CVE-2026-27537

WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

We have discovered 1,780 live websites that are affected by CVE-2026-27537.

Run a Free Instant Scan



Affected Software

Product  Popup By Supsystic
Category Wordpress Plugins
Vulnerable Domains1,780 live websites (99% of Popup By Supsystic install base)
Vulnerable Versions
  • from 0 through 1.11.2
Vulnerable Versions Count78 versions ( 98% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 13, 2026
  • Updated - Aug 13, 2026

Credits

  • hhhai | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-27537
United States669 websites


Germany145 websites
Cyprus96 websites
France90 websites
Spain63 websites
Italy63 websites
Russia61 websites
GB56 websites
Poland49 websites
India40 websites

Website Distribution by TLD

Number of websites using CVE-2026-27537
.com846 websites
.org173 websites
.de71 websites
.ru46 websites
.it45 websites
.net41 websites
.pl38 websites
.co.uk35 websites
.nl33 websites
.com.au31 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-27537

Top websites that are affected by CVE-2026-27537. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**********.org United States**,***
******.com United States***,***
*****************.com Germany***,***
**************.com United States***,***
****************.com Singapore***,***
********.org United States***,***
***************.com Spain***,***
***************.com United States***,***
**************.com United States***,***
****.***.il Israel***,***
See full domain list

FAQ

CVE-2026-27537 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Popup By Supsystic
A total of 1,780 websites have been identified as vulnerable to CVE-2026-27537, based on global website indexing conducted by WebTechSurvey.
The Popup By Supsystic is affected by the CVE-2026-27537 vulnerability.
Popup By Supsystic versions up to and including 1.11.2 are vulnerable to CVE-2026-27537.