Description
The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.
INFO
Published Date :
2026-04-07T06:00:09.736Z
Last Modified :
2026-04-07T16:25:37.703Z
Source :
WPScan
AFFECTED PRODUCTS
The following products are affected by CVE-2025-15611 vulnerability.
| Vendors | Products |
|---|---|
| Popup Box |
|
| Wordpress |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-15611.
