CVE-2026-28177: WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability
Published Aug 6, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.
Affected Software
1 affected component
Popup Maker WordPress Popup Maker plugin<=1.23.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Popup Maker pluginto a version that resolves this vulnerability.Fixed in 1.24.0
Event History
Aug 6, 2026
CVE Published
via MITRE·02:27 PM
Data Sourced
via MITRE·02:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-28177?
The severity of CVE-2026-28177 is classified as high with a score of 7.1.
2
How does CVE-2026-28177 affect the Popup Maker plugin?
CVE-2026-28177 affects the Popup Maker plugin by allowing unauthenticated Cross Site Scripting (XSS) vulnerabilities.
3
What versions of the Popup Maker plugin are affected by CVE-2026-28177?
CVE-2026-28177 affects versions of the Popup Maker plugin up to and including 1.23.0.
4
How do I fix CVE-2026-28177?
To fix CVE-2026-28177, update the Popup Maker plugin to the latest version that addresses the vulnerability.
5
What is Cross Site Scripting (XSS) in the context of CVE-2026-28177?
In the context of CVE-2026-28177, Cross Site Scripting (XSS) allows attackers to inject malicious scripts into web pages viewed by users.