WordPress Timed Popup plugin version 1.3 suffers from a cross site request forgery vulnerability that can be leveraged to trick an admin into storing cross site scripting code.