How severe is CVE-2025-15611?

CVE-2025-15611 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-15611 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-15611?

CVE-2025-15611 affects Ays-pro Popup Box. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-15611?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-15611 have an EU (EUVD) identifier?

Yes. CVE-2025-15611 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-209259.

When was CVE-2025-15611 published?

CVE-2025-15611 was published on 2026-04-07 and last updated on 2026-06-17.

CVE-2025-15611

CVE-2025-15611 is a medium-severity vulnerability in Ays-pro Popup Box with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-918.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 0% (3rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-209259
Weakness: CWE-918
Affected product: Ays-pro Popup Box
Published: 2026-04-07
Last modified: 2026-06-17

Description

The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.

Frequently asked questions

What is CVE-2025-15611?: The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.
How severe is CVE-2025-15611?: CVE-2025-15611 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-15611 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-15611?: CVE-2025-15611 affects Ays-pro Popup Box. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-15611?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-15611 have an EU (EUVD) identifier?: Yes. CVE-2025-15611 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-209259.
When was CVE-2025-15611 published?: CVE-2025-15611 was published on 2026-04-07 and last updated on 2026-06-17.

References

https://wpscan.com/vulnerability/089ea763-2421-4089-a220-251421f7f226/

Affected products (1)

cpe:2.3:a:ays-pro:popup_box:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Ays-pro Popup Box

CVE-2021-24460 — High (CVSS 8.8): The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use…
CVE-2021-24458 — High (CVSS 8.8): The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not…
CVE-2023-27414 — High (CVSS 7.1): Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Popup Box Team Popup box plugin <= 3.4.4 versions.
CVE-2024-9599 — Medium (CVSS 5.4): The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high…
CVE-2023-6591 — Medium (CVSS 4.8): The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high…
CVE-2023-5874 — Medium (CVSS 4.8): The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high…

All CVEs affecting Ays-pro Popup Box →

Other CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities

CVE-2026-47938 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)…
CVE-2026-35431 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to…
CVE-2026-32186 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a…
CVE-2026-33107 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a…
CVE-2026-32871 — Critical (CVSS 10.0): FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP…
CVE-2026-32169 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a…

Browse all CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities →