CVE-2026-28177

WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.

We have discovered 161,305 live websites that are affected by CVE-2026-28177.

Run a Free Instant Scan



Affected Software

Product  Popup Maker
Category Wordpress Plugins
Vulnerable Domains161,305 live websites (99% of Popup Maker install base)
Vulnerable Versions
  • from 0 through 1.23
Vulnerable Versions Count119 versions ( 99% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 6, 2026
  • Updated - Aug 6, 2026

Credits

  • daroo | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-28177
United States54,668 websites


Germany13,827 websites
Russia10,602 websites
France7,608 websites
Italy6,693 websites
GB6,001 websites
India4,439 websites
Canada4,245 websites
Australia4,102 websites
Spain4,046 websites

Website Distribution by TLD

Number of websites using CVE-2026-28177
.com68,718 websites
.org9,352 websites
.de8,755 websites
.ru8,605 websites
.it4,920 websites
.com.au3,961 websites
.co.uk3,531 websites
.fr3,396 websites
.nl3,380 websites
.net2,705 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-28177

Top websites that are affected by CVE-2026-28177. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**********.org United States*,***
*******.com United States*,***
********.com United States*,***
***.com United States*,***
*****.org United States*,***
*************.com United States*,***
************.com United States*,***
*******.com Canada*,***
***********.com United States*,***
***.org United States*,***
See full domain list

FAQ

CVE-2026-28177 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Popup Maker
A total of 161,305 websites have been identified as vulnerable to CVE-2026-28177, based on global website indexing conducted by WebTechSurvey.
The Popup Maker is affected by the CVE-2026-28177 vulnerability.
Popup Maker versions up to and including 1.23 are vulnerable to CVE-2026-28177.