A notable security vulnerability has been identified in the Popup Box WordPress plugin, affecting versions older than 5.5.0. This flaw, tracked as CVE-2025-15611, presents a medium severity risk due to its potential for Cross-Site Request Forgery (CSRF) attacks that can lead to stored Cross-Site Scripting (XSS).
In simple terms, this means that the plugin didn’t properly check for legitimate requests before saving new popup information. An attacker could craft a special, malicious web page. If a logged-in WordPress administrator were to visit this page, their browser might unknowingly send a request to their own WordPress site. This request, appearing legitimate to the vulnerable plugin, could then create or change popups on the site. These manipulated popups could contain harmful JavaScript code, which would then run on the admin panel and even on the public-facing parts of the website, potentially affecting visitors.
CVE Details
- Product: Popup Box WordPress plugin
- Published: April 7, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability specifically impacts the Popup Box WordPress plugin. Users running any version of the Popup Box plugin prior to 5.5.0 are at risk. It is crucial to verify your plugin version and take immediate action if you are using an older release.
Current Status
The vulnerability status is currently “Analyzed.” This means the issue has been thoroughly investigated and understood. Developers are aware of the problem, and a fix has been made available.
Severity Level
This vulnerability is rated as Medium severity with a CVSS score of 5.4. A medium severity rating indicates that while an attack requires some specific conditions—in this case, an authenticated administrator visiting a malicious page—the potential impact can be significant. Successful exploitation could allow attackers to inject arbitrary JavaScript, leading to unauthorized actions, defacement, or other malicious activities on both the administrative backend and the public frontend of the WordPress site.
Possible Solutions
The good news is that a fix for this vulnerability is available. To protect your WordPress site, you must update the Popup Box plugin to version 5.5.0 or later. Developers of the plugin have addressed the nonce validation issue in this release. Regularly updating your plugins is a fundamental cybersecurity practice that helps safeguard your website against known threats.
After updating, it’s always a good practice to clear any caching you might have in place and check your site for any unexpected behavior. Backing up your site before any major updates is also highly recommended.
References
- https://wpscan.com/vulnerability/089ea763-2421-4089-a220-251421f7f226/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15611
- https://spider-security.co.uk/csrf-to-xss-vulnerability-in-wordpress-plugin-with-50000-installs/
- https://spider-security.co.uk/
For further reading on related topics, consider exploring our articles on:
