# Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress I Order Terms plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-66097.md)
  `CVE-2025-66097` · CVE record: Igor Jerosimić I Order Terms · CVSS 4.3 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-66064.md)
  `CVE-2025-66064` · CVE record: Syed Balkhi Giveaways and Contests by RafflePress · CVSS 4.3 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-66061.md)
  `CVE-2025-66061` · CVE record: Craig Hewitt Seriously Simple Podcasting · CVSS 4.3 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [AuthorSure <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-13134.md)
  `CVE-2025-13134` · CVE record: powerblogservice AuthorSure · CVSS 6.1 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Custom Post Type <= 1.0 - Cross-Site Request Forgery to Custom Post Type Deletion](https://agentprime.io/advisories/CVE-2025-13142.md)
  `CVE-2025-13142` · CVE record: farvehandleren Custom Post Type · CVSS 4.3 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in LogStare Inc. LogStare Collector (for Windows) and others](https://agentprime.io/advisories/CVE-2025-62687.md)
  `CVE-2025-62687` · CVE record: LogStare Inc. LogStare Collector (for Windows) and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [HCL Glovius Cloud is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62346.md)
  `CVE-2025-62346` · CVE record: HCL Software Glovius Cloud · CVSS 6.8 Medium · Not analysed yet · Published 20 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution](https://agentprime.io/advisories/CVE-2025-12535.md)
  `CVE-2025-12535` · CVE record: brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder · CVSS 5.3 Medium · Not analysed yet · Published 19 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery in Windu CMS](https://agentprime.io/advisories/CVE-2025-59114.md)
  `CVE-2025-59114` · CVE record: JCD Windu CMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery in Windu CMS](https://agentprime.io/advisories/CVE-2025-59112.md)
  `CVE-2025-59112` · CVE record: JCD Windu CMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery in Windu CMS](https://agentprime.io/advisories/CVE-2025-59110.md)
  `CVE-2025-59110` · CVE record: JCD Windu CMS · CVSS 6.8 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services](https://agentprime.io/advisories/CVE-2025-6670.md)
  `CVE-2025-6670` · CVE record: WSO2 WSO2 Open Banking AM and 4 more · CVSS 8.8 High · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Project Honey Pot Spam Trap <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12406.md)
  `CVE-2025-12406` · CVE record: awensley Project Honey Pot Spam Trap · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WP Admin Microblog <= 3.1.1 - Cross-Site Request Forgery to Message Creation](https://agentprime.io/advisories/CVE-2025-12173.md)
  `CVE-2025-12173` · CVE record: winkm89 WP Admin Microblog · CVSS 4.3 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Top Friends <= 0.3 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-12827.md)
  `CVE-2025-12827` · CVE record: denishua Top Friends · CVSS 4.3 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Like-it <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12404.md)
  `CVE-2025-12404` · CVE record: nikolayyordanov Like-it · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Coil Web Monetization <= 2.0.2 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-9625.md)
  `CVE-2025-9625` · CVE record: interledger Coil Web Monetization · CVSS 4.3 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an attacker to trick an authenticated administrator into submitt…](https://agentprime.io/advisories/CVE-2025-63955.md)
  `CVE-2025-63955` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Rumpus FTP Server](https://agentprime.io/advisories/CVE-2025-55057.md)
  `CVE-2025-55057` · CVE record: Rumpus FTP Server · CVSS 4.5 Medium · Not analysed yet · Published 17 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Chunghwa Telecom｜TenderDocTransfer - Arbitrary File Copy and Paste](https://agentprime.io/advisories/CVE-2025-13283.md)
  `CVE-2025-13283` · CVE record: Chunghwa Telecom TenderDocTransfer · CVSS 7.0 High · Not analysed yet · Published 17 Nov 2025 · Tags: Path traversal, Cross-site request forgery (CSRF)
- [Chunghwa Telecom｜TenderDocTransfer - Arbitrary File Delete](https://agentprime.io/advisories/CVE-2025-13282.md)
  `CVE-2025-13282` · CVE record: Chunghwa Telecom TenderDocTransfer · CVSS 7.0 High · Not analysed yet · Published 17 Nov 2025 · Tags: Path traversal, Cross-site request forgery (CSRF)
- [Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System cross-site request forgery](https://agentprime.io/advisories/CVE-2025-13179.md)
  `CVE-2025-13179` · CVE record: Bdtask Wholesale Inventory Control and Inventory Management System and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Bdtask/CodeCanyon SalesERP cross-site request forgery](https://agentprime.io/advisories/CVE-2025-13177.md)
  `CVE-2025-13177` · CVE record: Bdtask SalesERP and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Inadequate validation of SSO redirect credentials permits credential theft](https://agentprime.io/advisories/CVE-2025-59480.md)
  `CVE-2025-59480` · CVE record: Mattermost Mattermost · CVSS 6.1 Medium · Not analysed yet · Published 13 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Fabian Ros/SourceCodester Simple E-Banking System cross-site request forgery](https://agentprime.io/advisories/CVE-2025-13119.md)
  `CVE-2025-13119` · CVE record: Fabian Ros Simple E-Banking System and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 13 Nov 2025 · Tags: Cross-site request forgery (CSRF), Broken access control
- [WordPress WP Plugin Manager plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-64271.md)
  `CVE-2025-64271` · CVE record: HasThemes WP Plugin Manager · CVSS 4.3 Medium · Not analysed yet · Published 13 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WordPress Auto Prune Posts plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-64262.md)
  `CVE-2025-64262` · CVE record: ramon fincken Auto Prune Posts · CVSS 6.5 Medium · Not analysed yet · Published 13 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Tuleap missing CSRF protections in the File Release System](https://agentprime.io/advisories/CVE-2025-64482.md)
  `CVE-2025-64482` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags](https://agentprime.io/advisories/CVE-2025-64117.md)
  `CVE-2025-64117` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update](https://agentprime.io/advisories/CVE-2025-12901.md)
  `CVE-2025-12901` · CVE record: asgaros Asgaros Forum · CVSS 4.3 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.](https://agentprime.io/advisories/CVE-2025-60645.md)
  `CVE-2025-60645` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code.](https://agentprime.io/advisories/CVE-2025-57310.md)
  `CVE-2025-57310` · CVE record · CVSS 8.8 High · Not analysed yet · Published 12 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12590.md)
  `CVE-2025-12590` · CVE record: andreaferracani YSlider · CVSS 6.1 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-12588.md)
  `CVE-2025-12588` · CVE record: behzadrohizadeh USB Qr Code Scanner For Woocommerce · CVSS 4.3 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WP Custom Admin Login Page Logo <= 1.4.8.4 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-12132.md)
  `CVE-2025-12132` · CVE record: larsactionhero WP Custom Admin Login Page Logo · CVSS 4.3 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12589.md)
  `CVE-2025-12589` · CVE record: baronen WP-Walla · CVSS 6.1 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation](https://agentprime.io/advisories/CVE-2025-11886.md)
  `CVE-2025-11886` · CVE record: codethislab CTL Arcade Lite · CVSS 4.3 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System.](https://agentprime.io/advisories/CVE-2025-63712.md)
  `CVE-2025-63712` · CVE record · CVSS 4.5 Medium · Not analysed yet · Published 10 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion…](https://agentprime.io/advisories/CVE-2025-63711.md)
  `CVE-2025-63711` · CVE record · CVSS 7.1 High · Not analysed yet · Published 10 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [The send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF).](https://agentprime.io/advisories/CVE-2025-63710.md)
  `CVE-2025-63710` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 10 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [QuLog Center](https://agentprime.io/advisories/CVE-2025-58469.md)
  `CVE-2025-58469` · CVE record: QNAP Systems Inc. QuLog Center · CVSS 1.2 Low · Not analysed yet · Published 7 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [The change password functionality at /pet_grooming/admin/change_pass.php in SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks.](https://agentprime.io/advisories/CVE-2025-63717.md)
  `CVE-2025-63717` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 7 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing operations.](https://agentprime.io/advisories/CVE-2025-63716.md)
  `CVE-2025-63716` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 7 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WordPress Contest Gallery plugin <= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62950.md)
  `CVE-2025-62950` · CVE record: Wasiliy Strecker / ContestGallery developer Contest Gallery · CVSS 4.3 Medium · Not analysed yet · Published 6 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WordPress WP GDPR Cookie Consent plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53316.md)
  `CVE-2025-53316` · CVE record: Shahjahan Jewel WP GDPR Cookie Consent · CVSS 7.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WordPress Simple Stripe plugin <= 0.9.17 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48085.md)
  `CVE-2025-48085` · CVE record: ZIPANG Simple Stripe · CVSS 7.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WordPress wpNamedUsers plugin <= 0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48083.md)
  `CVE-2025-48083` · CVE record: andriassundskard wpNamedUsers · CVSS 7.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WordPress Slick Google Map plugin <= 0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48078.md)
  `CVE-2025-48078` · CVE record: Norbert Slick Google Map · CVSS 7.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [WordPress Block Country plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-48077.md)
  `CVE-2025-48077` · CVE record: nitinmaurya12 Block Country · CVSS 7.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Easy Email Subscription <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion](https://agentprime.io/advisories/CVE-2025-10691.md)
  `CVE-2025-10691` · CVE record: yudiz Easy Email Subscription · CVSS 4.3 Medium · Not analysed yet · Published 6 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Associados Amazon Plugin <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12403.md)
  `CVE-2025-12403` · CVE record: revokee Associados Amazon Plugin · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Visit Counter 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12452.md)
  `CVE-2025-12452` · CVE record: bestiadurmiente Visit Counter · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [LinkedIn Resume <= 2.00 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12402.md)
  `CVE-2025-12402` · CVE record: bondnono LinkedIn Resume · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [MapMap <= 1.1 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12415.md)
  `CVE-2025-12415` · CVE record: sugiartha MapMap · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Centangle Team Showcase <= 1.0.0 - Cross-Site Request Forgery To Plugin's Settings Modification And Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12456.md)
  `CVE-2025-12456` · CVE record: centangle Centangle-Team · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [LMB^Box Smileys <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12400.md)
  `CVE-2025-12400` · CVE record: lmbbox LMB^Box Smileys · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [SH Contextual Help <= 3.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12410.md)
  `CVE-2025-12410` · CVE record: samhoamt SH Contextual Help · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Social Media WPCF7 Stop Words <= 1.1.3 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-12413.md)
  `CVE-2025-12413` · CVE record: socialmedialtd WPCF7 Stop words · CVSS 5.4 Medium · Not analysed yet · Published 4 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Pagerank Tools <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12416.md)
  `CVE-2025-12416` · CVE record: mahype Pagerank tools · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2025 · Tags: Cross-site request forgery (CSRF)
- [Top Bar Notification <= 1.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-12412.md)
  `CVE-2025-12412` · CVE record: josereyev Top Bar Notification · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2025 · Tags: Cross-site request forgery (CSRF)

Newest: <https://agentprime.io/advisories/tag/csrf.md>
Older: <https://agentprime.io/advisories/tag/csrf.md?cursor=WyIyMDI1LTExLTA0VDA0OjI3OjEyLjkzMDAwMFoiLCJDVkUtMjAyNS0xMjQxMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=csrf&cursor=WyIyMDI1LTExLTIxVDIwOjI5OjA0LjYxMzAwMFoiLCJDVkUtMjAyNS0xMTA4NyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/csrf/?cursor=WyIyMDI1LTExLTIxVDIwOjI5OjA0LjYxMzAwMFoiLCJDVkUtMjAyNS0xMTA4NyJd>. Everything for agents: <https://agentprime.io/llms.txt>.