CVE-2025-15611: Popup Box WordPress Plugin CSRF Vulnerability

CVE-2025-15611 Overview

CVE-2025-15611 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Popup Box WordPress plugin before version 5.5.0. The vulnerability exists in the add_or_edit_popupbox() function, which fails to properly validate nonces before saving popup data. This security flaw allows unauthenticated attackers to chain CSRF attacks with Stored Cross-Site Scripting (XSS), enabling arbitrary JavaScript execution in both the admin panel and the frontend of affected WordPress sites.

Critical Impact

Attackers can exploit this vulnerability to inject malicious JavaScript into popups when an authenticated administrator visits a malicious page. The injected scripts execute in the context of the admin session, potentially leading to account takeover, data theft, or website defacement.

Affected Products

• ays-pro Popup Box plugin for WordPress (versions before 5.5.0)

Discovery Timeline

• 2026-04-07 - CVE-2025-15611 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2025-15611

Vulnerability Analysis

This vulnerability combines two attack vectors: Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). The Popup Box plugin's add_or_edit_popupbox() function processes popup creation and modification requests without validating the request origin through WordPress nonce verification. This oversight allows attackers to craft malicious web pages that, when visited by authenticated WordPress administrators, silently submit requests to create or modify popup configurations.

The attack is particularly dangerous because it enables persistent JavaScript injection. Once a malicious popup is created or modified, the attacker's JavaScript payload persists in the database and executes whenever the popup is rendered—both in the WordPress admin dashboard and on the public-facing website frontend. This creates opportunities for session hijacking, credential theft, admin account compromise, and malicious content distribution to site visitors.

Root Cause

The root cause is the absence of proper nonce validation in the add_or_edit_popupbox() function. WordPress provides the wp_verify_nonce() function specifically to protect against CSRF attacks by ensuring that form submissions originate from legitimate sources. When this security check is omitted, the application cannot distinguish between legitimate admin-initiated requests and forged requests from malicious third-party sites.

Additionally, the plugin fails to sanitize user-supplied input for popup content, enabling attackers to inject arbitrary JavaScript code that persists in the database and executes in users' browsers.

Attack Vector

The attack follows a network-based vector requiring user interaction. An attacker creates a malicious webpage containing a hidden form or JavaScript that automatically submits a request to the vulnerable WordPress endpoint. When an authenticated administrator with the Popup Box plugin visits this malicious page (via phishing email, compromised website, or other social engineering techniques), the browser automatically includes their authentication cookies with the forged request.

The malicious request creates or modifies a popup to include JavaScript payloads. Since the plugin does not verify the request's authenticity via nonce validation, it processes the request as if it were legitimate. The injected JavaScript then executes whenever the popup is displayed, affecting both administrators accessing the WordPress backend and visitors viewing the frontend.

Detection Methods for CVE-2025-15611

Indicators of Compromise

• Unexpected or unauthorized popup configurations appearing in the Popup Box plugin settings
• JavaScript code embedded within popup content that was not intentionally added by administrators
• Unusual popup behavior including redirects, form injections, or external resource loading
• Browser console errors or network requests to unfamiliar domains when popups are displayed

Detection Strategies

• Review all existing popup configurations in the Popup Box plugin for suspicious JavaScript or iframe content
• Monitor WordPress audit logs for popup creation or modification events, especially those occurring without corresponding admin login activity
• Implement Web Application Firewall (WAF) rules to detect CSRF attack patterns targeting WordPress plugin endpoints
• Use browser developer tools to inspect popup content for obfuscated or suspicious script tags

Monitoring Recommendations

• Enable comprehensive logging for WordPress admin actions, particularly plugin configuration changes
• Configure alerts for popup modifications that include script tags or event handlers
• Monitor HTTP request logs for unusual POST requests to Popup Box plugin endpoints from external referrers
• Implement Content Security Policy (CSP) headers to help detect and prevent unauthorized script execution

How to Mitigate CVE-2025-15611

Immediate Actions Required

• Update the Popup Box plugin to version 5.5.0 or later immediately
• Audit all existing popup configurations for unauthorized or suspicious content, removing any unrecognized JavaScript
• Review WordPress admin user accounts for any signs of compromise
• Consider temporarily deactivating the plugin if immediate update is not possible

Patch Information

The vulnerability has been addressed in Popup Box version 5.5.0. Users should update through the WordPress admin dashboard by navigating to Plugins > Installed Plugins and checking for available updates, or by downloading the latest version from the WordPress plugin repository. For detailed vulnerability information, refer to the WPScan Vulnerability Detail.

Workarounds

• Disable the Popup Box plugin entirely until the update can be applied
• Implement a Web Application Firewall (WAF) with CSRF protection rules as a temporary mitigation layer
• Restrict administrative access to trusted IP addresses to reduce the attack surface
• Train administrators to avoid clicking links from untrusted sources while logged into WordPress

# Verify Popup Box plugin version via WP-CLI
wp plugin get ays-popup-box --field=version

# Update Popup Box plugin to the latest version
wp plugin update ays-popup-box

# Alternatively, deactivate the plugin until patching is possible
wp plugin deactivate ays-popup-box