{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39666", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:57:59.671Z", "datePublished": "2026-04-08T08:30:38.138Z", "dateUpdated": "2026-04-08T20:37:37.300Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "hellobar", "product": "Hello Bar Popup Builder", "vendor": "telepathy", "versions": [{"lessThanOrEqual": "1.5.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:42.092Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.<p>This issue affects Hello Bar Popup Builder: from n/a through <= 1.5.1.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.This issue affects Hello Bar Popup Builder: from n/a through <= 1.5.1."}], "impacts": [{"capecId": "CAPEC-588", "descriptions": [{"lang": "en", "value": "DOM-Based XSS"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:38.138Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/hellobar/vulnerability/wordpress-hello-bar-popup-builder-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "title": "WordPress Hello Bar Popup Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T20:37:21.357181Z", "id": "CVE-2026-39666", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T20:37:37.300Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.This issue affects Hello Bar Popup Builder: from n/a through <= 1.5.1."}], "id": "CVE-2026-39666", "lastModified": "2026-04-08T09:16:37.893", "metrics": {}, "published": "2026-04-08T09:16:37.893", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/hellobar/vulnerability/wordpress-hello-bar-popup-builder-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.5.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Hello Bar Popup Builder", "source": "cna", "vendor": "telepathy"}, "product": "hello_bar_popup_builder", "vendor": "telepathy"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T10:34:09.339404+00:00", "value": {"mitigation_remediation": ["Upgrade Hello Bar Popup Builder to the latest version available (greater than 1.5.1).", "Verify that the upgraded version is deployed on all affected WordPress sites.", "Test the popup functionality to ensure normal operation after the update."], "summary": {"action": "Patch Now", "impact": "DOM-Based Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "All installations of the telepathy Hello Bar Popup Builder plugin with versions from the earliest available release through 1.5.1 are impacted. WordPress sites that have not upgraded beyond version 1.5.1 are vulnerable, regardless of other security controls in place.", "description_and_impact": "The Hello Bar Popup Builder plugin contains a flaw that improperly neutralizes user input during page rendering, producing a DOM\u2011based cross\u2011site scripting vulnerability. An attacker can inject malicious JavaScript into a page that contains the plugin, which executes automatically in the victim\u2019s browser when the page is viewed. The injected code can steal session cookies, deface the page, or perform other client\u2011side attacks on the user.", "risk_and_exploitability": "The vulnerability operates entirely on the client side; no authentication or privileged access is required, which is inferred from the lack of any mention of a privilege prerequisite. The absence of EPSS and KEV entries suggests the exploit is not currently known, yet the ease of crafting a malicious URL or social\u2011engineering a victim gives the flaw a moderate to high risk rating. Prompt remediation is recommended."}}}}, "created": "2026-04-08T19:28:07.390924+00:00", "updated": "2026-04-08T19:41:10.522592+00:00", "vendors": ["telepathy", "telepathy$PRODUCT$hello_bar_popup_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}