CVE-2026-102398

Executive Summary

CVE-2026-102398 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the "Popup by Supsystic" WordPress plugin through version 1.13.1. Because exploitation requires no authentication, any remote attacker who can induce a victim to visit a crafted URL or interact with a poisoned page can inject and execute arbitrary script in the victim's browser within the context of the affected WordPress site. Successful exploitation enables session hijacking, credential theft, malicious redirects, and full site defacement for visitors, with a CVSS base score of 7.1 (High).

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting). Popup by Supsystic is a WordPress plugin that renders configurable popup overlays on site pages. Per the NVD description, the flaw is an unauthenticated XSS condition present in versions up to and including 1.13.1.

The defining characteristics of this vulnerability, as derivable from the supplied intelligence, are:

• Unauthenticated reachability: The exploit primitive does not require the attacker to hold any WordPress user role or session. The vulnerable code path is reachable by anonymous requests.
• Cross-Site Scripting: The flaw permits injection of script content that is subsequently rendered and executed in the context of another user's browser session on the target site.
• Reflected or stored class ambiguity: The provided description does not specify whether the injection is reflected (payload delivered via a crafted request) or stored (payload persisted through the popup configuration/rendering pipeline). The CVSS vector includes UI:R (User Interaction: Required), which is consistent with a reflected or interaction-driven delivery path in which the victim must be lured to a crafted resource. This is a reasonable inference from the vector and not an assertion about the specific code path, which is not disclosed in the available data.
• Scope change (S:C): The scope is Changed. Impact in the vulnerable component (the plugin's rendered output) extends to resources beyond its security authority — the broader WordPress site origin, session cookies, or DOM content — which is the standard scope behavior for DOM-dependent XSS.

The precise vulnerable parameter, endpoint, or rendering hook is not disclosed in the NVD description or CNA title provided. No function names, file paths, template identifiers, or request parameters can be confirmed from the source data; accordingly, no such specifics are asserted here. No public proof-of-concept, exploit code, or Nuclei template is available for this CVE.

Exploitation Scenarios

Because no public PoC exists, the attack chain below is described at the vulnerability-class level and inferred from the CVE class (unauthenticated XSS), the CVSS vector, and the fact that the affected component is a WordPress plugin. No specific endpoints, parameters, or function names are fabricated.

1. Reconnaissance / target identification. An attacker enumerates Internet-facing WordPress deployments and fingerprints those running the Supsystic Popup plugin. Fingerprinting is passive and low-noise: the plugin assets are typically served from a predictable plugin directory, and page HTML referencing the popup overlay is observable without authentication. Mass scanning can use HTTP response body and title matching (see Shodan dorks in METADATA).

2. Triggering the flaw class. Because the condition is unauthenticated, the attacker constructs a crafted request or link that carries script content into the plugin's rendered output. The victim, a legitimate visitor or authenticated site user, must then load the crafted resource or interact with the poisoned page (matching UI:R). The precise input vector is undisclosed; candidates for an XSS flaw in a popup-rendering plugin are broadly: a query-string parameter reflected into popup markup, a path/route segment, or a persisted popup field rendered without output encoding. These are class-level possibilities, not confirmed implementation details.

3. Payload delivery / execution. Execution occurs client-side in the victim's browser under the affected site's origin. A representative, class-level payload would be a script or event-handler snippet that runs on page load or user interaction within the popup context. The exact execution sink (DOM sink vs. server-rendered reflection) is not disclosed.

4. Post-exploitation impact. Per the CVSS subscores, the confidentiality, integrity, and availability impacts are all Low (C:L/I:L/A:L) but the scope is Changed. Practical outcomes include: theft of session data accessible to JavaScript on that origin, injection of fraudulent content into the popup/page, redirection to attacker-controlled resources, and — in a stored-XSS variant — persistent malicious content affecting all visitors who encounter the injected popup. Availability impact, if realized, would most plausibly stem from client-side script disruption rather than server denial of service.

Note: No public exploit, PoC, or Nuclei template is available. The chain above is modeled from the vulnerability class; it should be treated as a hypothesis for detection design, not as a verified weaponization path.

Impact Assessment

• Severity: CVSS 3.1 base score 7.1 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.
• Attack Vector (AV:N): Exploitable across a network — no local access required.
• Attack Complexity (AC:L): No special conditions; exploit primitives are simple once the vector is known.
• Privileges Required (PR:N): Attacker needs no credentials or role — this is the most consequential factor, since any anonymous actor can attempt exploitation.
• User Interaction (UI:R): A victim must load or interact with a crafted resource. This is the primary limiting factor and the reason the score does not reach Critical.
• Scope (S:C): Impact crosses a security boundary, extending to the site origin and client-side resources beyond the plugin itself.
• C/I/A (L/L/L): Measurable but limited impact across confidentiality, integrity, and availability.

Affected systems: Any WordPress installation running Popup by Supsystic version 1.13.1 or earlier. Blast radius: Every anonymous visitor and authenticated user of an affected site is a potential victim of a delivered payload; the site's reputation, injected content, and any origin-scoped tokens are at risk. Business impact: phishing/redirect abuse via trusted site domains, reputational damage, potential compromise of user accounts through stolen session material, and secondary malware distribution. No CISA KEV listing and no EPSS score are available; there is no evidence of in-the-wild exploitation at the time of writing.

Detection Guidance

Sigma Rule

title: Unauthenticated XSS Attempt Against Popup by Supsystic (CVE-2026-102398)
id: 8f2c1a44-5b7e-4d19-9c33-popup-supsystic-xss
status: experimental
description: Detects script-injection patterns in web requests targeting WordPress sites running Popup by Supsystic <= 1.13.1
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102398
author: SOC Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
  service: http
detection:
  selection_uri:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<svg'
      - '<img'
  selection_context:
    cs-uri-query|contains:
      - 'popup'
      - 'supsystic'
  condition: selection_uri and selection_context
falsepositives:
  - Legitimate application input containing literal HTML fragments
  - Security scanners and fuzzing tools
level: high
tags:
  - attack.t1190
  - cwe.79

YARA Rule

rule CVE_2026_102398_Supsystic_Popup_XSS
{
    meta:
        description = "Detects unauthenticated XSS injection payloads targeting Popup by Supsystic <= 1.13.1 (CVE-2026-102398)"
        author = "SOC Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102398"
        date = "2026-01-01"
        severity = "high"

    strings:
        $plugin = "popup-by-supsystic" ascii nocase
        $plugin2 = "supsystic" ascii nocase
        $xss1 = "<script" ascii nocase
        $xss2 = "javascript:" ascii nocase
        $xss3 = "onerror=" ascii nocase
        $xss4 = "%3Cscript" ascii nocase
        $xss5 = "&#x3C;script" ascii nocase

    condition:
        ($plugin or $plugin2) and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102398 Popup by Supsystic Unauthenticated XSS Attempt"; flow:established,to_server; http.uri; content:"popup"; nocase; http.uri; content:"supsystic"; nocase; http.uri; pcre:"/(%3C|<)\s*script|onerror\s*=|javascript\s*:/i"; reference:cve,2026-102398; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102398; classtype:web-application-attack; sid:2026102398; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.method == "GET" and
    url.path contains "supsystic" ]
  [ network where network.protocol == "http" and
    wildcard(url.query, "*<script*") or wildcard(url.query, "*onerror=*") or
    wildcard(url.query, "*javascript:*") or wildcard(url.query, "*%3Cscript*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri)
| where (match(uri,"popup") OR match(uri,"supsystic"))
| where (match(uri,"%3cscript") OR match(uri,"<script") OR match(uri,"onerror=") OR match(uri,"onload=") OR match(uri,"javascript:") OR match(uri,"%3csvg") OR match(uri,"%3cimg"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as attempted_uris by src_ip, host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,supsystic_xss,">
  <rule id="202610" level="12">
    <if_sid>31100</if_sid>
    <id>^GET</id>
    <match>popup|supsystic</match>
    <regex>%3Cscript|<script|onerror=|onload=|javascript:|%3Csvg|%3Cimg</regex>
    <description>CVE-2026-102398: Possible unauthenticated XSS attempt against Popup by Supsystic plugin</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102398,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source, and no vendor fix has been identified. The guidance below is therefore mitigation-first.

1. Immediate mitigations

   • If the Supsystic Popup plugin is not business-critical, deactivate and remove it. This eliminates the attack surface entirely.
   • If the plugin must remain active, place the WordPress site behind a Web Application Firewall (WAF) with virtual patching rules that inspect and block script-bearing input to plugin-reachable routes, and enable strict output-encoding protections where available.
   • Deploy the detection content in this report (Sigma/YARA/Suricata/Elastic/Splunk/Wazuh) to alert on injection attempts and correlate with victim interactions.
   • Enforce Content Security Policy (CSP) headers with restrictive script-src directives as defense-in-depth to limit payload execution, and set cookies HttpOnly/Secure to reduce session-theft impact.

2. Patch / upgrade steps

   • Monitor the plugin vendor (Supsystic) for a security release addressing CVE-2026-102398. No fixed version is known at this time; do not assume any release is fixed until the vendor confirms it in an advisory.
   • Once a fixed version is published, upgrade immediately and validate that the plugin's rendered output is safely encoded.
   • Because patch confidence is 0/4, treat any version at or below 1.13.1 as vulnerable until a vendor advisory states otherwise.

3. Long-term hardening

   • Maintain a WordPress component inventory and subscribe to authoritative vulnerability feeds (NVD, WPScan, vendor advisories) for continuous monitoring of third-party plugins.
   • Apply least-privilege and input-validation standards across all plugins; enforce a plugin review/vetting process before deployment.
   • Adopt a routine patching cadence and an asset management process that flags end-of-life or unmaintained plugins.
   • Conduct periodic authenticated and unauthenticated XSS testing against rendering-heavy components such as popup and widget plugins.

References

• NVD — CVE-2026-102398: https://nvd.nist.gov/vuln/detail/CVE-2026-102398
• MITRE CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Vendor — Popup by Supsystic (WordPress plugin) project page: https://wordpress.org/plugins/popup-by-supsystic/
• CISA Known Exploited Vulnerabilities catalog (no entry for CVE-2026-102398 as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild note: No CISA KEV listing, no EPSS score, and no public PoC, exploit code, or Nuclei template are available for CVE-2026-102398. There is no evidence of active exploitation or attribution to a known threat actor campaign at this time. Detection content above is derived from the vulnerability class and should be tuned to reduce false positives from legitimate HTML-bearing input.