Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-47447 CVE record

CVSS 4.3 Medium

WordPress Cool Author Box plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Hossni Mubarak Cool Author Box
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47446 CVE record

CVSS 4.3 Medium

WordPress Listamester plugin <= 2.3.6 - Cross Site Request Forgery (CSRF) Vulnerability
- Listamester
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-0669 CVE record

CVSS 8.6 High

BOINC Server Cross-Site Request Forgery
- BOINC Server
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-4327 CVE record

CVSS 5.3 Medium

MRCMS cross-site request forgery
- MRCMS
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 6 May 2025
CVE-2025-4337 CVE record

CVSS 4.3 Medium

AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion
- mitchelllevy AHAthat Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 6 May 2025
CVE-2025-4282 CVE record

CVSS 5.3 Medium

SourceCodester/oretnom23 Stock Management System Users.php cross-site request forgery
- SourceCodester Stock Management System
- oretnom23 Stock Management System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 5 May 2025
CVE-2025-28062 CVE record

CVSS 8.1 High

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3.
- Cross-site request forgery (CSRF)
Not analysed yet 5 May 2025
CVE-2025-4199 CVE record

CVSS 6.1 Medium

Abundatrade Plugin <= 1.8.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- withinboredom Abundatrade Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 3 May 2025
CVE-2025-4198 CVE record

CVSS 6.1 Medium

Alink Tap <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- todoapuestas Alink Tap
- Cross-site request forgery (CSRF)
Not analysed yet 3 May 2025
CVE-2025-4188 CVE record

CVSS 6.1 Medium

Advanced Reorder Image Text Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- balasahebbhise Advanced Reorder Image Text Slider
- Cross-site request forgery (CSRF)
Not analysed yet 3 May 2025
CVE-2024-11142 CVE record

CVSS 8.8 High

CSRF in Gosoft Software's Proticaret E-Commerce
- Gosoft Software Proticaret E-Commerce
- Cross-site request forgery (CSRF)
Not analysed yet 2 May 2025
CVE-2025-2168 CVE record

CVSS 4.3 Medium

Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User M…
- bdthemes Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 1 May 2025
CVE-2025-1305 CVE record

CVSS 8.8 High

NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation
- spicethemes NewsBlogger
- Cross-site request forgery (CSRF)
Not analysed yet 1 May 2025
CVE-2025-4088 CVE record

CVSS 6.5 Medium

Cross-site request forgery via storage access API redirects
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site request forgery (CSRF)
Not analysed yet 29 Apr 2025
CVE-2025-32354 CVE record

CVSS 8.8 High

In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF t…
- Cross-site request forgery (CSRF)
Not analysed yet 29 Apr 2025
CVE-2025-3997 CVE record

CVSS 5.3 Medium

dazhouda lecms Personal Information Page index.php cross-site request forgery
- dazhouda lecms
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 28 Apr 2025
CVE-2025-3979 CVE record

CVSS 5.3 Medium

dazhouda lecms Password Change index.php cross-site request forgery
- dazhouda lecms
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 27 Apr 2025
CVE-2025-3964 CVE record

CVSS 5.3 Medium

withstars Books-Management-System Article del cross-site request forgery
- withstars Books-Management-System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 27 Apr 2025
CVE-2025-3959 CVE record

CVSS 5.3 Medium

withstars Books-Management-System reader_delete.html cross-site request forgery
- withstars Books-Management-System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 27 Apr 2025
moodle/moodle Packagist

CVSS 8.8 High

Moodle has a CSRF risk in Brickfield tool's analysis request action
- Cross-site request forgery (CSRF)
<4.1.18 || >=4.3.0-beta, <4.3.12 || >=4.4.0-beta, <4.4.8 || >=4.5.0-beta, <4.5.4 · fixed in 4.1.18, 4.3.12, 4.4.8, 4.5.4

GHSA-m8qh-hx4c-h9hr · CVE-2025-3638 Not analysed yet 25 Apr 2025
moodle/moodle Packagist

CVSS 3.5 Low

Moodle has a CSRF risk in user tours manager that allows tour duplication
- Cross-site request forgery (CSRF)
<4.1.18 || >=4.3.0-beta, <4.3.12 || >=4.4.0-beta, <4.4.8 || >=4.5.0-beta, <4.5.4 · fixed in 4.1.18, 4.3.12, 4.4.8, 4.5.4

GHSA-88xj-97gf-7wpq · CVE-2025-3635 Not analysed yet 25 Apr 2025
CVE-2025-46547 CVE record

CVSS 5.4 Medium

Cross-site request forgery in Sherpa Orchestrator
- Sherpa Orchestrator
- Cross-site request forgery (CSRF)
Not analysed yet 25 Apr 2025
CVE-2025-46498 CVE record

CVSS 5.4 Medium

WordPress Zalo Official Live Chat plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability
- nghialuu Zalo Official Live Chat
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46507 CVE record

CVSS 7.1 High

WordPress Unsafe Mimetypes plugin <= 0.1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- ldrumm Unsafe Mimetypes
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46442 CVE record

CVSS 7.1 High

WordPress Loan Calculator plugin <= 1.3 - CSRF to Stored XSS vulnerability
- Casey Johnson Loan Calculator
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46513 CVE record

CVSS 4.3 Medium

WordPress All in One Time Clock Lite plugin < 1.3.326 - Cross Site Request Forgery (CSRF) Vulnerability
- Codebangers All in One Time Clock Lite
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46457 CVE record

CVSS 7.1 High

WordPress Wp Custom CMS Block plugin <= 2.1 - CSRF to Stored XSS vulnerability
- Ahsanullah Akanda Wp Custom CMS Block
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46530 CVE record

CVSS 7.1 High

WordPress Hacklog Remote Attachment plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) Vulnerability
- HuangYe WuDeng Hacklog Remote Attachment
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46528 CVE record

CVSS 7.1 High

WordPress Availability Calendar plugin <= 0.2.4 - Cross Site Request Forgery (CSRF) Vulnerability
- Steve Availability Calendar
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46524 CVE record

CVSS 7.1 High

WordPress WP Filter Post Category plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- stesvis WP Filter Post Category
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46522 CVE record

CVSS 7.1 High

WordPress Tabs plugin <= 4.0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- Billy Bryant Tabs
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46520 CVE record

CVSS 7.1 High

WordPress Related Posts via Taxonomies plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- alphasis Related Posts via Taxonomies
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46516 CVE record

CVSS 7.1 High

WordPress Twitter Card Generator plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- silencecm Twitter Card Generator
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46514 CVE record

CVSS 7.1 High

WordPress Milat jQuery Automatic Popup plugin <= 1.3.1 - CSRF to Stored XSS vulnerability
- Milat jQuery Automatic Popup
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46512 CVE record

CVSS 7.1 High

WordPress Custom Functions Plugin plugin <= 1.1 - CSRF to Stored XSS vulnerability
- Shamim Hasan Custom Functions Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46510 CVE record

CVSS 7.1 High

WordPress Contact Form 7 Calendar plugin <= 3.0.1 - CSRF to Stored XSS vulnerability
- harrysudana Contact Form 7 Calendar
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46508 CVE record

CVSS 7.1 High

WordPress Advanced lazy load plugin <= 1.6.0 - CSRF to Stored XSS vulnerability
- kasonzhao Advanced lazy load
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46506 CVE record

CVSS 7.1 High

WordPress WpZon – Amazon Affiliate Plugin plugin <= 1.3 - CSRF to XSS vulnerability
- Lora77 WpZon – Amazon Affiliate Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46504 CVE record

CVSS 7.1 High

WordPress Vasaio QR Code plugin <= 1.2.5 - CSRF to XSS vulnerability
- Olar Marius Vasaio QR Code
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46497 CVE record

CVSS 7.1 High

WordPress Navegg Analytics plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) vulnerability
- Navegg Analytics
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46495 CVE record

CVSS 6.5 Medium

WordPress Drop Caps plugin <= 2.1 - CSRF to XSS vulnerability
- tomontoast Drop Caps
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46492 CVE record

CVSS 7.1 High

WordPress Call Now PHT Blog plugin <= 2.4.1 - CSRF to XSS vulnerability
- Pham Thanh Call Now PHT Blog
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46466 CVE record

CVSS 7.1 High

WordPress Modern Polls plugin <= 1.0.10 - CSRF to Stored XSS vulnerability
- felixtz Modern Polls
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46465 CVE record

CVSS 7.1 High

WordPress Print Science Designer plugin <= 1.3.155 - CSRF to Stored XSS vulnerability
- John Weissberg Print Science Designer
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46462 CVE record

CVSS 4.3 Medium

WordPress WPVN plugin <= 0.7.8 - Cross Site Request Forgery (CSRF) Vulnerability
- Trân Minh-Quân WPVN
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46452 CVE record

CVSS 7.1 High

WordPress Google News plugin <= 2.5.1 - CSRF to Stored XSS vulnerability
- Olav Kolbu Google News
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46450 CVE record

CVSS 7.1 High

WordPress occupancyplan plugin <= 1.0.3.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- x000x occupancyplan
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46436 CVE record

CVSS 4.3 Medium

WordPress SCSS-Library plugin <= 0.4.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Sebastian Echeverry SCSS-Library
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46439 CVE record

CVSS 7.4 High

WordPress Plugin Central plugin <= 2.5.1 - CSRF to Arbitrary File Deletion vulnerability
- Vladimir Prelovac Plugin Central
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46435 CVE record

CVSS 7.1 High

WordPress Time Based Greeting plugin <= 2.2.2 - CSRF to Stored XSS vulnerability
- Yash Binani Time Based Greeting
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-39381 CVE record

CVSS 7.1 High

WordPress KiotViet Sync plugin <= 1.8.4 - CSRF to Stored XSS vulnerability
- KiotViet Sync
- Cross-site request forgery (CSRF)
Not analysed yet 24 Apr 2025
CVE-2025-3907 CVE record

CVSS 4.3 Medium

Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046
- Drupal Search API Solr
- Cross-site request forgery (CSRF)
Not analysed yet 23 Apr 2025
CVE-2025-31328 CVE record

CVSS 4.6 Medium

Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)
- SAP_SE SAP S/4 HANA (Learning Solution)
- Cross-site request forgery (CSRF)
Not analysed yet 22 Apr 2025
CVE-2025-46251 CVE record

CVSS 7.1 High

WordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.3.3 - CSRF to Stored XSS vulnerability
- e4jvikwp VikRestaurants
- Cross-site request forgery (CSRF)
Not analysed yet 22 Apr 2025
CVE-2025-46249 CVE record

CVSS 4.3 Medium

WordPress Simple calendar for Elementor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerability
- Michael Simple calendar for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 22 Apr 2025
CVE-2025-46246 CVE record

CVSS 4.3 Medium

WordPress CM Answers plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) Vulnerability
- CreativeMindsSolutions CM Answers
- Cross-site request forgery (CSRF)
Not analysed yet 22 Apr 2025
CVE-2025-46245 CVE record

CVSS 4.3 Medium

WordPress CM Ad Changer plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) Vulnerability
- CreativeMindsSolutions CM Ad Changer
- Cross-site request forgery (CSRF)
Not analysed yet 22 Apr 2025
CVE-2025-46243 CVE record

CVSS 4.3 Medium

WordPress Recover abandoned cart for WooCommerce plugin <= 2.2 - Cross Site Request Forgery (CSRF) Vulnerability
- sonalsinha21 Recover abandoned cart for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 22 Apr 2025
CVE-2025-46241 CVE record

CVSS 8.2 High

WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability
- codepeople Appointment Booking Calendar
- Cross-site request forgery (CSRF)
Not analysed yet 22 Apr 2025
CVE-2025-46231 CVE record

CVSS 5.4 Medium

WordPress affiliate-toolkit plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) Vulnerability
- SERVIT Software Solutions affiliate-toolkit
- Cross-site request forgery (CSRF)
Not analysed yet 22 Apr 2025