# Cross-site request forgery (CSRF). A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Rencontre plugin <= 3.13.7 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67534.md) `CVE-2025-67534` · CVE record: Jacques Malgrange Rencontre · CVSS 7.1 High · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress CWW Companion plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67473.md) `CVE-2025-67473` · CVE record: codeworkweb CWW Companion · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67472.md) `CVE-2025-67472` · CVE record: vcita Online Booking & Scheduling Calendar for WordPress by vcita · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Quick Contact Form plugin <= 8.2.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67471.md) `CVE-2025-67471` · CVE record: Saad Iqbal Quick Contact Form · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress PDF Thumbnail Generator plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67469.md) `CVE-2025-67469` · CVE record: kubiq PDF Thumbnail Generator · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Simple Link Directory plugin <= 8.8.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67465.md) `CVE-2025-67465` · CVE record: QuantumCloud Simple Link Directory · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Salon booking system plugin <= 10.30.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-66531.md) `CVE-2025-66531` · CVE record: Dimitri Grassi Salon booking system · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Chartify plugin <= 3.6.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-66529.md) `CVE-2025-66529` · CVE record: Ays Pro Chartify · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Simple Folio plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-64256.md) `CVE-2025-64256` · CVE record: PressTigers Simple Folio · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [CSRF in Panilux](https://agentprime.io/advisories/CVE-2025-11022.md) `CVE-2025-11022` · CVE record: Personal Project Panilux · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Cross Site Request Forgery (CSRF) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to cause a denial of service via function handle_interface_POST_and_status.](https://agentprime.io/advisories/CVE-2025-65573.md) `CVE-2025-65573` · CVE record · CVSS 8.8 High · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap has missing CSRF protections its in tracker field dependencies](https://agentprime.io/advisories/CVE-2025-65962.md) `CVE-2025-65962` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap has missing CSRF protections in its tracker trigger management system](https://agentprime.io/advisories/CVE-2025-64760.md) `CVE-2025-64760` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap is missing CSRF protections for its planning management API](https://agentprime.io/advisories/CVE-2025-64499.md) `CVE-2025-64499` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-64498.md) `CVE-2025-64498` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [CSRF vulnerability in CIRCL Vulnerability-Lookup](https://agentprime.io/advisories/CVE-2025-42616.md) `CVE-2025-42616` · CVE record: CIRCL Vulnerability-Lookup · CVSS 7.0 High · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality.](https://agentprime.io/advisories/CVE-2025-60912.md) `CVE-2025-60912` · CVE record · CVSS 3.3 Low · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WP Landing Page <= 0.9.3 - Cross-Site Request Forgery to Arbitrary Post Meta Update](https://agentprime.io/advisories/CVE-2025-13629.md) `CVE-2025-13629` · CVE record: xbenx WP Landing Page · CVSS 4.3 Medium · Not analysed yet · Published 6 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [fit2cloud Halo cross-site request forgery](https://agentprime.io/advisories/CVE-2025-14117.md) `CVE-2025-14117` · CVE record: fit2cloud Halo · CVSS 5.3 Medium · Not analysed yet · Published 6 Dec 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF](https://agentprime.io/advisories/CVE-2025-66629.md) `CVE-2025-66629` · CVE record: hedgedoc hedgedoc · CVSS 3.7 Low · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [User Generator and Importer <= 1.2.2 - Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation](https://agentprime.io/advisories/CVE-2025-12879.md) `CVE-2025-12879` · CVE record: vinoth06 User Generator and Importer · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion](https://agentprime.io/advisories/CVE-2025-12130.md) `CVE-2025-12130` · CVE record: wcvendors WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [ARK Related Posts <= 2.19 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-13684.md) `CVE-2025-13684` · CVE record: alexkar ARK Related Posts · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Torod – The smart shipping and delivery portal for e-shops and retailers <= 1.9 - Cross-Site Request Forgery To Plugin's Settings Modification](https://agentprime.io/advisories/CVE-2025-12373.md) `CVE-2025-12373` · CVE record: torod Torod – The smart shipping and delivery portal for e-shops and retailers · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Image Optimizer by wps.sk <= 1.2.0 - Cross-Site Request Forgery to Bulk Image Optimization](https://agentprime.io/advisories/CVE-2025-12190.md) `CVE-2025-12190` · CVE record: duddi Image Optimizer by wps.sk · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload](https://agentprime.io/advisories/CVE-2025-12189.md) `CVE-2025-12189` · CVE record: breadbutter Bread & Butter: AI-Powered Lead Intelligence · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Hide Categories Or Products On Shop Page <= 1.0.7 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-12128.md) `CVE-2025-12128` · CVE record: kaushikankrani Hide Categories Or Products On Shop Page · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Time Sheets <= 2.1.3 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-10055.md) `CVE-2025-10055` · CVE record: mrdenny Time Sheets · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Quantic Social Image Hover <= 1.0.8 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-13360.md) `CVE-2025-13360` · CVE record: monkeyboz Quantic Social Image Hover · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [dream gallery <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action](https://agentprime.io/advisories/CVE-2025-13621.md) `CVE-2025-13621` · CVE record: teamdream dream gallery · CVSS 6.1 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [ContentStudio <= 1.3.7 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-13144.md) `CVE-2025-13144` · CVE record: contentstudio ContentStudio · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-13362.md) `CVE-2025-13362` · CVE record: jevgenisultanov Norby AI · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Backup, Restore and Migrate your sites with XCloner <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save()](https://agentprime.io/advisories/CVE-2025-11759.md) `CVE-2025-11759` · CVE record: watchful Backup, Restore and Migrate your sites with XCloner · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in Synology DiskStation Manager (DSM) and others](https://agentprime.io/advisories/CVE-2024-45538.md) `CVE-2024-45538` · CVE record: Synology DiskStation Manager (DSM) and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover](https://agentprime.io/advisories/CVE-2025-65027.md) `CVE-2025-65027` · CVE record: rommapp romm · CVSS 7.6 High · Not analysed yet · Published 3 Dec 2025 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF), Unrestricted file upload - [ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation](https://agentprime.io/advisories/CVE-2025-12358.md) `CVE-2025-12358` · CVE record: roxnor ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution · CVSS 4.3 Medium · Not analysed yet · Published 3 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [The feature to manage resources is prone to Cross-Site Request Forgery attacks](https://agentprime.io/advisories/CVE-2025-13871.md) `CVE-2025-13871` · CVE record: ObjectPlanet Opinio · CVSS 2.3 Low · Not analysed yet · Published 2 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletion](https://agentprime.io/advisories/CVE-2025-13140.md) `CVE-2025-13140` · CVE record: devsoftbaltic SurveyJS: Drag & Drop Form Builder · CVSS 4.3 Medium · Not analysed yet · Published 2 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Photo Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actions](https://agentprime.io/advisories/CVE-2025-13685.md) `CVE-2025-13685` · CVE record: ays-pro Photo Gallery by Ays – Responsive Image Gallery · CVSS 4.3 Medium · Not analysed yet · Published 2 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2025-13606.md) `CVE-2025-13606` · CVE record: smackcoders Export All Posts, Products, Orders, Refunds & Users · CVSS 6.5 Medium · Not analysed yet · Published 2 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in Socomec DIRIS Digiware M-70](https://agentprime.io/advisories/CVE-2024-53684.md) `CVE-2024-53684` · CVE record: Socomec DIRIS Digiware M-70 · CVSS 7.5 High · Not analysed yet · Published 1 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [CSRF in Tekrom Technology's T-Soft E-Commerce](https://agentprime.io/advisories/CVE-2025-13296.md) `CVE-2025-13296` · CVE record: Tekrom Technology Inc. T-Soft E-Commerce · CVSS 5.4 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.](https://agentprime.io/advisories/CVE-2025-65840.md) `CVE-2025-65840` · CVE record · CVSS 8.8 High · Not analysed yet · Published 1 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Scada-LTS cross-site request forgery](https://agentprime.io/advisories/CVE-2025-13790.md) `CVE-2025-13790` · CVE record: Scada-LTS · CVSS 5.3 Medium · Not analysed yet · Published 30 Nov 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-53897.md) `CVE-2025-53897` · CVE record: kiteworks security-advisories · CVSS 6.8 Medium · Not analysed yet · Published 29 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login](https://agentprime.io/advisories/CVE-2025-13737.md) `CVE-2025-13737` · CVE record: nextendweb Nextend Social Login and Register · CVSS 4.3 Medium · Not analysed yet · Published 28 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd.](https://agentprime.io/advisories/CVE-2025-51733.md) `CVE-2025-51733` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 28 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.12.0 - Cross-Site Request Forgery to Account Disconnection](https://agentprime.io/advisories/CVE-2025-13143.md) `CVE-2025-13143` · CVE record: assafp Quiz, Poll & Survey Maker by Opinion Stage · CVSS 4.3 Medium · Not analysed yet · Published 27 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Reuters Direct <= 3.0.0 - Cross-Site Request Forgery to Settings Reset](https://agentprime.io/advisories/CVE-2025-12578.md) `CVE-2025-12578` · CVE record: rnags Reuters Direct · CVSS 4.3 Medium · Not analysed yet · Published 27 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack](https://agentprime.io/advisories/GHSA-q279-jhrf-cc6v.md) `GHSA-q279-jhrf-cc6v`, `CVE-2025-62593`, `PYSEC-2026-520` · PyPI `ray`: affected `<2.52.0`, fixed in `2.52.0` · CVSS 9.4 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.60 · Not analysed yet · Published 26 Nov 2025 · Tags: Code injection, Cross-site request forgery (CSRF) - [Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution](https://agentprime.io/advisories/CVE-2025-12061.md) `CVE-2025-12061` · CVE record: Unknown TAX SERVICE Electronic HDM · CVSS 8.6 High · Not analysed yet · Published 26 Nov 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [Peer Publish <= 1.0 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-12587.md) `CVE-2025-12587` · CVE record: webgarh Peer Publish · CVSS 4.3 Medium · Not analysed yet · Published 25 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-12586.md) `CVE-2025-12586` · CVE record: evolurise Conditionnal Maintenance Mode for WordPress · CVSS 4.3 Medium · Not analysed yet · Published 25 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-site request forgery in Sony Corporation SNC-CX600W](https://agentprime.io/advisories/CVE-2025-62497.md) `CVE-2025-62497` · CVE record: Sony Corporation SNC-CX600W · CVSS 2.1 Low · Not analysed yet · Published 25 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code…](https://agentprime.io/advisories/CVE-2025-60739.md) `CVE-2025-60739` · CVE record · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Nov 2025 · Tags: Cross-site scripting (XSS), Information disclosure, Cross-site request forgery (CSRF) - [A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.](https://agentprime.io/advisories/CVE-2025-63953.md) `CVE-2025-63953` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 24 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.](https://agentprime.io/advisories/CVE-2025-63952.md) `CVE-2025-63952` · CVE record · CVSS 5.7 Medium · Not analysed yet · Published 24 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third…](https://agentprime.io/advisories/CVE-2025-56400.md) `CVE-2025-56400` · CVE record · CVSS 8.8 High · Not analysed yet · Published 24 Nov 2025 · Tags: Cross-site request forgery (CSRF), Authentication bypass - [Langfuse SSO Account Takeover via CSRF or phishing attack](https://agentprime.io/advisories/CVE-2025-65107.md) `CVE-2025-65107` · CVE record: langfuse langfuse · CVSS 6.5 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: Broken access control, Cross-site request forgery (CSRF) - [Zegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload](https://agentprime.io/advisories/CVE-2025-11087.md) `CVE-2025-11087` · CVE record: zozothemes Zegen Core · CVSS 8.8 High · Not analysed yet · Published 21 Nov 2025 · Tags: Cross-site request forgery (CSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .