# Cross-site request forgery (CSRF). A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Like & Share My Site <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-7685.md) `CVE-2025-7685` · CVE record: sflack Like & Share My Site · CVSS 6.1 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Latest Post Accordian Slider <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-7687.md) `CVE-2025-7687` · CVE record: anop-goswami Latest Post Accordian Slider · CVSS 6.1 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2025-7369.md) `CVE-2025-7369` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.1 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [PHPGurukul Complaint Management System cross-site request forgery](https://agentprime.io/advisories/CVE-2025-7834.md) `CVE-2025-7834` · CVE record: PHPGurukul Complaint Management System · CVSS 5.3 Medium · Not analysed yet · Published 19 Jul 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [Avishi WP PayPal Payment Button <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-7669.md) `CVE-2025-7669` · CVE record: avishika Avishi WP PayPal Payment Button · CVSS 6.1 Medium · Not analysed yet · Published 19 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Copymatic – AI Content Writer & Generator <= 2.1 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-6781.md) `CVE-2025-6781` · CVE record: ryanfaber Copymatic – AI Content Writer & Generator · CVSS 4.3 Medium · Not analysed yet · Published 18 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Zuppler Online Ordering <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-6053.md) `CVE-2025-6053` · CVE record: bogdansilivestru Zuppler Online Ordering · CVSS 6.1 Medium · Not analysed yet · Published 18 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [StudentManage v1.0 was discovered to contain Cross-Site Request Forgery (CSRF).](https://agentprime.io/advisories/CVE-2025-50586.md) `CVE-2025-50586` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 18 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [code-projects E-Commerce Site cross-site request forgery](https://agentprime.io/advisories/CVE-2025-7756.md) `CVE-2025-7756` · CVE record: code-projects E-Commerce Site · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [WordPress Import CDN-Remote Images plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-48153.md) `CVE-2025-48153` · CVE record: Atakan Au Import CDN-Remote Images · CVSS 7.1 High · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Post Hide plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54042.md) `CVE-2025-54042` · CVE record: Xfinitysoft WP Post Hide · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Wallet System for WooCommerce plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54041.md) `CVE-2025-54041` · CVE record: WP Swings Wallet System for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Animator plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54039.md) `CVE-2025-54039` · CVE record: Toast Plugins Animator · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Restaurant Menu by MotoPress plugin <= 2.4.6 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54038.md) `CVE-2025-54038` · CVE record: jetmonsters Restaurant Menu by MotoPress · CVSS 5.4 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Webba Booking plugin <= 5.1.20 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54036.md) `CVE-2025-54036` · CVE record: Webba Appointment Booking Webba Booking · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54035.md) `CVE-2025-54035` · CVE record: Tribulant Software Newsletters · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Theme Builder For Elementor plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54033.md) `CVE-2025-54033` · CVE record: BlocksWP Theme Builder For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WooCommerce Google Sheet Connector plugin <= 1.3.20 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54030.md) `CVE-2025-54030` · CVE record: WesternDeal WooCommerce Google Sheet Connector · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Coupon Affiliates plugin <= 6.4.0 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54022.md) `CVE-2025-54022` · CVE record: Elliot Sowersby / RelyWP Coupon Affiliates · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress AntiSpam for Contact Form 7 plugin <= 0.6.3 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54020.md) `CVE-2025-54020` · CVE record: Erik AntiSpam for Contact Form 7 · CVSS 5.4 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress FluentSnippets plugin <= 10.50 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-54010.md) `CVE-2025-54010` · CVE record: Shahjahan Jewel FluentSnippets · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in Oracle Corporation Oracle Applications Framework](https://agentprime.io/advisories/CVE-2025-50090.md) `CVE-2025-50090` · CVE record: Oracle Corporation Oracle Applications Framework · CVSS 5.4 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2025-30756.md) `CVE-2025-30756` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 6.1 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in Oracle Corporation Oracle iStore](https://agentprime.io/advisories/CVE-2025-30746.md) `CVE-2025-30746` · CVE record: Oracle Corporation Oracle iStore · CVSS 6.1 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in Oracle Corporation Oracle MES for Process Manufacturing](https://agentprime.io/advisories/CVE-2025-30745.md) `CVE-2025-30745` · CVE record: Oracle Corporation Oracle MES for Process Manufacturing · CVSS 6.1 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Restrict File Access <= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion](https://agentprime.io/advisories/CVE-2025-7667.md) `CVE-2025-7667` · CVE record: josxha Restrict File Access · CVSS 8.1 High · Not analysed yet · Published 15 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Zoom Clients - Cross-site Scripting](https://agentprime.io/advisories/CVE-2025-49462.md) `CVE-2025-49462` · CVE record: Zoom Communications Inc. Zoom Clients · CVSS 3.5 Low · Not analysed yet · Published 10 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [A security bypass vulnerability was found in DataSync Center installed on ADM](https://agentprime.io/advisories/CVE-2025-7379.md) `CVE-2025-7379` · CVE record: ASUSTOR ADM · CVSS 5.2 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [CSRF Vulnerability in Firmware Update Endpoints Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2025-53540.md) `CVE-2025-53540` · CVE record: espressif arduino-esp32 · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20322.md) `CVE-2025-20322` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20321.md) `CVE-2025-20321` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [CodeAstro Online Movie Ticket Booking System cross-site request forgery](https://agentprime.io/advisories/CVE-2025-7133.md) `CVE-2025-7133` · CVE record: CodeAstro Online Movie Ticket Booking System · CVSS 5.3 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [07FLYCMS/07FLY-CMS/07FlyCRM cross-site request forgery](https://agentprime.io/advisories/CVE-2025-7078.md) `CVE-2025-7078` · CVE record: 07FLYCMS and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [SecurePoll: Multiple admin actions vulnerable to Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-53483.md) `CVE-2025-53483` · CVE record: Wikimedia Foundation Mediawiki - SecurePoll extension · CVSS 8.8 High · Not analysed yet · Published 4 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Contact Form 7 reCAPTCHA plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-23972.md) `CVE-2025-23972` · CVE record: Brian S. Reed Contact Form 7 reCAPTCHA · CVSS 4.3 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53569.md) `CVE-2025-53569` · CVE record: Trust Payments Trust Payments Gateway for WooCommerce (JavaScript Library) · CVSS 4.3 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Radio Station plugin <= 2.5.12 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53568.md) `CVE-2025-53568` · CVE record: Tony Zeoli Radio Station · CVSS 4.3 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [WP Firebase Push Notification <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification](https://agentprime.io/advisories/CVE-2025-5924.md) `CVE-2025-5924` · CVE record: skywaveinfo WP Firebase Push Notification · CVSS 4.3 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [yContributors <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-6041.md) `CVE-2025-6041` · CVE record: yonisink yContributors · CVSS 6.1 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [RD Contacto <= 1.4 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-5933.md) `CVE-2025-5933` · CVE record: richarddev7 RD Contacto · CVSS 4.3 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [CVE-2025-27454](https://agentprime.io/advisories/CVE-2025-27454.md) `CVE-2025-27454` · CVE record: Endress+Hauser Endress+Hauser MEAC300-FNADE4 · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Laundry 2.3.0 - Account Takeover via CSRF](https://agentprime.io/advisories/CVE-2025-52841.md) `CVE-2025-52841` · CVE record: Laundry Laundry · CVSS 8.5 High · Not analysed yet · Published 2 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in QUALITIA CO., LTD. Active! mail 6](https://agentprime.io/advisories/CVE-2025-52463.md) `CVE-2025-52463` · CVE record: QUALITIA CO., LTD. Active! mail 6 · CVSS 2.1 Low · Not analysed yet · Published 2 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate](https://agentprime.io/advisories/CVE-2025-6459.md) `CVE-2025-6459` · CVE record: scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager · CVSS 8.8 High · Not analysed yet · Published 2 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-34050.md) `CVE-2025-34050` · CVE record: AVTECH IP cameras and 2 more · CVSS 5.1 Medium · Not analysed yet · Published 1 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Sunshine application-wide CSRF in the UI leads to command injection as Administrator](https://agentprime.io/advisories/CVE-2025-53095.md) `CVE-2025-53095` · CVE record: LizardByte Sunshine · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in Ubiquiti Inc UCRM Client Signup Plugin](https://agentprime.io/advisories/CVE-2025-24289.md) `CVE-2025-24289` · CVE record: Ubiquiti Inc UCRM Client Signup Plugin · CVSS 7.5 High · Not analysed yet · Published 29 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [DaiCuo index cross-site request forgery](https://agentprime.io/advisories/CVE-2025-6865.md) `CVE-2025-6865` · CVE record: DaiCuo · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [SeaCMS admin_type.php cross-site request forgery](https://agentprime.io/advisories/CVE-2025-6864.md) `CVE-2025-6864` · CVE record: SeaCMS · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset](https://agentprime.io/advisories/CVE-2025-5937.md) `CVE-2025-5937` · CVE record: videowhisper MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet · CVSS 4.3 Medium · Not analysed yet · Published 28 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress re.place plugin <= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53338.md) `CVE-2025-53338` · CVE record: dor re.place · CVSS 7.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Track Everything plugin <= 2.0.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53332.md) `CVE-2025-53332` · CVE record: ethoseo Track Everything · CVSS 7.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress RSS Digest plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53331.md) `CVE-2025-53331` · CVE record: samcharrington RSS Digest · CVSS 7.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Społecznościowa 6 PL 2013 plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53329.md) `CVE-2025-53329` · CVE record: szajenw Społecznościowa 6 PL 2013 · CVSS 7.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Aioseo Multibyte Descriptions plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53327.md) `CVE-2025-53327` · CVE record: rui_mashita Aioseo Multibyte Descriptions · CVSS 4.3 Medium · Not analysed yet · Published 27 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WPShapere Lite plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53317.md) `CVE-2025-53317` · CVE record: AcmeeDesign WPShapere - WordPress admin theme · CVSS 7.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Relocate Upload plugin <= 0.24.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53315.md) `CVE-2025-53315` · CVE record: alanft Relocate Upload · CVSS 7.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Optimizer plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-53314.md) `CVE-2025-53314` · CVE record: sh1zen WP Optimizer · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Twitch TV Embed Suite plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53313.md) `CVE-2025-53313` · CVE record: plumwd Twitch TV Embed Suite · CVSS 7.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress OnionBuzz plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53312.md) `CVE-2025-53312` · CVE record: Looks Awesome OnionBuzz · CVSS 7.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: Cross-site request forgery (CSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .