EUVD-2026-37635Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable Popup Box
-
DeliveryCraft malicious URL with XSS payload
-
ExploitPhish WordPress admin with link
-
ExecutionVictim clicks while authenticated
-
PersistScript executes in WordPress origin
-
ImpactSteal session or create rogue admin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a WordPress site running the Ays Pro Popup Box plugin at version 6.2.9 or below, (2) the attacker delivering a crafted URL to a victim who is currently authenticated to that WordPress site (UI:R - user must click the link), and (3) the victim's browser to execute JavaScript in the WordPress origin. Limiting factors: the attack is reflected (not stored), so each victim must individually click an attacker-supplied link, and the highest-impact outcome (admin session compromise) requires the victim to be a privileged user. No authentication on the attacker side is required (PR:N), and no non-default configuration is mentioned - the vulnerability applies to default installations of the plugin. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L produces 7.1 (High), driven primarily by the scope change and unauthenticated network reach, offset by the required user interaction (clicking a crafted link). No EPSS score, KEV listing, or public POC was provided, suggesting this is a routine plugin XSS discovered through Patchstack's research program rather than an actively targeted vulnerability. Real-world risk is moderate and concentrated against high-value WordPress targets (administrators) where successful XSS could pivot to session theft or admin takeover; for typical low-traffic sites the practical risk is lower. Key data missing: no fixed-version confirmation, no independent exploit verification, and no statement on whether the XSS is in a frontend or admin-only surface. |
| Exploit ScenarioDerived | An attacker crafts a URL containing a malicious JavaScript payload in a parameter handled by the Popup Box plugin and delivers it via phishing email, forum post, or malvertising to a WordPress administrator. When the admin clicks the link while logged in, the script executes in the WordPress origin and can exfiltrate session cookies, perform CSRF-style actions, or inject a backdoored admin user. No POC was identified in the provided data, but reflected XSS in WordPress plugins is well-understood and trivially exploitable once the vulnerable parameter is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Reflected cross-site scripting in the Ays Pro Popup Box WordPress plugin versions 6.2.9 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The CVSS 7.1 score reflects scope change (S:C) typical of XSS escaping the plugin context into the broader WordPress session. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis from the input data - site administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ays-popup-box/vulnerability/wordpress-popup-box-plugin-6-2-9-reflected-cross-site-scripting-xss-vulnerability) and the Ays Pro Popup Box page on WordPress.org for the latest version above 6.2.9 and upgrade immediately once available. Until a fixed release is confirmed, compensating controls include deactivating and uninstalling the Popup Box plugin (which removes popup functionality entirely), deploying a WAF rule that blocks reflected script payloads in query parameters reaching the plugin's endpoints, or enforcing a strict Content-Security-Policy that disallows inline script execution (note this can break other plugins or themes that rely on inline handlers). Educating administrators to avoid clicking unsolicited links to their own site while logged in further reduces the chance of session hijack.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Ays Pro 'Popup Box' WordPress plugin (CPE cpe:2.3:a:ays_pro:popup_box), a third-party plugin used to display promotional and notification popups on WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is reflected back into HTML output without proper encoding or sanitization. Because the flaw is reflected XSS, the malicious payload travels in the request itself (typically a URL parameter) rather than being stored server-side, and execution occurs in the context of the WordPress site origin.
Know when Popup Box gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS reachable over the network without authentication, requires victim click (UI:R), and crosses into the WordPress origin (S:C) with limited C/I/A impact via script execution.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.
Executive ViewAI
The Ays Pro Popup Box WordPress plugin versions 6.2.9 and earlier contains a reflected cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary code in users' browsers via crafted links. No public exploit identified at time of analysis, though the vulnerability could enable credential theft, session hijacking, and malware distribution across WordPress sites using this plugin. Organizations must immediately assess deployment scope and implement protective measures.
Implement WAF rules targeting reflected XSS attack patterns; strengthen Content Security Policy (CSP) headers to restrict inline script execution; limit plugin functionality to authenticated administrator accounts; disable plugin entirely if not business-critical; establish vendor monitoring for future patch availability; educate users to avoid clicking suspicious links from untrusted sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
The get_fb_likeboxes() function in the Popup Like box - Page Plugin WordPress plugin before 3.5.3 did not use whitelist
The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use
The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plug
Cross-Site Request Forgery in Popup Box WordPress plugin before 5.5.0 allows authenticated admins to be tricked into cre
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high pr
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high pr
The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high pr
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privi
The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high pr
GitHub PoC
Exploit-DB