CVE-2025-69021
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Cross-Site Request Forgery (CSRF) vulnerability in Popup box (WordPress plugin) allows an attacker to force a logged-in user to perform unwanted actions. Affects versions up to and including 6.0.7.
Risk Assessment
An attacker can force an administrator to change settings, delete content, or perform other actions without consent, potentially leading to site takeover.
Recommendation
Update Popup box to the latest version. Additionally, use CSRF tokens in forms and verify request origin.
Other vulnerabilities in Popup box
See all- CVE-2026-54192High
Popup box versions up to 6.2.9 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
- CVE-2026-57631High
SQL Injection vulnerability in Popup box versions up to 6.0.1 allows an administrator to inject malicious SQL code. An attacker with admin privileges can manipulate database queries.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS