Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-31921 CVE record

CVSS 4.3 Medium

WordPress WP Ultimate Tours Builder plugin <= 1.055 - Cross Site Request Forgery (CSRF) Vulnerability
- loopus WP Ultimate Tours Builder
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025
CVE-2025-31922 CVE record

CVSS 7.1 High

WordPress CSS3 Accordions for WordPress plugin <= 3.0 - CSRF to Stored XSS vulnerability
- QuanticaLabs CSS3 Accordions for WordPress
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025
CVE-2025-32245 CVE record

CVSS 7.1 High

WordPress Featured Posts Scroll plugin <= 1.25 - CSRF to Stored Cross Site Scripting (XSS) vulnerability
- Chaser324 Featured Posts Scroll
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025
CVE-2025-32310 CVE record

CVSS 8.8 High

WordPress QuickCal plugin <= 1.0.15 - CSRF to Privilege Escalation vulnerability
- ThemeMove QuickCal - Appointment Booking Calendar for WordPress
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025
CVE-2025-48146 CVE record

CVSS 7.1 High

WordPress SEO Flow by LupsOnline plugin <= 2.2.1 - CSRF to Stored XSS vulnerability
- Michael Lups SEO Flow by LupsOnline
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025
CVE-2025-48144 CVE record

CVSS 7.1 High

WordPress Import Export For WooCommerce plugin <= 1.6.2 - CSRF to Stored XSS vulnerability
- sidngr Import Export For WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025
CVE-2025-48115 CVE record

CVSS 4.3 Medium

WordPress ValidateCertify plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability
- Javier Revilla ValidateCertify
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025
CVE-2025-48114 CVE record

CVSS 7.1 High

WordPress ShayanWeb Admin FontChanger plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- Shayan Farhang Pazhooh ShayanWeb Admin FontChanger
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025
CVE-2025-32922 CVE record

CVSS 7.1 High

WordPress WP2LEADS plugin <= 3.5.0 - Cross Site Request Forgery (CSRF) vulnerability
- Saleswonder Team: Tobias WP2LEADS
- Cross-site request forgery (CSRF)
Not analysed yet 15 May 2025
CVE-2025-44185 CVE record

CVSS 5.4 Medium

SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change_pass.php via the password parameter.
- Cross-site request forgery (CSRF)
Not analysed yet 15 May 2025
org.jenkins-ci.plugins:vmanager-plugin Maven

CVSS 4.3 Medium

Jenkins Cadence vManager Plugin Vulnerable to Cross-Site Request Forgery
- Cross-site request forgery (CSRF)
<4.0.1-288.v8804b_ea_a_cb_7f · fixed in 4.0.1-288.v8804b_ea_a_cb_7f

GHSA-5w52-96jj-fv59 · CVE-2025-47886 Not analysed yet 14 May 2025
CVE-2025-47708 CVE record

CVSS 8.8 High

Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054
- Enterprise MFA - TFA for Drupal
- Cross-site request forgery (CSRF)
Not analysed yet 14 May 2025
CVE-2025-47701 CVE record

CVSS 8.8 High

Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047
- Drupal Restrict route by IP
- Cross-site request forgery (CSRF)
Not analysed yet 14 May 2025
github.com/justinas/nosurf Go

CVSS 6.0 Medium

nosurf vulnerable to CSRF due to non-functional same-origin request checks
- Cross-site request forgery (CSRF)
<1.2.0 · fixed in 1.2.0

GHSA-w9hf-35q4-vcjw · CVE-2025-46721 Not analysed yet 14 May 2025
CVE-2025-44186 CVE record

CVSS 5.4 Medium

SourceCodester Best Employee Management System 1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/Operation/User.php page.
- Cross-site request forgery (CSRF)
Not analysed yet 14 May 2025
bootstrap-multiselect npm

CVSS 6.1 Medium

Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
<2.0.0 · fixed in 2.0.0

GHSA-gv5r-9gxr-v74w · CVE-2025-47204 Not analysed yet 13 May 2025
CVE-2025-24223 CVE record

CVSS 8.0 High

Cross-site request forgery in Apple Safari and others
- Apple Safari
- Apple iOS and iPadOS
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2025
CVE-2025-31205 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Apple Safari and others
- Apple Safari
- Apple iOS and iPadOS
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2025
CVE-2025-46743 CVE record

CVSS 6.3 Medium

Cross-Site Request Forgery
- Schweitzer Engineering Laboratories SEL Blueframe OS
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2025
CVE-2025-46610 CVE record

CVSS 8.8 High

ARTEC EMA Mail 6.92 allows CSRF.
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2025
CVE-2025-4375 CVE record

CVSS 6.9 Medium

Cross-Site Request Forgery vulnerability in Pro Cloud Server's WebEA
- Sparx Systems Pro Cloud Server
- Cross-site request forgery (CSRF)
Not analysed yet 9 May 2025
CVE-2025-20195 CVE record

CVSS 4.3 Medium

Cross-site request forgery in Cisco IOS XE Software
- Cisco IOS XE Software
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47685 CVE record

CVSS 7.1 High

WordPress Contribuinte Checkout plugin <= 2.0.03 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- Moloni Contribuinte Checkout
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47684 CVE record

CVSS 5.4 Medium

WordPress Smaily for WP plugin <= 3.1.7 - Cross Site Request Forgery (CSRF) Vulnerability
- Smaily for WP
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47681 CVE record

CVSS 4.3 Medium

WordPress Web Accessibility with Max Access plugin <= 2.0.9 - Cross Site Request Forgery (CSRF) Vulnerability
- Ability, Inc Web Accessibility with Max Access
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47674 CVE record

CVSS 4.3 Medium

WordPress Credova_Financial plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Credova Financial Credova_Financial
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47667 CVE record

CVSS 5.4 Medium

WordPress LiveAgent plugin <= 4.4.7 - Cross Site Request Forgery (CSRF) Vulnerability
- qusupport LiveAgent
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47661 CVE record

CVSS 5.4 Medium

WordPress 워드프레스 결제 심플페이 plugin <= 5.2.11 - Cross Site Request Forgery (CSRF) Vulnerability
- codemstory 워드프레스 결제 심플페이
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47655 CVE record

CVSS 7.1 High

WordPress theMarketer plugin <= 1.4.7 - CSRF to Stored XSS vulnerability
- theMarketer
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47648 CVE record

CVSS 7.1 High

WordPress Pays – WooCommerce Payment Gateway plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability
- axima Pays – WooCommerce Payment Gateway
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47647 CVE record

CVSS 4.3 Medium

WordPress Sidebar Manager Light plugin <= 1.18 - Cross Site Request Forgery (CSRF) Vulnerability
- OTWthemes Sidebar Manager Light
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47639 CVE record

CVSS 7.1 High

WordPress Supertext Translation and Proofreading plugin <= 4.26 - CSRF to Stored XSS vulnerability
- Supertext Translation and Proofreading
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47633 CVE record

CVSS 4.3 Medium

WordPress Awin – Advertiser Tracking for WooCommerce plugin <= 2.0.0 - CSRF to Product Feed Regeneration vulnerability
- Awin – Advertiser Tracking for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47624 CVE record

CVSS 4.3 Medium

WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability
- apasionados DoFollow Case by Case
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47620 CVE record

CVSS 7.1 High

WordPress Martins Free Monetized Ad Exchange Network plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerability
- bundgaard Martins Free Monetized Ad Exchange Network
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47614 CVE record

CVSS 4.3 Medium

WordPress LessButtons Social Sharing and Statistics plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
- Chris Clark LessButtons Social Sharing and Statistics
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47609 CVE record

CVSS 4.3 Medium

WordPress EasyMe Connect plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability
- easymebiz EasyMe Connect
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47606 CVE record

CVSS 4.3 Medium

WordPress Simple Giveaways plugin <= 2.49.0 - Cross Site Request Forgery (CSRF) vulnerability
- Igor Benic Simple Giveaways
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47597 CVE record

CVSS 4.3 Medium

WordPress WP Podcasts Manager plugin <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability
- Maulik Vora WP Podcasts Manager
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47596 CVE record

CVSS 4.3 Medium

WordPress Beacon Lead Magnets and Lead Capture plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability
- Syed Balkhi Beacon Lead Magnets and Lead Capture
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47594 CVE record

CVSS 4.3 Medium

WordPress Soccer Live Scores <= 1.0.5 - Cross Site Request Forgery (CSRF) Vulnerability
- DAEXT Soccer Live Scores
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47590 CVE record

CVSS 4.3 Medium

WordPress WPSpeed plugin <= 2.6.5 - Cross Site Request Forgery (CSRF) Vulnerability
- JExtensions Store WPSpeed
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47551 CVE record

CVSS 4.3 Medium

WordPress Wiki Embed plugin <= 1.4.6 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
- ctltwp Wiki Embed
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47546 CVE record

CVSS 7.1 High

WordPress WP Compress plugin <= 6.30.30 - Cross Site Request Forgery (CSRF) Vulnerability
- AresIT WP Compress
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47543 CVE record

CVSS 4.3 Medium

WordPress TrueBooker plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability
- themetechmount TrueBooker
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47542 CVE record

CVSS 4.3 Medium

WordPress Simple calendar for Elementor plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) Vulnerability
- Michael Simple calendar for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47533 CVE record

CVSS 8.1 High

WordPress Graphina plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) to Local File Inclusion vulnerability
- Iqonic Design Graphina
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47523 CVE record

CVSS 4.3 Medium

WordPress Seznam Webmaster plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) Vulnerability
- Lukáš Hartmann Seznam Webmaster
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47519 CVE record

CVSS 4.3 Medium

WordPress Easy PayPal Events plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) Vulnerability
- Scott Paterson Easy PayPal Events
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47517 CVE record

CVSS 7.1 High

WordPress Accept Donations with PayPal plugin <= 1.4.5 - CSRF to Stored XSS vulnerability
- Scott Paterson Accept Donations with PayPal & Stripe
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47514 CVE record

CVSS 7.1 High

WordPress ELI's Related Posts Footer Links and Widget plugin <= 1.2.04.20 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- ELI's Related Posts Footer Links and Widget
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47491 CVE record

CVSS 7.4 High

WordPress Contact Form Widget plugin <= 1.4.6 - Cross Site Request Forgery (CSRF) Vulnerability
- A WP Life Contact Form Widget
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47473 CVE record

CVSS 5.4 Medium

WordPress PW WooCommerce Bulk Edit plugin <= 2.134 - Cross Site Request Forgery (CSRF) Vulnerability
- pimwick PW WooCommerce Bulk Edit
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47470 CVE record

CVSS 4.3 Medium

WordPress GPT3 AI Content Writer plugin <= 1.9.14 - Cross Site Request Forgery (CSRF) to Prompt Generation vulnerability
- senols GPT3 AI Content Writer
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47468 CVE record

CVSS 4.3 Medium

WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerability
- hashthemes Hash Form
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47466 CVE record

CVSS 5.4 Medium

WordPress Ultimate WP Mail plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability
- Rustaurius Ultimate WP Mail
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47462 CVE record

CVSS 8.8 High

WordPress Challan plugin <= 3.7.58 - CSRF to Privilege Escalation vulnerability
- WebAppick Challan
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47459 CVE record

CVSS 4.3 Medium

WordPress WP Fundraising Donation and Crowdfunding Platform plugin <= 1.7.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Roxnor FundEngine
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47451 CVE record

CVSS 4.3 Medium

WordPress Product Quantity Dropdown For Woocommerce plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
- silverplugins217 Product Quantity Dropdown For Woocommerce
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-47448 CVE record

CVSS 4.3 Medium

WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability
- ThimPress WP Hotel Booking
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025