# Cross-site request forgery (CSRF). A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Sosh Share Buttons <= 1.1.0 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2025-15377.md) `CVE-2025-15377` · CVE record: abage Sosh Share Buttons · CVSS 4.3 Medium · Not analysed yet · Published 14 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [WPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update](https://agentprime.io/advisories/CVE-2025-14389.md) `CVE-2025-14389` · CVE record: obridgeacademy WPBlogSyn · CVSS 4.3 Medium · Not analysed yet · Published 14 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [DASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery to SQL Injection](https://agentprime.io/advisories/CVE-2025-14615.md) `CVE-2025-14615` · CVE record: dashboardbuilder DASHBOARD BUILDER – WordPress plugin for Charts and Graphs · CVSS 7.1 High · Not analysed yet · Published 14 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation)](https://agentprime.io/advisories/CVE-2026-0493.md) `CVE-2026-0493` · CVE record: SAP_SE SAP Fiori App (Intercompany Balance Reconciliation) · CVSS 4.3 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences](https://agentprime.io/advisories/CVE-2026-22800.md) `CVE-2026-22800` · CVE record: THM-Health PILOS · CVSS 2.4 Low · Not analysed yet · Published 12 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.](https://agentprime.io/advisories/CVE-2021-41074.md) `CVE-2021-41074` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 12 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion](https://agentprime.io/advisories/CVE-2025-14976.md) `CVE-2025-14976` · CVE record: wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · CVSS 5.4 Medium · Not analysed yet · Published 10 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [GestSup <= 3.2.60 CSRF Allows Privileged Actions](https://agentprime.io/advisories/CVE-2026-22194.md) `CVE-2026-22194` · CVE record: GestSup GestSup · CVSS 8.9 High · Not analysed yet · Published 9 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering](https://agentprime.io/advisories/CVE-2025-13749.md) `CVE-2025-13749` · CVE record: creativemotion Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer · CVSS 4.3 Medium · Not analysed yet · Published 9 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Authlib has 1-click Account Takeover vulnerability](https://agentprime.io/advisories/GHSA-fg6f-75jq-6523.md) `GHSA-fg6f-75jq-6523`, `CVE-2025-68158`, `PYSEC-2026-1201` · PyPI `authlib`: affected `>=1.0.0, <1.6.6`, fixed in `1.6.6` · CVSS 5.7 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [React Router has CSRF issue in Action/Server Action Request Processing](https://agentprime.io/advisories/GHSA-h5cw-625j-3rxh.md) `GHSA-h5cw-625j-3rxh`, `CVE-2026-22030` · npm `react-router` and 1 more: affected `>=7.0.0, <7.12.0`, fixed in `7.12.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: Cross-site request forgery (CSRF), CWE-346 - [Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76).](https://agentprime.io/advisories/CVE-2025-61547.md) `CVE-2025-61547` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2019-25259.md) `CVE-2019-25259` · CVE record: Leica Geosystems AG Leica Geosystems GR10/GR25/GR30/GR50 GNSS · CVSS 5.1 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Simcast <= 1.0.0 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-14077.md) `CVE-2025-14077` · CVE record: openchamp Simcast · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Mamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation](https://agentprime.io/advisories/CVE-2025-13990.md) `CVE-2025-13990` · CVE record: mamurjor Mamurjor Employee Info · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Sticky Action Buttons <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update](https://agentprime.io/advisories/CVE-2025-14465.md) `CVE-2025-14465` · CVE record: praveentamil Sticky Action Buttons · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [WP Status Notifier <= 1.0 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-13521.md) `CVE-2025-13521` · CVE record: fulippo WP Status Notifier · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [MTCaptcha WordPress Plugin <= 2.7.2 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2025-13520.md) `CVE-2025-13520` · CVE record: mtcaptcha MTCaptcha WordPress Plugin · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [xShare <= 1.0.1 - Cross-Site Request Forgery to 'rs_plugin_reset' Parameter](https://agentprime.io/advisories/CVE-2025-13527.md) `CVE-2025-13527` · CVE record: anwerashif xShare · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Latest Tabs <= 1.5 - Cross-Site Request Forgery to Plugin's Settings Update](https://agentprime.io/advisories/CVE-2025-14999.md) `CVE-2025-14999` · CVE record: kentothemes Latest Tabs · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [SVG Map Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-13519.md) `CVE-2025-13519` · CVE record: smjrifle SVG Map by Smjrifle · CVSS 6.1 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [HCL BigFix IVR is impacted by improper authentication and missing CSRF protection](https://agentprime.io/advisories/CVE-2025-31963.md) `CVE-2025-31963` · CVE record: HCLSoftware BigFix IVR · CVSS 2.9 Low · Not analysed yet · Published 7 Jan 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF) - [NS IE Compatibility Fixer <= 2.1.5 - Cross-Site Request Forgery to Plugin Settings Update](https://agentprime.io/advisories/CVE-2025-14845.md) `CVE-2025-14845` · CVE record: nsthemes NS Ie Compatibility Fixer · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [HelpDesk contact form plugin <= 1.1.5 - Cross-Site Request Forgery to Settings Update via handle_query_args](https://agentprime.io/advisories/CVE-2025-13657.md) `CVE-2025-13657` · CVE record: helpdeskcom HelpDesk Contact Form · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Newsletter Email Subscribe <= 2.4 - Cross-Site Request Forgery to Plugin Settings Update](https://agentprime.io/advisories/CVE-2025-14904.md) `CVE-2025-14904` · CVE record: anilankola Newsletter Email Subscribe · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission](https://agentprime.io/advisories/CVE-2025-14468.md) `CVE-2025-14468` · CVE record: mohammed_kaludi AMP for WP – Accelerated Mobile Pages · CVSS 4.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery via User Management](https://agentprime.io/advisories/CVE-2020-36918.md) `CVE-2020-36918` · CVE record: Yerootech iDS6 DSSPro Digital Signage System · CVSS 5.1 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Secure Computing SnapGear Management Console SG560 3.1.5 Cross-Site Request Forgery via Admin Users](https://agentprime.io/advisories/CVE-2020-36908.md) `CVE-2020-36908` · CVE record: Secure Computing SnapGear Management Console SG560 · CVSS 5.1 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [P5 FNIP-8x16A FNIP-4xSH 1.0.20 Cross-Site Request Forgery via User Management](https://agentprime.io/advisories/CVE-2020-36906.md) `CVE-2020-36906` · CVE record: P5 FNIP-8x16A · CVSS 5.3 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [WordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53344.md) `CVE-2025-53344` · CVE record: ThimPress Thim Core · CVSS 4.3 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2023-52212.md) `CVE-2023-52212` · CVE record: Automattic WP Job Manager · CVSS 5.4 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site request forgery (CSRF) - [Emlog: CSRF chained with stored XSS leads to ATO](https://agentprime.io/advisories/CVE-2026-21430.md) `CVE-2026-21430` · CVE record: emlog emlog · CVSS 7.0 High · Not analysed yet · Published 2 Jan 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF) - [PHPEMS cross-site request forgery](https://agentprime.io/advisories/CVE-2025-15405.md) `CVE-2025-15405` · CVE record: PHPEMS · CVSS 5.3 Medium · Not analysed yet · Published 1 Jan 2026 · Tags: Cross-site request forgery (CSRF), Broken access control - [WordPress Bloggie theme <= 2.0.8 - Cross Site Scripting (XSS) Vulnerability](https://agentprime.io/advisories/CVE-2025-31054.md) `CVE-2025-31054` · CVE record: Themefy Bloggie · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Pardakht Delkhah plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62101.md) `CVE-2025-62101` · CVE record: Omid Shamloo Pardakht Delkhah · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Co-marquage service-public.fr plugin <= 0.5.77 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62113.md) `CVE-2025-62113` · CVE record: emendo_seb Co-marquage service-public.fr · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP Gmail SMTP plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62123.md) `CVE-2025-62123` · CVE record: inkthemes WP Gmail SMTP · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Post Snippets plugin <= 4.0.11 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-63040.md) `CVE-2025-63040` · CVE record: Saad Iqbal Post Snippets · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Appointify plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-59130.md) `CVE-2025-59130` · CVE record: appointify Appointify · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress FormFacade plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62133.md) `CVE-2025-62133` · CVE record: manidoraisamy FormFacade · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Gmedia Photo Gallery plugin <= 1.25.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-63014.md) `CVE-2025-63014` · CVE record: Serhii Pasyuk Gmedia Photo Gallery · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Mergado Pack plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62089.md) `CVE-2025-62089` · CVE record: MERGADO Mergado Pack · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress iNext Woo Pincode Checker plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62084.md) `CVE-2025-62084` · CVE record: Imdad Next Web iNext Woo Pincode Checker · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Robots.txt rewrite plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62148.md) `CVE-2025-62148` · CVE record: Eugen Bobrowski Robots.txt rewrite · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62080.md) `CVE-2025-62080` · CVE record: Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress EasyIndex plugin <= 1.1.1704 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62117.md) `CVE-2025-62117` · CVE record: Jayce53 EasyIndex · CVSS 5.4 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress OpenHook plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62120.md) `CVE-2025-62120` · CVE record: Rick Beckman OpenHook · CVSS 5.4 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Contact Form Widget plugin <= 1.5.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62134.md) `CVE-2025-62134` · CVE record: A WP Life Contact Form Widget · CVSS 5.4 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Zoho ZeptoMail plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-49028.md) `CVE-2025-49028` · CVE record: Zoho Mail Zoho ZeptoMail · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Everest Backup plugin <= 2.3.11 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62992.md) `CVE-2025-62992` · CVE record: everestthemes Everest Backup · CVSS 6.5 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Custom Style plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49342.md) `CVE-2025-49342` · CVE record: merzedes Custom Style · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Noindex by Path plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49353.md) `CVE-2025-49353` · CVE record: Marcin Kijak Noindex by Path · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Custom Post Status plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2025-68885.md) `CVE-2025-68885` · CVE record: page-carbajal Custom Post Status · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Recent Posts From Each Category plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49354.md) `CVE-2025-49354` · CVE record: Mindstien Technologies Recent Posts From Each Category · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Social Profilr plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49343.md) `CVE-2025-49343` · CVE record: socialprofilr Social Profilr · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress SensitiveTagCloud plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49344.md) `CVE-2025-49344` · CVE record: reneade SensitiveTagCloud · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP-EasyArchives plugin <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49345.md) `CVE-2025-49345` · CVE record: mg12 WP-EasyArchives · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Simple Archive Generator plugin <= 5.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49346.md) `CVE-2025-49346` · CVE record: peterwsterling Simple Archive Generator · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-59137.md) `CVE-2025-59137` · CVE record: eleopard Behance Portfolio Manager · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [WordPress WP-CalDav2ICS plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-59131.md) `CVE-2025-59131` · CVE record: hoernerfranz WP-CalDav2ICS · CVSS 7.1 High · Not analysed yet · Published 30 Dec 2025 · Tags: Cross-site request forgery (CSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .