What is the CVSS score of CVE-2026-54192?

CVE-2026-54192 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Popup Box are affected by CVE-2026-54192?

The Ays Pro Popup Box WordPress plugin versions 6.2.9 and earlier contains a reflected cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary code in users'…

How to fix or mitigate CVE-2026-54192?

Within 24 hours: inventory all WordPress installations using Ays Pro Popup Box version 6.2.9 or earlier and classify by business criticality. Within 7 days: disable and remove the plugin from non-critical installations; for critical deployments, implement WAF rules to filter reflected XSS payloads and restrict plugin access to trusted administrator roles. Within 30 days: establish automated monitoring for vendor security advisories; no vendor-released patch identified at time of analysis, so prioritize compensating controls.

Popup Box CVE-2026-54192

EUVD-2026-37635 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Patchstack

WordPress XSS Popup Box Wordpress Plugin Ays Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS reachable over the network without authentication, requires victim click (UI:R), and crosses into the WordPress origin (S:C) with limited C/I/A impact via script execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:55 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.

AnalysisAI

Reflected cross-site scripting in the Ays Pro Popup Box WordPress plugin versions 6.2.9 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The CVSS 7.1 score reflects scope change (S:C) typical of XSS escaping the plugin context into the broader WordPress session. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the Ays Pro 'Popup Box' WordPress plugin (CPE cpe:2.3:a:ays_pro:popup_box), a third-party plugin used to display promotional and notification popups on WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is reflected back into HTML output without proper encoding or sanitization. Because the flaw is reflected XSS, the malicious payload travels in the request itself (typically a URL parameter) rather than being stored server-side, and execution occurs in the context of the WordPress site origin.

RemediationAI

No vendor-released patch identified at time of analysis from the input data - site administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ays-popup-box/vulnerability/wordpress-popup-box-plugin-6-2-9-reflected-cross-site-scripting-xss-vulnerability) and the Ays Pro Popup Box page on WordPress.org for the latest version above 6.2.9 and upgrade immediately once available. Until a fixed release is confirmed, compensating controls include deactivating and uninstalling the Popup Box plugin (which removes popup functionality entirely), deploying a WAF rule that blocks reflected script payloads in query parameters reaching the plugin's endpoints, or enforcing a strict Content-Security-Policy that disallows inline script execution (note this can break other plugins or themes that rely on inline handlers). Educating administrators to avoid clicking unsolicited links to their own site while logged in further reduces the chance of session hijack.