CVE-2025-14394 is a CSRF vulnerability in the melodicmedia Popover Windows WordPress plugin. The issue arises from missing or incorrect nonce validation, which is intended to protect against unauthorized state-changing requests. An attacker can exploit this by convincing an authenticated administrator to trigger a malicious request, leading to unauthorized modification of plugin settings. The vulnerability affects versions up to and including 1.2. There is no indication of known exploits in the wild or available patches at this time.

An attacker can cause an authenticated administrator to unknowingly change plugin settings via a forged request. This could lead to unauthorized configuration changes but does not directly impact confidentiality or availability. The CVSS score of 4.3 reflects a medium impact primarily on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links from untrusted sources and consider disabling or removing the Popover Windows plugin if possible.