Skip to content
OpenAdvisories

Vendor

melodicmedia

2 known vulnerabilities.

Products

Popover Windows 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-14394

    Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update

    The Popover Windows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's setti…

    melodicmedia Popover Windows Windows Web / CMS
  • Medium 4.3
    CVE-2025-14395

    Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions

    The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions (e.g., pop_submit, poptheme_submit) in all versions up to, and including, 1.2. This makes it possible for au…

    melodicmedia Popover Windows Windows Web / CMS