CVE-2025-57931
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Popup box plugin for WordPress (versions up to 5.5.4) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions.
Risk Assessment
Unauthorized operations may be performed in the context of a logged-in user, potentially leading to configuration or data changes.
Recommendation
Update the Popup box plugin to a version newer than 5.5.4 or disable it.
Other vulnerabilities in Popup box
See all- CVE-2026-54192High
Popup box versions up to 6.2.9 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
- CVE-2026-57631High
SQL Injection vulnerability in Popup box versions up to 6.0.1 allows an administrator to inject malicious SQL code. An attacker with admin privileges can manipulate database queries.
- CVE-2025-69021Medium
Cross-Site Request Forgery (CSRF) vulnerability in Popup box (WordPress plugin) allows an attacker to force a logged-in user to perform unwanted actions. Affects versions up to and including 6.0.7.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 5.5.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS