# Cross-site request forgery (CSRF). A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [PHPGurukul Car Rental Portal cross-site request forgery](https://agentprime.io/advisories/CVE-2025-6284.md) `CVE-2025-6284` · CVE record: PHPGurukul Car Rental Portal · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site request forgery](https://agentprime.io/advisories/CVE-2024-54172.md) `CVE-2024-54172` · CVE record: IBM Sterling B2B Integrator · CVSS 4.3 Medium · Not analysed yet · Published 18 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-48111.md) `CVE-2025-48111` · CVE record: YITHEMES YITH PayPal Express Checkout for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 17 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Responsive Plus plugin <= 3.2.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability](https://agentprime.io/advisories/CVE-2025-49856.md) `CVE-2025-49856` · CVE record: CyberChimps Responsive Plus · CVSS 4.3 Medium · Not analysed yet · Published 17 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Advanced Settings plugin <= 3.0.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49865.md) `CVE-2025-49865` · CVE record: Helmut Wandl Advanced Settings · CVSS 4.3 Medium · Not analysed yet · Published 17 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WuKongOpenSource WukongCRM AdminRoleController.java cross-site request forgery](https://agentprime.io/advisories/CVE-2025-6106.md) `CVE-2025-6106` · CVE record: WuKongOpenSource WukongCRM · CVSS 5.3 Medium · Not analysed yet · Published 16 Jun 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [jflyfox jfinal_cms HOME.java cross-site request forgery](https://agentprime.io/advisories/CVE-2025-6105.md) `CVE-2025-6105` · CVE record: jflyfox jfinal_cms · CVSS 5.3 Medium · Not analysed yet · Published 16 Jun 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [XiSearch bar <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-6063.md) `CVE-2025-6063` · CVE record: dmitry78 XiSearch bar · CVSS 6.1 Medium · Not analysed yet · Published 14 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-6062.md) `CVE-2025-6062` · CVE record: netlatch Yougler Blogger Profile Page · CVSS 4.3 Medium · Not analysed yet · Published 14 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [AI Image Lab – Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update](https://agentprime.io/advisories/CVE-2025-4592.md) `CVE-2025-4592` · CVE record: aspengrovestudios AI Image Lab – Free AI Image Generator · CVSS 4.3 Medium · Not analysed yet · Published 14 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Zen Sticky Social <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-6055.md) `CVE-2025-6055` · CVE record: bogdanding Zen Sticky Social · CVSS 6.1 Medium · Not analysed yet · Published 14 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WP URL Shortener <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-6064.md) `CVE-2025-6064` · CVE record: djerba WP URL Shortener · CVSS 6.1 Medium · Not analysed yet · Published 14 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Seraphinite Accelerator <= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actions](https://agentprime.io/advisories/CVE-2025-6059.md) `CVE-2025-6059` · CVE record: seraphinitesoft Seraphinite Accelerator · CVSS 4.3 Medium · Not analysed yet · Published 14 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-5928.md) `CVE-2025-5928` · CVE record: fay-1 WP Sliding Login/Dashboard Panel · CVSS 4.3 Medium · Not analysed yet · Published 13 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Import](https://agentprime.io/advisories/CVE-2025-5938.md) `CVE-2025-5938` · CVE record: themebon Digital Marketing and Agency Templates Addons for Elementor · CVSS 5.3 Medium · Not analysed yet · Published 13 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WP2HTML <= 1.0.2 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-5930.md) `CVE-2025-5930` · CVE record: digitalacornjp WP2HTML · CVSS 4.3 Medium · Not analysed yet · Published 13 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Link Shield <= 0.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-5926.md) `CVE-2025-5926` · CVE record: jconti Link Shield · CVSS 6.1 Medium · Not analysed yet · Published 13 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [VirtueMart - Cross Site Request Forgery (CSRF)](https://agentprime.io/advisories/CVE-2025-6001.md) `CVE-2025-6001` · CVE record: VirtueMart VirtueMart · CVSS 8.3 High · Not analysed yet · Published 11 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Weidmueller: Security routers IE-SR-2TX are affected by CSRF](https://agentprime.io/advisories/CVE-2025-41661.md) `CVE-2025-41661` · CVE record: Weidmueller IE-SR-2TX-WL and 2 more · CVSS 8.8 High · Not analysed yet · Published 11 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in Dell Wyse Management Suite](https://agentprime.io/advisories/CVE-2025-36576.md) `CVE-2025-36576` · CVE record: Dell Wyse Management Suite · CVSS 2.7 Low · Not analysed yet · Published 10 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49510.md) `CVE-2025-49510` · CVE record: WPFactory Min Max Step Quantity Limits Manager for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Civi Framework plugin <= 2.1.6 - Cross Site Request Forgery (CSRF) to User Deactivation vulnerability](https://agentprime.io/advisories/CVE-2025-49511.md) `CVE-2025-49511` · CVE record: uxper Civi Framework · CVSS 7.1 High · Not analysed yet · Published 10 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Bunny’s Print CSS <= 0.95 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-5925.md) `CVE-2025-5925` · CVE record: steph Bunny’s Print CSS · CVSS 4.3 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Tenda AC9 cross-site request forgery](https://agentprime.io/advisories/CVE-2025-5900.md) `CVE-2025-5900` · CVE record: Tenda AC9 · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [jsnjfz WebStack-Guns cross-site request forgery](https://agentprime.io/advisories/CVE-2025-5888.md) `CVE-2025-5888` · CVE record: jsnjfz WebStack-Guns · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [Konica Minolta bizhub cross-site request forgery](https://agentprime.io/advisories/CVE-2025-5885.md) `CVE-2025-5885` · CVE record: Konica Minolta bizhub · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [code-projects Laundry System cross-site request forgery](https://agentprime.io/advisories/CVE-2025-5766.md) `CVE-2025-5766` · CVE record: code-projects Laundry System · CVSS 5.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [WordPress Konami Easter Egg plugin <= v0.4 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49425.md) `CVE-2025-49425` · CVE record: Adrian Hanft Konami Easter Egg · CVSS 7.1 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Wp Easy Allopass plugin <= 4.1.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49435.md) `CVE-2025-49435` · CVE record: Hasina77 Wp Easy Allopass · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Atelier Create CV plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability](https://agentprime.io/advisories/CVE-2025-49439.md) `CVE-2025-49439` · CVE record: mariusz88atelierweb Atelier Create CV · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Security Master plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49440.md) `CVE-2025-49440` · CVE record: Vuong Nguyen WP Security Master · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Interactive UK Regional Map plugin <= 2.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability](https://agentprime.io/advisories/CVE-2025-49445.md) `CVE-2025-49445` · CVE record: WP Map Plugins Interactive UK Regional Map · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Admin Notes plugin <=1.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49446.md) `CVE-2025-49446` · CVE record: minhlaobao Admin Notes · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Interactive Regional Map of Africa plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49449.md) `CVE-2025-49449` · CVE record: WP Map Plugins Interactive Regional Map of Africa · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress BP Profile as Homepage plugin <= 1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-49453.md) `CVE-2025-49453` · CVE record: Jatinder Pal Singh BP Profile as Homepage · CVSS 7.1 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-24772.md) `CVE-2025-24772` · CVE record: cmsMinds Pay with Contact Form 7 · CVSS 5.4 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress FastBook plugin <= 1.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-26593.md) `CVE-2025-26593` · CVE record: FasterThemes FastBook · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Media File Type Manager plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-27359.md) `CVE-2025-27359` · CVE record: Seerox WP Media File Type Manager · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Quick Event Calendar plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-27360.md) `CVE-2025-27360` · CVE record: WP Corner Quick Event Calendar · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Mediabay - WordPress Media Library Folders plugin <= 1.4 - CSRF to Reflected XSS vulnerability](https://agentprime.io/advisories/CVE-2025-28948.md) `CVE-2025-28948` · CVE record: codedraft Mediabay - WordPress Media Library Folders · CVSS 7.1 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Post Author plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-28950.md) `CVE-2025-28950` · CVE record: David Shabtai Post Author · CVSS 7.1 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress CubePoints plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-28952.md) `CVE-2025-28952` · CVE record: Jonathan Lau CubePoints · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Backwp plugin <= 2.0.2 - CSRF to Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2025-28954.md) `CVE-2025-28954` · CVE record: wphobby Backwp · CVSS 7.4 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Bg Orthodox Calendar plugin <= 0.13.10 - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-28958.md) `CVE-2025-28958` · CVE record: Vadim Bogaiskov Bg Orthodox Calendar · CVSS 7.1 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Personal Favicon plugin <= 2.0 - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-28964.md) `CVE-2025-28964` · CVE record: mangup Personal Favicon · CVSS 7.1 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Recent Posts Slider Responsive plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-28966.md) `CVE-2025-28966` · CVE record: dilemma123 Recent Posts Slider Responsive · CVSS 7.1 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Free WP Mail SMTP plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-28974.md) `CVE-2025-28974` · CVE record: mail250 Free WP Mail SMTP · CVSS 7.1 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Mail Options plugin <= 0.2.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-28981.md) `CVE-2025-28981` · CVE record: Soli WP Mail Options · CVSS 7.1 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Subscription Renewal Reminders for WooCommerce plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-28984.md) `CVE-2025-28984` · CVE record: storepro Subscription Renewal Reminders for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Epicwin Plugin plugin <= 1.5 - CSRF to SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2025-28986.md) `CVE-2025-28986` · CVE record: Webaholicson Epicwin Plugin · CVSS 8.2 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress HR Management Lite plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-29005.md) `CVE-2025-29005` · CVE record: Weblizar - WordPress Themes & Plugin HR Management Lite · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Bitly URL Shortener plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-30629.md) `CVE-2025-30629` · CVE record: Codehaveli Bitly URL Shortener · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Global Translator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-30632.md) `CVE-2025-30632` · CVE record: pozzad Global Translator · CVSS 5.4 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Custom Bulk/Quick Edit plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-30946.md) `CVE-2025-30946` · CVE record: Michael Cannon Custom Bulk/Quick Edit · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Layouts for Elementor plugin <= 1.11 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-30948.md) `CVE-2025-30948` · CVE record: Giraphix Creative Layouts for Elementor · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Booqable Rental plugin <= 2.4.25 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-30956.md) `CVE-2025-30956` · CVE record: Booqable Rental Software Booqable Rental · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Advanced Post List plugin <= 0.5.6.2 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-30968.md) `CVE-2025-30968` · CVE record: jokerbr313 Advanced Post List · CVSS 5.4 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-30980.md) `CVE-2025-30980` · CVE record: Alessandro Piconi Simple Keyword to Link · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP-Recall plugin <= 16.26.14 - CSRF to Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2025-30981.md) `CVE-2025-30981` · CVE record: tggfref WP-Recall · CVSS 6.3 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Elite Video Player plugin <= 10.0.5 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-30986.md) `CVE-2025-30986` · CVE record: \_CreativeMedia\_ Elite Video Player · CVSS 5.4 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site request forgery (CSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .