Threat Entry Updated 2026-04-15

CVE-2026-1165 - Ays Popup Box Plugin

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather than one submitted in the request. This makes it possible for unauthenticated attackers to change the publish status of popups via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

PLUGIN Ays Popup Box

CVE-2026-1165

MEDIUM CVSS 4.3 2026-01-31

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-18

CVE-2024-10861 - Ays Popup Box Plugin

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to update the 'ays_pb_upgrade_plugin' option with arbitrary data.

PLUGIN Ays Popup Box

CVE-2024-10861

MEDIUM CVSS 5.3 2024-11-16

Risk Score

Open Full Technical Breakdown