The Ays Pro Popup box plugin contains a CSRF vulnerability that permits attackers to forge requests on behalf of authenticated users. By crafting malicious URLs or embedding them in web pages, an attacker can trigger state‑changing operations performed by the plugin without the victim’s knowledge. This flaw is classified as CWE‑352 and can allow unauthorized configuration changes or content manipulation, compromising the integrity of the hosted site.

Ays Pro Popup box plugin, versions from the initial release through 5.5.4 inclusive, is affected. No other vendors or product lines are listed in the advisory.

The CVSS score of 5.3 indicates moderate severity, and the EPSS of <1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is browser‑based; an attacker must persuade a logged‑in administrator to visit a crafted link or embed the request in an innocuous page. Successful exploitation would allow an attacker to modify or delete popup content without authorization.