Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-30994 CVE record

CVSS 4.3 Medium

WordPress CubeWP plugin <= 1.1.29 - Cross Site Request Forgery (CSRF) vulnerability
- Imran Tauqeer CubeWP
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-30995 CVE record

CVSS 7.1 High

WordPress Widgetize Pages Light plugin <= 3.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- OTWthemes Widgetize Pages Light
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49332 CVE record

CVSS 4.3 Medium

WordPress WP Time Slots Booking Form plugin <= 1.2.30 - Cross Site Request Forgery (CSRF) Vulnerability
- codepeople WP Time Slots Booking Form
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49317 CVE record

CVSS 4.3 Medium

WordPress WP Page Loading plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) Vulnerability
- NTC WP Page Loading
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49291 CVE record

CVSS 4.3 Medium

WordPress Calculated Fields Form plugin <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability
- codepeople Calculated Fields Form
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49286 CVE record

CVSS 4.3 Medium

WordPress WP Table Builder plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability
- WP Table Builder
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49285 CVE record

CVSS 4.3 Medium

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) Vulnerability
- WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49284 CVE record

CVSS 4.3 Medium

WordPress WP Maintenance Mode & Site Under Construction plugin <= 4.3 - Cross Site Request Forgery (CSRF) Vulnerability
- wp-buy WP Maintenance Mode & Site Under Construction
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49283 CVE record

CVSS 4.3 Medium

WordPress Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant plugin <= 4.1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49273 CVE record

CVSS 4.3 Medium

WordPress WP Tools plugin <= 5.24 - Cross Site Request Forgery (CSRF) Vulnerability
- sminozzi WP Tools
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49269 CVE record

CVSS 4.3 Medium

WordPress Market Exporter plugin <= 2.0.22 - Cross Site Request Forgery (CSRF) Vulnerability
- Anton Vanyukov Market Exporter
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49239 CVE record

CVSS 5.4 Medium

WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.5.0 - Cross Site Request Forgery (CSRF) Vulnerability
- tychesoftwares Print Invoice & Delivery Notes for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49238 CVE record

CVSS 4.3 Medium

WordPress Everest Backup plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability
- everestthemes Everest Backup
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49237 CVE record

CVSS 7.4 High

WordPress POEditor plugin <= 0.9.10 - CSRF to Arbitrary File Deletion vulnerability
- POEditor
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-48328 CVE record

CVSS 4.3 Medium

WordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
- Daman Jeet Real Time Validation for Gravity Forms
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49077 CVE record

CVSS 4.3 Medium

WordPress Dynamic Pricing and Discount Rules plugin <= 2.2.9 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeHigh Dynamic Pricing and Discount Rules
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-5732 CVE record

CVSS 5.3 Medium

code-projects Traffic Offense Reporting System cross-site request forgery
- code-projects Traffic Offense Reporting System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 6 Jun 2025
CVE-2025-2935 CVE record

CVSS 5.4 Medium

Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms <= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions
- webguyio Stop Spammers Classic
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-4966 CVE record

CVSS 6.1 Medium

WP Online Users Stats <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via hk_dataset_results Function
- hk1993 WP Online Users Stats
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-5019 CVE record

CVSS 5.4 Medium

Hive Support <= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function
- hivesupport Hive Support | AI-Powered Help Desk, Live Chat and Chatbot
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-36513 CVE record

CVSS 5.1 Medium

Cross-site request forgery in Surveillance cameras provided by i-PRO Co., Ltd.
- Surveillance cameras provided by i-PRO Co., Ltd.
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-46257 CVE record

CVSS 4.3 Medium

WordPress Element Pack Pro Plugin < 8.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- BdThemes Element Pack Pro
- Cross-site request forgery (CSRF)
Not analysed yet 5 Jun 2025
CVE-2025-31482 CVE record

CVSS 4.3 Medium

FreshRSS vulnerable to DoS by malicious feed entry loading logout URL
- FreshRSS
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2025
CVE-2025-5521 CVE record

CVSS 5.3 Medium

WuKongOpenSource WukongCRM updataPassword cross-site request forgery
- WuKongOpenSource WukongCRM
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 3 Jun 2025
CVE-2025-49069 CVE record

CVSS 4.3 Medium

WordPress Contact Forms by Cimatti plugin <= 1.9.8 - Cross Site Request Forgery (CSRF) vulnerability
- Contact Forms by Cimatti
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jun 2025
CVE-2025-5410 CVE record

CVSS 5.3 Medium

Mist Community Edition middleware.py session_start_response cross-site request forgery
- Mist Community Edition
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 1 Jun 2025
CVE-2025-48885 CVE record

CVSS 5.7 Medium

application-urlshortener users can create arbitrary pages as long as they have view access to them
- xwikisas application-urlshortener
- Cross-site request forgery (CSRF)
Not analysed yet 30 May 2025
CVE-2025-5142 CVE record

CVSS 6.5 Medium

Simple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters
- pluginsandsnippets Simple Page Access Restriction
- Cross-site request forgery (CSRF)
Not analysed yet 30 May 2025
CVE-2025-48483 CVE record

CVSS 6.3 Medium

FreeScout Stored XSS leads to CSRF
- freescout
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 30 May 2025
CVE-2025-26211 CVE record

CVSS 3.7 Low

Cross-site request forgery in Gibbon
- Gibbon
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2025
CVE-2025-5185 CVE record

CVSS 5.3 Medium

Summer Pearl Group Vacation Rental Management Platform cross-site request forgery
- Summer Pearl Group Vacation Rental Management Platform
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 26 May 2025
CVE-2025-5132 CVE record

CVSS 5.3 Medium

Tmall Demo logout cross-site request forgery
- Tmall Demo
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 24 May 2025
CVE-2025-46458 CVE record

CVSS 8.2 High

WordPress occupancyplan plugin <= 1.0.3.0 - CSRF to SQL Injection vulnerability
- x000x occupancyplan
- Cross-site request forgery (CSRF)
Not analysed yet 23 May 2025
CVE-2025-48740 CVE record

CVSS 5.9 Medium

Cross-site request forgery in StrangeBee TheHive
- StrangeBee TheHive
- Cross-site request forgery (CSRF)
Not analysed yet 23 May 2025
CVE-2025-5033 CVE record

CVSS 5.3 Medium

XiaoBingby TeaCMS addUser cross-site request forgery
- XiaoBingby TeaCMS
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 21 May 2025
CVE-2025-48340 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress User Profile Meta Manager plugin <= 1.02 - CSRF to Privilege Escalation vulnerability
- Danny Vink User Profile Meta Manager
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-43835 CVE record

CVSS 4.3 Medium

WordPress wp-cyr-cho plugin <= 0.1 - Cross Site Request Forgery (CSRF) vulnerability
- ktsvetkov wp-cyr-cho
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-43840 CVE record

CVSS 7.1 High

WordPress CheckBot plugin <= 1.05 - CSRF to Stored XSS vulnerability
- ref CheckBot
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-39375 CVE record

CVSS 4.3 Medium

WordPress Easy Child Theme Creator plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- Ashok G Easy Child Theme Creator
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-39374 CVE record

CVSS 7.1 High

WordPress Best Posts Summary plugin <= 1.0 - CSRF to Stored XSS vulnerability
- aseem1234 Best Posts Summary
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-39371 CVE record

CVSS 4.3 Medium

WordPress Author Box Plugin With Different Description plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability
- Sanjeev Mohindra Author Box Plugin With Different Description
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-39351 CVE record

CVSS 4.3 Medium

WordPress Grand Restaurant WordPress theme <= 7.0 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeGoods Grand Restaurant
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-47583 CVE record

CVSS 5.4 Medium

WordPress Salon booking system plugin <= 10.16 - CSRF to Arbitrary Content Deletion vulnerability
- Dimitri Grassi Salon booking system
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48344 CVE record

CVSS 5.4 Medium

WordPress Rootspersona plugin <= 3.7.5 - Cross Site Request Forgery (CSRF) Vulnerability
- ed4becky Rootspersona
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48342 CVE record

CVSS 5.4 Medium

WordPress Dynamic Pricing & Discounts Lite for WooCommerce plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) vulnerability
- RedefiningTheWeb Dynamic Pricing & Discounts Lite for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48285 CVE record

CVSS 4.3 Medium

WordPress Falang multilanguage plugin <= 1.3.61 - Cross Site Request Forgery (CSRF) Vulnerability
- sbouey Falang multilanguage
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48284 CVE record

CVSS 5.4 Medium

WordPress Japanized For WooCommerce plugin <= 2.6.40 - Cross Site Request Forgery (CSRF) Vulnerability
- shohei.tanaka Japanized For WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48265 CVE record

CVSS 4.3 Medium

WordPress Year Make Model Search for WooCommerce plugin <= 1.0.11 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
- Pektsekye Year Make Model Search for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48264 CVE record

CVSS 4.3 Medium

WordPress Product Code for WooCommerce plugin <= 1.5.0 - CSRF to Database Update vulnerability
- artiosmedia Product Code for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48259 CVE record

CVSS 4.3 Medium

WordPress WP Mapa Politico España plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
- Juan Carlos WP Mapa Politico España
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48255 CVE record

CVSS 4.3 Medium

WordPress Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin <= 6.2.4 - Cross Site Request Forgery (CSRF) Vulnerability
- videowhisper Broadcast Live Video
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48243 CVE record

CVSS 4.3 Medium

WordPress reCAPTCHA for all plugin <= 2.26 - Cross Site Request Forgery (CSRF) Vulnerability
- sminozzi reCAPTCHA for all
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48238 CVE record

CVSS 7.1 High

WordPress AWcode Toolkit plugin <= 1.0.18 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- AWcode Toolkit
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-48233 CVE record

CVSS 7.1 High

WordPress Affiliates Manager Google reCAPTCHA Integration plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- affmngr Affiliates Manager Google reCAPTCHA Integration
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2025
CVE-2025-4887 CVE record

CVSS 5.3 Medium

SourceCodester Online Student Clearance System cross-site request forgery
- SourceCodester Online Student Clearance System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 18 May 2025
CVE-2025-4194 CVE record

CVSS 6.1 Medium

AlT Monitoring <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- alti5 AlT Monitoring
- Cross-site request forgery (CSRF)
Not analysed yet 17 May 2025
CVE-2025-4189 CVE record

CVSS 6.1 Medium

Audio Comments Plugin <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- naicuoctavian Audio Comments Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 17 May 2025
CVE-2025-31068 CVE record

CVSS 4.3 Medium

WordPress Seven Stars <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability
- themeton Seven Stars
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025
CVE-2025-31639 CVE record

CVSS 4.3 Medium

WordPress Spare <= 1.7 - Cross Site Request Forgery (CSRF) Vulnerability
- themeton Spare
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025
CVE-2025-31915 CVE record

CVSS 5.4 Medium

WordPress Pixel Form BuilderPlugin & Autoresponder plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability
- kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2025