| Plugin Name | WordPress Popup Box AYS Pro plugin |
|---|---|
| Type of Vulnerability | Cross-Site Scripting (XSS) |
| CVE Number | CVE-2025-15611 |
| Urgency | Medium |
| CVE Publish Date | 2026-04-08 |
| Source URL | CVE-2025-15611 |
Breaking Down CVE-2025-15611 — Admin Stored XSS via CSRF in Popup Box Plugin (< 5.5.0) & How to Protect Your WordPress Site
Author: Hong Kong Security Expert
Date: 2026-04-08
Summary: A medium-severity stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-15611) was disclosed in the WordPress Popup Box AYS Pro plugin (affected versions < 5.5.0). The vulnerability permits an attacker to use a CSRF vector to cause privileged users to save malicious content that becomes persistently stored and executed. This article explains the risk, detection, mitigation, and practical steps you can take immediately using hardening, code fixes, and temporary edge mitigations.
What happened (plain language)
A widely used popup plugin for WordPress published a security advisory: versions prior to 5.5.0 contain a stored Cross-Site Scripting (XSS) vulnerability that can be triggered via Cross-Site Request Forgery (CSRF). Simply put, an attacker can craft a page or link which, when visited by an administrator (or other privileged user) while authenticated, causes malicious HTML/JavaScript to be stored in the site. That stored content executes later in the browser context of admins or visitors, enabling session theft, malicious actions, site defacement, spam injections, and more.
If your site runs this plugin and it is active and not updated to 5.5.0 or later, treat this as urgent: update as soon as possible or apply conservative mitigations immediately.
Technical summary
- Vulnerability: Admin stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)
- CVE: CVE-2025-15611
- Affected versions: plugin versions earlier than 5.5.0
- Required privileges: attack is crafted by an unauthenticated actor, but exploitation requires a privileged user (e.g., admin) to interact while authenticated
- CVSS (reported): ~7.1 (medium)
- Type: Persistent (stored) XSS triggered via CSRF
How the exploit works (step-by-step)
- The plugin exposes an admin-facing form or AJAX endpoint used to create or edit popup content (title, body HTML, CSS, etc.).
- The endpoint accepts content and stores it without properly verifying the request origin (no/insufficient nonce or referer check) and without proper sanitization/escaping of HTML.
- An attacker crafts a malicious page or email containing a forged request (link or auto-submitting form) targeting the vulnerable admin endpoint. The forged request includes JavaScript payloads embedded in a popup content field (for example,
