EUVD-2026-57935
GHSA-qrg3-qvgr-8m6x
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Description states unauthenticated, so PR:N; XSS has no availability impact warranting A:N; S:C retained for browser scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.
AnalysisAI
Cross-site scripting in the Popup by Supsystic WordPress plugin (all versions up to and including 1.11.2) enables script injection into pages viewed by other users, with the injected code executing in the victim's browser under a changed scope. Reported by Patchstack and tracked as EUVD-2026-57935, the vulnerability carries a CVSS base score of 6.5 with Changed Scope, meaning successful exploitation crosses the security boundary between the plugin and the victim's browser session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability requires that the Popup by Supsystic plugin (version <= 1.11.2) is installed and active on a WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 6.5 (Medium) is based on a vector of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted popup configuration or input field containing a malicious JavaScript payload through the plugin's interface - potentially without authenticating if the 'unauthenticated' description is accurate. The payload is stored or reflected and later rendered in a victim's browser when they view a page displaying the popup, causing the script to execute in the victim's browser context. … |
| Remediation | The primary remediation is to update the Popup by Supsystic plugin to a version above 1.11.2 via the WordPress admin dashboard or by downloading directly from the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Popup By Supsystic
View allUnauthenticated PHP Object Injection in the WordPress plugin Popup by Supsystic (versions 1.13.0 and earlier) lets remot
Broken authentication in the Popup by Supsystic WordPress plugin (versions <= 1.13.0) lets remote unauthenticated attack
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today