CVSS vector S:C (scope change) confirms the injected script crosses a security boundary, enabling session hijacking, credential theft, or admin-level actions performed on behalf of the victim. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated trigger surface (PR:N) makes this a tangible risk for any WordPress site running the affected plugin.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization, validation, or output encoding of user-supplied input before it is rendered as HTML. The Popup Maker plugin, developed by Daniel Iser and identified by CPE cpe:2.3:a:daniel_iser:popup_maker:*:*:*:*:*:*:*:*, is a PHP-based WordPress plugin responsible for rendering dynamic popups on WordPress-powered websites. The CVSS S:C metric confirms the injected payload executes in a security context different from where the input was submitted - a characteristic of reflected or stored XSS where attacker-controlled content reaches authenticated or privileged users. The exact vulnerable input parameter or endpoint is not identified in the available data and should be verified via the Patchstack advisory.

RemediationAI

Upgrade the Popup Maker plugin to a version beyond 1.23.0; the exact patched release version is not independently confirmed from the available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/popup-maker/vulnerability/wordpress-popup-maker-plugin-1-23-0-cross-site-scripting-xss-vulnerability for the confirmed fixed version before updating. If an immediate upgrade is not possible, deactivating the Popup Maker plugin entirely eliminates the attack surface at the cost of losing popup functionality. As a partial workaround, restricting access to popup-rendering endpoints via a WAF rule targeting common XSS payloads may reduce exposure but should not be treated as a substitute for patching, since WAF bypass techniques are widely known.