The vulnerability is an unauthenticated Cross Site Scripting flaw that allows an attacker to inject arbitrary client‑side script via the Popup by Supsystic plugin in WordPress when using any version up to 1.13.1. This weakness, classified as CWE‑79, could enable an attacker to steal cookies, hijack user sessions, perform phishing, or deface the web page presented to visitors. The vulnerability exists without authentication, meaning any website visitor could trigger it by loading a crafted page containing malicious payloads injected by the plugin.

The affected systems are WordPress installations that have the Popup by Supsystic plugin from the vendor Supsystic installed, specifically versions 1.13.1 or earlier. Any site running these plugin versions is susceptible until the code is updated to 1.13.2 or newer.

With a CVSS score of 7.1 the flaw is considered moderate‑to‑high severity. The EPSS score is currently unavailable, but the lack of a KEV listing indicates that it has not yet been widely exploited in the wild; nevertheless, because the attack does not require authentication, the potential for abuse is significant. Exposing the vulnerability is straightforward: an attacker can embed malicious JavaScript into a page rendered by the vulnerable plugin, and any user visiting that page would be affected.