This vulnerability (CVE-2026-28177) involves improper neutralization of input during web page generation (CWE-79) in the Popup Maker plugin for WordPress, versions up to 1.23.0. It allows unauthenticated attackers to perform cross-site scripting (XSS) attacks, which can lead to execution of arbitrary scripts in the context of the affected site. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction required. The impact scope is changed (S:C), affecting confidentiality, integrity, and availability at a low level. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, potentially resulting in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability at a low level. The vulnerability is exploitable remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block XSS payloads targeting Popup Maker. Avoid user input that is reflected in popups without proper sanitization.