CVE-2026-28177

HIGH

CVE: CVE-2026-28177 - Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1Sign in to save

CVSS

7.1

CVSS v3.1

EPSS

0.2%

Exploit Prediction Score

Published

August 6, 2026

Exploitability

EPSS probability 0.2%

Description

Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.

CWE-79

No package data available.

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://patchstack.com/database/wordpress/plugin/popup-maker/vulnerability/wordpress-popup-maker-plugin-1-23-0-cross-sit…