CVE-2026-11996— Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
Quick assessment
Affected
codesupplyco Advanced Popups
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 Advanced Popups 在所有 1.2.3 及更早版本中，由于输入过滤和输出转义不足，存在存储型跨站脚本（Stored XSS）漏洞。该漏洞通过“通知按钮链接”（Notification Button Link）字段实现。具备作者（author）或更高权限的认证攻击者可以利用此漏洞在页面中注入任意 Web 脚本，当用户访问被注入的页面时，这些脚本将被执行。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-11996
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
Source: CVE Program / CVE List V5
Vulnerability Description
The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| codesupplyco | Advanced Popups | 0 ~ 1.2.3 | - |
|
II. Public POCs for CVE-2026-11996
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11996
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-11996 (1)
Security Blog Posts for CVE-2026-11996 (1)
IV. Related Vulnerabilities
Same vendor: codesupplyco
-
CVE-2026-2390
Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cros -
CVE-2026-28178
WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (X -
CVE-2026-15644
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cros -
CVE-2026-15649
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cros -
CVE-2026-15645
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cros
Same weakness: CWE-79
-
CVE-2026-19619
Improper Neutralization of Input During Web Page Generation -
CVE-2026-78252
Improper Neutralization of Input During Web Page Generation -
CVE-2026-18555
Better Messages – Chat Rooms, Group Chat, Private Messages & -
CVE-2026-5920
Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) St -
CVE-2026-18595
WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cr
V. Comments for CVE-2026-11996
No comments yet