CVE-2026-28177: WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability

Published Aug 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.

Affected Software

1 affected component

Popup Maker WordPress Popup Maker plugin<=1.23.0

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Popup Maker plugin to a version that resolves this vulnerability.
Fixed in 1.24.0

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

The severity of CVE-2026-28177 is classified as high with a score of 7.1.

CVE-2026-28177 affects the Popup Maker plugin by allowing unauthenticated Cross Site Scripting (XSS) vulnerabilities.

CVE-2026-28177 affects versions of the Popup Maker plugin up to and including 1.23.0.

To fix CVE-2026-28177, update the Popup Maker plugin to the latest version that addresses the vulnerability.

In the context of CVE-2026-28177, Cross Site Scripting (XSS) allows attackers to inject malicious scripts into web pages viewed by users.