CVE-2025-15611

CWE-918 — Server-Side Request Forgery (SSRF)CWE-79 — Cross-site Scripting (XSS)CWE-352 — Cross-Site Request Forgery (CSRF)4 documents4 sources
Severity
5.4MEDIUM
EPSS
0.0%
top 93.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Popup BOXAys-pro Popup BOX
Timeline
PublishedApr 7

Description

The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/popup_box< 5.5.0
▶NVDays-pro/popup_box< 5.5.0

🔴Vulnerability Details

2
CVEList
Popup Box AYS Pro < 5.5.0 - Admin+ Stored Cross-Site Scripting (XSS) via CSRF↗2026-04-07
▶
GHSA
GHSA-86pc-m9xh-3jg9: The Popup Box WordPress plugin before 5↗2026-04-07
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-15611 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-15611 (MEDIUM CVSS 5.4) | The Popup Box WordPress plugin befo | cvebase.io