CVE-2025-46514 Overview
CVE-2025-46514 is a Cross-Site Request Forgery (CSRF) vulnerability in the Milat jQuery Automatic Popup WordPress plugin (milat-jquery-automatic-popup) that enables Stored Cross-Site Scripting (XSS). The flaw affects all plugin versions up to and including 1.3.1. An attacker who tricks an authenticated administrator into visiting a crafted page can submit a forged request that stores malicious JavaScript in the plugin configuration. The stored payload then executes in the browser of any user who loads an affected page. The weakness is tracked as [CWE-352] Cross-Site Request Forgery.
Critical Impact
Successful exploitation allows attackers to inject persistent JavaScript into WordPress sites, enabling session theft, administrative account takeover, and downstream client-side attacks against site visitors.
Affected Products
- Milat jQuery Automatic Popup WordPress plugin versions through 1.3.1
- WordPress installations with the milat-jquery-automatic-popup plugin enabled
- Sites where administrators can be socially engineered into visiting attacker-controlled URLs
Discovery Timeline
- 2025-04-24 - CVE-2025-46514 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-46514
Vulnerability Analysis
The vulnerability chains a CSRF flaw with a Stored XSS sink in the Milat jQuery Automatic Popup plugin. The plugin exposes administrative actions that update popup content without verifying the origin or intent of the request. Specifically, the plugin lacks a valid WordPress nonce check (wp_verify_nonce) on settings-handling endpoints. Combined with missing output encoding or input sanitization on popup fields, attacker-supplied markup is stored in the database and later rendered into pages.
An attacker hosts a page containing a hidden form or JavaScript that auto-submits a POST request to the WordPress admin endpoint that saves popup settings. If a logged-in administrator visits the attacker-controlled page, the browser sends authenticated cookies and the malicious payload is persisted. Any subsequent page render that includes the popup executes the injected script in visitors' browsers.
Root Cause
The root cause is missing CSRF protection on plugin configuration handlers, compounded by missing sanitization of user-supplied HTML before storage. WordPress provides check_admin_referer and wp_nonce_field primitives for CSRF defense, and wp_kses for HTML sanitization. The plugin does not apply these controls on the affected save path.
Attack Vector
Exploitation requires network access and user interaction. The attacker must convince an authenticated administrator to load a malicious URL. No prior credentials are needed for the attacker. The scope is changed because injected scripts execute in the browser context of any user loading the affected popup, extending impact beyond the administrator's session.
No public proof-of-concept is currently linked in the advisory. See the Patchstack WordPress Plugin Advisory for the technical write-up.
Detection Methods for CVE-2025-46514
Indicators of Compromise
- Unexpected <script>, <iframe>, or event-handler attributes stored in the plugin's popup configuration rows in the wp_options table.
- Outbound requests from site visitors to unfamiliar domains shortly after loading pages that render the popup.
- Administrator account activity recorded from unfamiliar referrers immediately before plugin settings changes.
Detection Strategies
- Review the wp_options table for entries created by milat-jquery-automatic-popup and inspect stored values for HTML or JavaScript content.
- Audit web server access logs for POST requests to wp-admin/admin.php or admin-post.php with the plugin's action parameter and an external Referer header.
- Inspect rendered page DOM on staging for unexpected <script> tags injected through the popup component.
Monitoring Recommendations
- Alert on modifications to WordPress plugin settings that originate from cross-origin referrers.
- Monitor administrator browsing activity for requests to recently registered or low-reputation domains.
- Track Content Security Policy (CSP) violation reports for inline script execution on pages that include the popup.
How to Mitigate CVE-2025-46514
Immediate Actions Required
- Deactivate the Milat jQuery Automatic Popup plugin until a vendor patch is available and verified.
- Audit and clean any popup configuration records that contain HTML or script payloads.
- Force-reset administrator sessions and rotate credentials if compromise is suspected.
Patch Information
At the time of publication, no fixed version is listed in the advisory; the vulnerability affects all releases through 1.3.1. Check the Patchstack WordPress Plugin Advisory and the plugin's WordPress.org page for updates before re-enabling.
Workarounds
- Remove the plugin entirely and replace it with a maintained alternative if no patch is available.
- Enforce a strict Content Security Policy that disallows inline scripts on pages where the popup renders.
- Require administrators to use a dedicated browser profile for WordPress administration to reduce CSRF exposure from other tabs.
- Deploy a web application firewall (WAF) rule that blocks requests to the plugin's admin endpoints lacking a same-origin Referer header.
# Configuration example: disable the plugin via WP-CLI
wp plugin deactivate milat-jquery-automatic-popup
wp plugin delete milat-jquery-automatic-popup
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
