CVE-2026-11996

MediumCVSS 6.4/10Last modified Sep 16, 2026

Description

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
codesupplyco	Advanced Popups	<= 1.2.3

References

Timeline

Published: Sep 16, 2026
Last modified: Sep 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-119974.3The Bulk SEO Image plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1. This is due to miss CVE-2026-1199778.1WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging path CVE-2026-1199788.5Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted CVE-2026-1199798.8LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to CVE-2026-119987.6A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrar CVE-2026-1199806.5The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized a CVE-2026-1199887.1Numeric truncation error in Windows SMB allows an authorized attacker to execute code over a network.CVE-2026-1199898.2Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to exec CVE-2026-119997.5X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affect CVE-2026-1199909.8Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1199915.9Weak authentication in Microsoft Configuration Manager allows an unauthorized attacker to disclose information over a network.CVE-2026-1199927.0Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.