Medium · 5.3 CVE-2025-57931 EUVD-2025-36595GHSA-hrf6-48c7-hhqf

WordPress Popup box plugin <= 5.5.4 - Cross Site Request Forgery (CSRF) vulnerability

Published Oct 29, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 5.5.4.

Affected products

Vendor	Product	Affected	Fixed
Ays Pro	Popup box	≤ 5.5.4	—

References

https://patchstack.com/database/Wordpress/Plugin/ays-popup-box/vulnerability/wordpress-popup-box-plugin-5-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry