Now officially on WordPress.org

CVE Database / CVE-2026-28177

CVE · High

CVE-2026-28177 — Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder [popup-maker] < 1.24.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-28177 Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder [popup-maker] < 1.24.0 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') High 7.1 < 1.24.0 1.24.0 2026-08-05 —

CVE-2026-28177

A vulnerability has been discovered in Popup Maker plugin versions prior to 1.24, allowing an attacker to inject malicious scripts into a website without requiring authentication. This occurs due to insufficient input validation and sanitization of user-submitted data. As a result, an unauthenticated user can potentially exploit this weakness to execute arbitrary JavaScript code on the affected site.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings