The Popup Box WordPress plugin versions prior to 5.5.0 fail to properly validate nonces in the add_or_edit_popupbox() function before saving popup data. This flaw allows unauthenticated attackers to perform CSRF attacks. When an authenticated administrator visits a crafted malicious page, the attacker can inject arbitrary JavaScript into popups, resulting in stored XSS that executes in the admin interface and on the frontend. The vulnerability combines CWE-79 (Cross-Site Scripting) and CWE-352 (Cross-Site Request Forgery). The CVSS v3.1 base score is 5.4 (medium severity) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

An attacker can leverage this vulnerability to execute arbitrary JavaScript in the context of the admin panel and frontend by tricking an authenticated administrator into visiting a malicious page. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized content manipulation. There is no direct availability impact. No known exploits in the wild have been reported.

No official patch or remediation has been confirmed at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid visiting untrusted or suspicious web pages while logged into the WordPress admin panel. Monitoring vendor channels for updates and applying any future official patches promptly is recommended.