The Popover Windows WordPress plugin is vulnerable to Cross‑Site Request Forgery in all versions up to and including 1.2. The flaw stems from missing or incorrect nonce validation, allowing an attacker to craft a forged request that will be accepted as if submitted by a logged‑in administrator. In effect, an unauthenticated attacker can alter the plugin’s settings, potentially redirecting site content, exposing sensitive data, or otherwise compromising the site’s behavior. The weakness is identified as CWE‑352. The vulnerability does not expose any direct data leakage or privilege escalation but can compromise the integrity of the site’s configuration.

WordPress sites that have installed the Popover Windows plugin from melodicmedia. Versions 1.2 and below are affected; no specific patch version is listed in the advisory, so users should verify whether an updated release (post‑1.2) is available and install it.

The CVSS score of 4.3 places this bug in the Moderate range, reflecting its limited impact. The EPSS score of less than 1% indicates that the probability of this vulnerability being actively exploited is very low at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to entice an administrator to click a malicious link or submit a forged form; no authentication or privileged system access is required to exploit the flaw.