CVE-2025-14395

MediumCVSS 4.3

Published: 13/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Popover Windows plugin for WordPress is vulnerable to unauthorized data modification due to missing capability checks on multiple AJAX actions in all versions up to 1.2. This allows authenticated attackers with subscriber-level access and above to modify plugin settings and content.

Risk Assessment

Attackers can alter plugin settings and content, potentially leading to site defacement or injection of malicious content.

Recommendation

Update the plugin to the latest version and restrict AJAX actions to trusted roles only.

Other vulnerabilities in Popover Windows

CVE-2025-14394Medium
The WordPress plugin Popover Windows in versions up to and including 1.2 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation. This allows unauthenticated attackers to update the plugin's settings via a forged request if they can trick an administrator into clicking a link.

Original NVD description (English source)

The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions (e.g., pop_submit, poptheme_submit) in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings and content.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS