CVE-2014-9525: Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 f...

Security readout for executives and security teams

This affects WordPress sites using Timed Popup plugin version 1.3. An attacker could trick a logged-in administrator into making unwanted plugin changes, including injecting script content through a popup subtitle field. The sources do not provide a CVSS score, fixed version, or evidence of active exploitation. Exposure is likely limited to WordPress installations that still have Timed Popup/wp-timed-popup 1.3 installed and administratively reachable. The bundle does not identify other affected versions or products. Treat as a targeted legacy WordPress exposure. Prioritize sites where this plugin remains active, especially public-facing or business-critical sites managed by multiple administrators. Mitigation focus: Inventory WordPress sites for Timed Popup/wp-timed-popup 1.3.; Check vendor or WordPress plugin guidance for a maintained fixed version.; Disable or remove the plugin if no supported fix is available..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.