Exploited vulnerability

CVE-2026-28177

TLP:CLEAR

code-atlantic popup_maker Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.

Facts

Vendor: code-atlantic
Product: popup_maker
EPSS (probability of exploitation within 30 days): 0.3 %
First known exploitation: 26 October 2026
First seen by Risk Letters: 26 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD