CVE-2026-65540highCWE-352

CVE-2026-65540: high-severity vulnerability in Metin Saraç Popup for CF7 with Sweet Alert

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

Published 23 Jul 2026

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.1epss 0.1%

from disclosure to weapon50 days

Published on NVDJul 23

1st PoC+50d

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Affected products

public PoCs found — 1

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Metin Saraç Popup for CF7 with Sweet Alert

In the same product, most dangerous first.

References