CVE-2025-15611: CWE-79 Cross-Site Scripting (XSS) in Popup Box
CVE-2025-15611 is a vulnerability in the Popup Box WordPress plugin before version 5. 5. 0. It arises from improper validation of nonces in the add_or_edit_popupbox() function, enabling unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) attacks. When an authenticated administrator visits a malicious page, the attacker can create or modify popups containing arbitrary JavaScript, which executes in both the admin panel and the frontend. This leads to Cross-Site Scripting (XSS) exploitation. No official patch or remediation guidance is currently available.
AI Analysis
Technical Summary
The Popup Box WordPress plugin versions prior to 5.5.0 fail to properly validate nonces in the add_or_edit_popupbox() function before saving popup data. This flaw allows unauthenticated attackers to conduct CSRF attacks that, when combined with an authenticated admin visiting a crafted malicious page, enable the injection and execution of arbitrary JavaScript code in the admin interface and frontend. The vulnerability involves CWE-79 (Cross-Site Scripting) and CWE-352 (Cross-Site Request Forgery). No CVSS score or official remediation level has been published yet.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the WordPress admin panel and frontend via manipulated popups. This can lead to administrative account compromise, unauthorized actions within the WordPress site, and potential site defacement or data theft. The vulnerability requires an authenticated admin to visit a malicious page, leveraging CSRF to inject the malicious script.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid visiting untrusted or suspicious websites while logged into the WordPress admin panel. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches promptly.
CVE-2025-15611: CWE-79 Cross-Site Scripting (XSS) in Popup Box
Description
CVE-2025-15611 is a vulnerability in the Popup Box WordPress plugin before version 5. 5. 0. It arises from improper validation of nonces in the add_or_edit_popupbox() function, enabling unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) attacks. When an authenticated administrator visits a malicious page, the attacker can create or modify popups containing arbitrary JavaScript, which executes in both the admin panel and the frontend. This leads to Cross-Site Scripting (XSS) exploitation. No official patch or remediation guidance is currently available.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Popup Box WordPress plugin versions prior to 5.5.0 fail to properly validate nonces in the add_or_edit_popupbox() function before saving popup data. This flaw allows unauthenticated attackers to conduct CSRF attacks that, when combined with an authenticated admin visiting a crafted malicious page, enable the injection and execution of arbitrary JavaScript code in the admin interface and frontend. The vulnerability involves CWE-79 (Cross-Site Scripting) and CWE-352 (Cross-Site Request Forgery). No CVSS score or official remediation level has been published yet.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the WordPress admin panel and frontend via manipulated popups. This can lead to administrative account compromise, unauthorized actions within the WordPress site, and potential site defacement or data theft. The vulnerability requires an authenticated admin to visit a malicious page, leveraging CSRF to inject the malicious script.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid visiting untrusted or suspicious websites while logged into the WordPress admin panel. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-03-16T18:36:17.868Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d4a832aaed68159ad9ba6a
Added to database: 4/7/2026, 6:46:10 AM
Last enriched: 4/7/2026, 7:01:23 AM
Last updated: 4/7/2026, 8:11:56 AM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.