Back to search
CVE-2025-15611
Published: Apr 7, 2026
Modified: Apr 7, 2026
PUBLISHED
Description
The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.
| Vendor | Product | Versions |
|---|---|---|
Unknown | Popup Box | affected 0 - < 5.5.0 |
References
https://wpscan.com/vulnerability/089ea763-2421-4089-a220-251421f7f226/
exploit
vdb-entry
technical-description
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now