Medium · 4.3 CVE-2025-48363 EUVD-2025-26016GHSA-qw6f-wfc7-g53p

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

Published Aug 28, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Metin Saraç Product: Popup for CF7 with Sweet Alert

Description

Cross-Site Request Forgery (CSRF) vulnerability in Metin Saraç Popup for CF7 with Sweet Alert cf7-sweet-alert-popup allows Cross Site Request Forgery.This issue affects Popup for CF7 with Sweet Alert: from n/a through <= 1.6.5.

Affected products

Vendor	Product	Affected	Fixed
Metin Saraç	Popup for CF7 with Sweet Alert	≤ 1.6.5	—

References

https://patchstack.com/database/Wordpress/Plugin/cf7-sweet-alert-popup/vulnerability/wordpress-popup-for-cf7-with-sweet-alert-plugin-1-6-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry