# Cross-site request forgery (CSRF). A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Parallax Scrolling Enllax.js Plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58831.md) `CVE-2025-58831` · CVE record: snagysandor Parallax Scrolling Enllax.js · CVSS 4.3 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Developer Tools Blocker Plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58818.md) `CVE-2025-58818` · CVE record: SwiftNinjaPro Developer Tools Blocker · CVSS 5.4 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress To Lead For Salesforce Plugin <= 2.7.3.9 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58809.md) `CVE-2025-58809` · CVE record: Nick Ciske To Lead For Salesforce · CVSS 7.1 High · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Purge Varnish Cache Plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58807.md) `CVE-2025-58807` · CVE record: Dsingh Purge Varnish Cache · CVSS 7.1 High · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WordPress Error Monitoring by Bugsnag Plugin <= 1.6.3 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58806.md) `CVE-2025-58806` · CVE record: Tom Longridge WordPress Error Monitoring by Bugsnag · CVSS 7.1 High · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WooCommerce Single Page Checkout Plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58804.md) `CVE-2025-58804` · CVE record: brijrajs WooCommerce Single Page Checkout · CVSS 4.3 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress TrustMate.io – WooCommerce integration plugin <= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-58802.md) `CVE-2025-58802` · CVE record: michalzagdan TrustMate.io – WooCommerce integration · CVSS 4.3 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Responder Plugin <= 4.3.8 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58801.md) `CVE-2025-58801` · CVE record: KCS Responder · CVSS 5.4 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Email Template plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-58800.md) `CVE-2025-58800` · CVE record: Steve Truman WP Email Template · CVSS 4.3 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58799.md) `CVE-2025-58799` · CVE record: themelocation Custom WooCommerce Checkout Fields Editor · CVSS 4.3 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress BCM Duplicate Menu plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-58798.md) `CVE-2025-58798` · CVE record: Bjorn Manintveld BCM Duplicate Menu · CVSS 4.3 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-58794.md) `CVE-2025-58794` · CVE record: rainafarai Notification for Telegram · CVSS 4.3 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Authors List plugin <= 2.0.6.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-58792.md) `CVE-2025-58792` · CVE record: WPKube Authors List · CVSS 4.3 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [PopAd <= 1.0.4 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-9616.md) `CVE-2025-9616` · CVE record: alobaidi PopAd · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability](https://agentprime.io/advisories/CVE-2025-20326.md) `CVE-2025-20326` · CVE record: Cisco Cisco Unified Communications Manager · CVSS 4.3 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Tickera Plugin <= 3.5.5.6 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58611.md) `CVE-2025-58611` · CVE record: Tickera Tickera · CVSS 4.3 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in NTT EAST, Inc. Web Caster V130 and others](https://agentprime.io/advisories/CVE-2025-58272.md) `CVE-2025-58272` · CVE record: NTT EAST, Inc. Web Caster V130 and 1 more · CVSS 2.0 Low · Not analysed yet · Published 3 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [CSRF in Akinsoft's QR Menu](https://agentprime.io/advisories/CVE-2025-0610.md) `CVE-2025-0610` · CVE record: Akınsoft QR Menü · CVSS 8.6 High · Not analysed yet · Published 1 Sept 2025 · Tags: Cross-site request forgery (CSRF) - [Koillection csrf_protection_controller.js cross-site request forgery](https://agentprime.io/advisories/CVE-2025-9747.md) `CVE-2025-9747` · CVE record: Koillection · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [Related Posts Lite <= 1.12 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-9618.md) `CVE-2025-9618` · CVE record: wpdreams Related Posts Lite · CVSS 4.3 Medium · Not analysed yet · Published 30 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks](https://agentprime.io/advisories/GHSA-82ff-hg59-8x73.md) `GHSA-82ff-hg59-8x73`, `CVE-2025-47909`, `GO-2025-3884` · Go `github.com/gorilla/csrf`: affected `<=1.7.3`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site request forgery (CSRF), CWE-346, CWE-807 - [Ultimate Tag Warrior Importer <= 0.2 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-9374.md) `CVE-2025-9374` · CVE record: briancolinger Ultimate Tag Warrior Importer · CVSS 4.3 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-48363.md) `CVE-2025-48363` · CVE record: Metin Saraç Popup for CF7 with Sweet Alert · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Hesabfa Accounting plugin <= 2.2.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-48362.md) `CVE-2025-48362` · CVE record: Saeed Sattar Beglou Hesabfa Accounting · CVSS 5.4 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress ATT YouTube Widget plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48359.md) `CVE-2025-48359` · CVE record: thaihavnn07 ATT YouTube Widget · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Century ToolKit plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Activation vulnerability](https://agentprime.io/advisories/CVE-2025-48357.md) `CVE-2025-48357` · CVE record: Theme Century Century ToolKit · CVSS 5.4 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Clickbank WordPress Plugin (Niche Storefront) plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48353.md) `CVE-2025-48353` · CVE record: dactum Clickbank WordPress Plugin (Niche Storefront) · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Kento Splash Screen plugin <= 1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48351.md) `CVE-2025-48351` · CVE record: PluginsPoint Kento Splash Screen · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WPMU Ldap Authentication plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48343.md) `CVE-2025-48343` · CVE record: Aaron Axelsen WPMU Ldap Authentication · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Admin Theme plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48325.md) `CVE-2025-48325` · CVE record: shmish111 WP Admin Theme · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Ultimate twitter profile widget plugin <= 1.0 - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48321.md) `CVE-2025-48321` · CVE record: dyiosah Ultimate twitter profile widget · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress 百度分享按钮 plugin <= 1.0.6 - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48320.md) `CVE-2025-48320` · CVE record: cuckoohello 百度分享按钮 · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress 多说社会化评论框 plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability](https://agentprime.io/advisories/CVE-2025-48318.md) `CVE-2025-48318` · CVE record: shen2 多说社会化评论框 · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Invisible Optin plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48311.md) `CVE-2025-48311` · CVE record: OffClicks Invisible Optin · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Table Editor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-48310.md) `CVE-2025-48310` · CVE record: wptableeditor Table Editor · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress BetPress plugin <= 1.0.1 Lite - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48309.md) `CVE-2025-48309` · CVE record: web-able BetPress · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Newsletter subscription optin module plugin <= 1.2.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48308.md) `CVE-2025-48308` · CVE record: nonletter Newsletter subscription optin module · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress SEO For Images plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48307.md) `CVE-2025-48307` · CVE record: kasonzhao SEO For Images · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Savyour Affiliate Partner plugin <= 2.1.4 - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48306.md) `CVE-2025-48306` · CVE record: developers savyour Savyour Affiliate Partner · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Google XML News Sitemap plugin plugin <= 0.02 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48304.md) `CVE-2025-48304` · CVE record: Gary Illyes Google XML News Sitemap plugin · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress XM-Backup plugin <= 0.9.1 - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48109.md) `CVE-2025-48109` · CVE record: Xavier Media XM-Backup · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in QuickCMS](https://agentprime.io/advisories/CVE-2025-54541.md) `CVE-2025-54541` · CVE record: OpenSolution QuickCMS · CVSS 6.9 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [Video Share VOD – Turnkey Video Site Builder Script <= 2.7.6 - Cross-Site Request Forgery to Command Injection](https://agentprime.io/advisories/CVE-2025-7812.md) `CVE-2025-7812` · CVE record: videowhisper Video Share VOD – Turnkey Video Site Builder Script · CVSS 8.8 High · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Instant Breaking News Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58217.md) `CVE-2025-58217` · CVE record: GeroNikolov Instant Breaking News · CVSS 7.1 High · Not analysed yet · Published 27 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Simple Page Access Restriction Plugin <= 1.0.32 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58202.md) `CVE-2025-58202` · CVE record: Plugins and Snippets Simple Page Access Restriction · CVSS 4.3 Medium · Not analysed yet · Published 27 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Backup Bolt plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49040.md) `CVE-2025-49040` · CVE record: Backup Bolt Backup Bolt · CVSS 4.3 Medium · Not analysed yet · Published 27 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via the /notifications/delete/ URI.](https://agentprime.io/advisories/CVE-2025-54598.md) `CVE-2025-54598` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 27 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Post Type Converter plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-48303.md) `CVE-2025-48303` · CVE record: Kevin Langley Jr. Post Type Converter · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [Sertifier Certificate & Badge Maker for WordPress – Tutor LMS <= 1.19 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-7841.md) `CVE-2025-7841` · CVE record: sertifier Sertifier Certificate & Badge Maker for WordPress – Tutor LMS · CVSS 4.3 Medium · Not analysed yet · Published 23 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [Restore Permanently delete Post or Page Data <= 1.0 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-7839.md) `CVE-2025-7839` · CVE record: pokornydavid Restore Permanently delete Post or Page Data · CVSS 4.3 Medium · Not analysed yet · Published 23 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [Silencesoft RSS Reader <= 0.6 - Cross-Site Request Forgery to RSS Feed Deletion](https://agentprime.io/advisories/CVE-2025-7842.md) `CVE-2025-7842` · CVE record: silence Silencesoft RSS Reader · CVSS 4.3 Medium · Not analysed yet · Published 23 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress JobWP Plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-57895.md) `CVE-2025-57895` · CVE record: Hossni Mubarak JobWP · CVSS 4.3 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Fast Total Search Plugin <= 1.79.270 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-57893.md) `CVE-2025-57893` · CVE record: Epsiloncool WP Fast Total Search · CVSS 4.3 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Simple Statistics for Feeds Plugin <= 20250322 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-57892.md) `CVE-2025-57892` · CVE record: Jeff Starr Simple Statistics for Feeds · CVSS 4.3 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Fluent Support Plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-57885.md) `CVE-2025-57885` · CVE record: Shahjahan Jewel Fluent Support · CVSS 4.3 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [UnoPim vulnerable to CSRF on Product edit feature and creation of other types](https://agentprime.io/advisories/GHSA-287x-6r2h-f9mw.md) `GHSA-287x-6r2h-f9mw`, `CVE-2025-55744`, `PKSA-dfwt-ydb1-tqns` · Packagist `unopim/unopim`: affected `<0.2.1`, fixed in `0.2.1` · CVSS 6.9 Medium · Not analysed yet · Published 21 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [Inspiro <= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation](https://agentprime.io/advisories/CVE-2025-8592.md) `CVE-2025-8592` · CVE record: wpzoom Inspiro · CVSS 8.1 High · Not analysed yet · Published 21 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [Liferay Portal Vulnerable to Cross-Site Request Forgery](https://agentprime.io/advisories/GHSA-p9gc-59hf-x48p.md) `GHSA-p9gc-59hf-x48p`, `CVE-2025-43748` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.0.0-a1, <7.4.3.120-ga120`, fixed in `7.4.3.120-ga120` · CVSS 7.1 High · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in QuickCMS](https://agentprime.io/advisories/CVE-2025-54174.md) `CVE-2025-54174` · CVE record: OpenSolution Quick.CMS · CVSS 5.1 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site request forgery (CSRF) - [Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions](https://agentprime.io/advisories/CVE-2025-8102.md) `CVE-2025-8102` · CVE record: smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy · CVSS 5.4 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site request forgery (CSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .