# Cross-site request forgery (CSRF). A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-58999.md) `CVE-2025-58999` · CVE record: loopus WP Attractive Donations System - Easy Stripe & Paypal donations · CVSS 4.3 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.](https://agentprime.io/advisories/CVE-2025-65593.md) `CVE-2025-65593` · CVE record · CVSS 8.8 High · Not analysed yet · Published 16 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update](https://agentprime.io/advisories/CVE-2025-14394.md) `CVE-2025-14394` · CVE record: melodicmedia Popover Windows · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update](https://agentprime.io/advisories/CVE-2025-14462.md) `CVE-2025-14462` · CVE record: owais4377 Lucky Draw Contests · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion](https://agentprime.io/advisories/CVE-2025-14454.md) `CVE-2025-14454` · CVE record: ays-pro Image Slider by Ays- Responsive Slider and Carousel · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [OpenPLC_V3 Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-13970.md) `CVE-2025-13970` · CVE record: OpenPLC_V3 OpenPLC_V3 · CVSS 7.0 High · Not analysed yet · Published 13 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion](https://agentprime.io/advisories/CVE-2025-12407.md) `CVE-2025-12407` · CVE record: netweblogic Events Manager – Calendar, Bookings, Tickets, and more! · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Secure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data Export](https://agentprime.io/advisories/CVE-2025-14159.md) `CVE-2025-14159` · CVE record: ays-pro Secure Copy Content Protection and Content Locking · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation](https://agentprime.io/advisories/CVE-2025-10684.md) `CVE-2025-10684` · CVE record: Unknown Construction Light · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Authentication bypass, Cross-site request forgery (CSRF) - [Cross-site request forgery in Japan Total System Co.,Ltd. GroupSession Free edition and others](https://agentprime.io/advisories/CVE-2025-58576.md) `CVE-2025-58576` · CVE record: Japan Total System Co.,Ltd. GroupSession Free edition and 2 more · CVSS 5.1 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Simple Theme Changer <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update](https://agentprime.io/advisories/CVE-2025-14391.md) `CVE-2025-14391` · CVE record: darendev Simple Theme Changer · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Rabbit Hole <= 1.1 - Cross-Site Request Forgery to Settings Reset](https://agentprime.io/advisories/CVE-2025-13366.md) `CVE-2025-13366` · CVE record: frapesce Rabbit Hole · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Upcoming for Calendly <= 1.2.4 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-14160.md) `CVE-2025-14160` · CVE record: justdave Upcoming for Calendly · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion](https://agentprime.io/advisories/CVE-2025-13987.md) `CVE-2025-13987` · CVE record: codnloc Purchase and Expense Manager · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Animated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter](https://agentprime.io/advisories/CVE-2025-14062.md) `CVE-2025-14062` · CVE record: tekafran Animated Pixel Marquee Creator · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update](https://agentprime.io/advisories/CVE-2025-14161.md) `CVE-2025-14161` · CVE record: truefy Truefy Embed · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Resource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions](https://agentprime.io/advisories/CVE-2025-14354.md) `CVE-2025-14354` · CVE record: doubledome Resource Library for Logged In Users · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-14165.md) `CVE-2025-14165` · CVE record: developerke Kirim.Email WooCommerce Integration · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [IMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update](https://agentprime.io/advisories/CVE-2025-13363.md) `CVE-2025-13363` · CVE record: imaqpress IMAQ CORE · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Coding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-14158.md) `CVE-2025-14158` · CVE record: octagonsimon Coding Blocks · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection](https://agentprime.io/advisories/CVE-2025-13408.md) `CVE-2025-13408` · CVE record: foxtheme Foxtool All-in-One: Contact chat button, Custom login, Media optimize images · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [BMLT WordPress Plugin <= 3.11.4 - Cross-Site Request Forgery to Settings Creation and Deletion](https://agentprime.io/advisories/CVE-2025-14162.md) `CVE-2025-14162` · CVE record: magblogapi BMLT WordPress Satellite · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malic…](https://agentprime.io/advisories/CVE-2025-65472.md) `CVE-2025-65472` · CVE record · CVSS 8.8 High · Not analysed yet · Published 11 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [TableProgressTracking's missing CSRF protection allows unauthorized state changes](https://agentprime.io/advisories/CVE-2025-67646.md) `CVE-2025-67646` · CVE record: Telepedia TableProgressTracking · CVSS 3.5 Low · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality](https://agentprime.io/advisories/GHSA-wrvc-x3wf-j5f5.md) `GHSA-wrvc-x3wf-j5f5`, `CVE-2025-34429`, `GO-2025-4231` · Go `github.com/1Panel-dev/1Panel`: affected `>=1.10.33, <=2.0.15`, no fixed version yet · CVSS 7.0 High · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name management functionality](https://agentprime.io/advisories/GHSA-5xpq-2vmc-5cqp.md) `GHSA-5xpq-2vmc-5cqp`, `CVE-2025-34430`, `GO-2025-4230` · Go `github.com/1Panel-dev/1Panel`: affected `>=1.10.33, <=2.0.15`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management](https://agentprime.io/advisories/CVE-2020-36901.md) `CVE-2020-36901` · CVE record: UBICOD Co., Ltd. | MEDIVISION INC. UBICOD Medivision Digital Signage · CVSS 8.6 High · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [All-Dynamics Digital Signage System 2.0.2 Cross-Site Request Forgery via User Management](https://agentprime.io/advisories/CVE-2020-36900.md) `CVE-2020-36900` · CVE record: All-Dynamics Software GmbH Digital Signage System · CVSS 8.6 High · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [SpinetiX Fusion Digital Signage 3.4.8 Cross-Site Request Forgery via User Creation](https://agentprime.io/advisories/CVE-2020-36886.md) `CVE-2020-36886` · CVE record: SpenetiX AG Fusion Digital Signage · CVSS 6.9 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Jenkins has a CSRF vulnerability on the login form](https://agentprime.io/advisories/GHSA-6837-qgrc-x5p6.md) `GHSA-6837-qgrc-x5p6`, `BIT-jenkins-2025-67639`, `CVE-2025-67639` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.529, <2.541 || <2.528.3`, fixed in `2.541`, `2.528.3` · CVSS 3.5 Low · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username functionality](https://agentprime.io/advisories/GHSA-rpr2-4hqj-hc4q.md) `GHSA-rpr2-4hqj-hc4q`, `CVE-2025-34410`, `GO-2025-4229` · Go `github.com/1Panel-dev/1Panel`: affected `>=1.10.33, <=2.0.15`, no fixed version yet · CVSS 7.0 High · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Selea Targa IP Camera Cross-Site Request Forgery via Admin Creation](https://agentprime.io/advisories/CVE-2021-47730.md) `CVE-2021-47730` · CVE record: Selea s.r.l. Selea Targa IP OCR-ANPR Camera · CVSS 8.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [STVS ProVision Cross-Site Request Forgery (Add Admin)](https://agentprime.io/advisories/CVE-2021-47723.md) `CVE-2021-47723` · CVE record: STVS SA STVS ProVision · CVSS 6.9 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [OpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.php](https://agentprime.io/advisories/CVE-2021-47702.md) `CVE-2021-47702` · CVE record: OPEN BMCS OpenBMCS · CVSS 5.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication](https://agentprime.io/advisories/CVE-2025-13924.md) `CVE-2025-13924` · CVE record: maartenbelmans Advanced Product Fields (Product Addons) for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Fast Cache plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2023-22675.md) `CVE-2023-22675` · CVE record: Taylor Hawkes WP Fast Cache · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67467.md) `CVE-2025-67467` · CVE record: StellarWP GiveWP · CVSS 5.4 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress KALLYAS theme < 4.25.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-63060.md) `CVE-2025-63060` · CVE record: hogash KALLYAS · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress New User Approve plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-63030.md) `CVE-2025-63030` · CVE record: Saad Iqbal New User Approve · CVSS 7.1 High · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-63012.md) `CVE-2025-63012` · CVE record: ThimPress WP Hotel Booking · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Flashy Marketing Automation plugin <= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62873.md) `CVE-2025-62873` · CVE record: Flashyapp WP Flashy Marketing Automation · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Social Photo Fetcher plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62872.md) `CVE-2025-62872` · CVE record: JK Social Photo Fetcher · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Just TinyMCE Custom Styles plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62871.md) `CVE-2025-62871` · CVE record: Alex Prokopenko / JustCoded Just TinyMCE Custom Styles · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Auto Alt Text plugin <= 2.5.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62866.md) `CVE-2025-62866` · CVE record: Valerio Monti Auto Alt Text · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress SMTP Mail plugin <= 1.3.51 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62762.md) `CVE-2025-62762` · CVE record: photoboxone SMTP Mail · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Add Custom Codes plugin <= 4.80 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62739.md) `CVE-2025-62739` · CVE record: SaifuMak Add Custom Codes · CVSS 6.5 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Media Library Downloader plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62734.md) `CVE-2025-62734` · CVE record: M.Code Media Library Downloader · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Custom Sidebars by ProteusThemes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62733.md) `CVE-2025-62733` · CVE record: ProteusThemes Custom Sidebars by ProteusThemes · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Media Library File Download plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62103.md) `CVE-2025-62103` · CVE record: wpmediadownload Media Library File Download · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62102.md) `CVE-2025-62102` · CVE record: apasionados DoFollow Case by Case · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Duplicate Content Cure plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-59132.md) `CVE-2025-59132` · CVE record: Badi Jones Duplicate Content Cure · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Create Posts & Terms plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49351.md) `CVE-2025-49351` · CVE record: Valentin Agachi Create Posts & Terms · CVSS 7.1 High · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP sIFR plugin <= 0.6.8.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49347.md) `CVE-2025-49347` · CVE record: Jupitercow WP sIFR · CVSS 7.1 High · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress PDF Creator Lite plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49341.md) `CVE-2025-49341` · CVE record: Alex Furr PDF Creator Lite · CVSS 7.1 High · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67598.md) `CVE-2025-67598` · CVE record: PSM Plugins SupportCandy · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Business Directory plugin <= 6.4.19 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67596.md) `CVE-2025-67596` · CVE record: Strategy11 Team Business Directory · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Quiz Maker plugin <= 6.7.0.82 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67595.md) `CVE-2025-67595` · CVE record: Ays Pro Quiz Maker · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress UsersWP plugin <= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67593.md) `CVE-2025-67593` · CVE record: Stiofan UsersWP · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress JNews Paywall plugin < 12.0.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67591.md) `CVE-2025-67591` · CVE record: jegtheme JNews Paywall · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Ultimate FAQ plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67590.md) `CVE-2025-67590` · CVE record: Rustaurius Ultimate FAQ · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site request forgery (CSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .