CVE-2025-48363

MediumCVSS 4.3

Published: 28/08/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Popup for CF7 with Sweet Alert plugin (cf7-sweet-alert-popup) in versions up to and including 1.6.5 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized actions on behalf of a logged-in user.

Risk Assessment

An attacker could trick an administrator into performing unwanted operations in WordPress, potentially leading to configuration changes or site takeover.

Recommendation

Update the Popup for CF7 with Sweet Alert plugin to a version newer than 1.6.5, or remove it if not in use.

Other vulnerabilities in Popup for CF7 with Sweet Alert

CVE-2026-65540High
Unauthenticated Cross-Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert versions up to 1.6.5.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Metin Saraç Popup for CF7 with Sweet Alert cf7-sweet-alert-popup allows Cross Site Request Forgery.This issue affects Popup for CF7 with Sweet Alert: from n/a through <= 1.6.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS