CVE-2026-54192
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Popup box versions up to 6.2.9 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
Risk Assessment
This vulnerability may lead to user data theft or session hijacking, posing a serious security threat to the application.
Recommendation
It is recommended to upgrade to the latest version of Popup box to mitigate this vulnerability.
Other vulnerabilities in Popup box
See all- CVE-2026-57631High
SQL Injection vulnerability in Popup box versions up to 6.0.1 allows an administrator to inject malicious SQL code. An attacker with admin privileges can manipulate database queries.
- CVE-2025-69021Medium
Cross-Site Request Forgery (CSRF) vulnerability in Popup box (WordPress plugin) allows an attacker to force a logged-in user to perform unwanted actions. Affects versions up to and including 6.0.7.
- CVE-2025-57931Medium
The Popup box plugin for WordPress (versions up to 5.5.4) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS