CVE-2026-27537 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Popup by Supsystic versions up to 1.11.2. This vulnerability allows attackers to execute arbitrary scripts in the context of the affected application without requiring authentication, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed, with low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in partial disclosure of information, modification of data, or disruption of service. The vulnerability does not require authentication, increasing the risk of exploitation. However, user interaction is required for the attack to succeed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the vendor's communications for updates and apply patches once available. Until then, consider applying web application firewall rules or input sanitization as temporary mitigations if feasible.