CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.4. It affects WordPress, Java. Exploitation may require the attacker to be authenticated.
CVE
CVE-2025-15611
Severity
MEDIUM
CVSS
5.4
EPSS
0.14%
WordPress Java
Original NVD Description
The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.
Related CVEs
Other vulnerabilities affecting the same vendor(s)