CVE-2025-14394

MediumCVSS 4.3

Published: 13/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

The WordPress plugin Popover Windows in versions up to and including 1.2 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation. This allows unauthenticated attackers to update the plugin's settings via a forged request if they can trick an administrator into clicking a link.

Risk Assessment

An attacker could change plugin settings without the administrator's knowledge, potentially leading to unwanted changes in site appearance or behavior. This could be used for further attacks.

Recommendation

Update the Popover Windows plugin to a version newer than 1.2 as soon as it becomes available. Until then, restrict admin panel access and educate administrators.

Other vulnerabilities in Popover Windows

CVE-2025-14395Medium
The Popover Windows plugin for WordPress is vulnerable to unauthorized data modification due to missing capability checks on multiple AJAX actions in all versions up to 1.2. This allows authenticated attackers with subscriber-level access and above to modify plugin settings and content.

Original NVD description (English source)

The Popover Windows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS