CVE-2025-15611: Popup Box AYS Pro < 5.5.0 - Admin+ Stored Cross-Site Scripting (XSS) via CSRF
The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the addoreditpopupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15611?
CVE-2025-15611 has been classified as having a high severity due to its potential for Cross-Site Request Forgery attacks.
How do I fix CVE-2025-15611?
To fix CVE-2025-15611, update the Popup Box plugin to version 5.5.0 or later where the nonce validation issue has been resolved.
What does CVE-2025-15611 exploit?
CVE-2025-15611 exploits a vulnerability in the Popup Box plugin related to inadequate nonce validation in the add_or_edit_popupbox() function.
Who is affected by CVE-2025-15611?
CVE-2025-15611 affects WordPress sites using the Popup Box AYS Pro plugin versions prior to 5.5.0.
What type of vulnerability is CVE-2025-15611?
CVE-2025-15611 is categorized as an admin+ stored Cross-Site Scripting (XSS) vulnerability combined with Cross-Site Request Forgery (CSRF).