CVE-2025-14394

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14394", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-09T22:11:23.702Z", "datePublished": "2025-12-13T04:31:32.153Z", "dateUpdated": "2026-04-08T17:20:13.154Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:13.154Z"}, "affected": [{"vendor": "melodicmedia", "product": "Popover Windows", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Popover Windows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2af263f-960b-4807-bc85-d136136fa30f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/popover-windows/tags/1.2/popoveroptions.php#L98"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2025-12-12T16:09:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:43:08.837861Z", "id": "CVE-2025-14394", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:47:04.952Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14394", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:43:08.837861Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:43:09.863Z"}}], "cna": {"title": "Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "melodicmedia", "product": "Popover Windows", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T16:09:54.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2af263f-960b-4807-bc85-d136136fa30f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/popover-windows/tags/1.2/popoveroptions.php#L98"}], "descriptions": [{"lang": "en", "value": "The Popover Windows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:13.154Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14394", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:20:13.154Z", "dateReserved": "2025-12-09T22:11:23.702Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T04:31:32.153Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Popover Windows", "vendor": "melodicmedia", "versions": [{"lessThanOrEqual": "1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Popover Windows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Popover Windows para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en versiones hasta la 1.2, inclusive. Esto se debe a la falta o la incorrecci\u00f3n de la validaci\u00f3n de nonce. Esto hace posible que atacantes no autenticados actualicen la configuraci\u00f3n del plugin a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-14394", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14394", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:43:08.837861Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:49.100", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/popover-windows/tags/1.2/popoveroptions.php#L98"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2af263f-960b-4807-bc85-d136136fa30f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:48:03.736264+00:00", "value": {"mitigation_remediation": ["Upgrade the Popover Windows plugin to the latest available version, which must be newer than 1.2.", "If no newer release exists, uninstall the plugin.", "If the plugin is required, restrict access to the plugin\u2019s admin pages to trusted users and implement additional server\u2011side checks such as validating the referer header."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Request Forgery permitting arbitrary configuration changes"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the Popover Windows plugin from melodicmedia. Versions 1.2 and below are affected; no specific patch version is listed in the advisory, so users should verify whether an updated release (post\u20111.2) is available and install it.", "description_and_impact": "The Popover Windows WordPress plugin is vulnerable to Cross\u2011Site Request Forgery in all versions up to and including 1.2. The flaw stems from missing or incorrect nonce validation, allowing an attacker to craft a forged request that will be accepted as if submitted by a logged\u2011in administrator. In effect, an unauthenticated attacker can alter the plugin\u2019s settings, potentially redirecting site content, exposing sensitive data, or otherwise compromising the site\u2019s behavior. The weakness is identified as CWE\u2011352. The vulnerability does not expose any direct data leakage or privilege escalation but can compromise the integrity of the site\u2019s configuration.", "risk_and_exploitability": "The CVSS score of 4.3 places this bug in the Moderate range, reflecting its limited impact. The EPSS score of less than 1% indicates that the probability of this vulnerability being actively exploited is very low at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to entice an administrator to click a malicious link or submit a forged form; no authentication or privileged system access is required to exploit the flaw."}}}}, "created": "2025-12-14T21:15:09.457493+00:00", "updated": "2026-04-21T01:00:12.940287+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}