Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-53311 CVE record

CVSS 7.1 High

WordPress Navayan Subscribe plugin <= 1.13 - Cross Site Request Forgery (CSRF) Vulnerability
- Amol Nirmala Waman Navayan Subscribe
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53310 CVE record

CVSS 7.1 High

WordPress HidePost plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) Vulnerability
- Funnnny HidePost
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53308 CVE record

CVSS 7.1 High

WordPress Image Slider With Description plugin <= 9.2 - Cross Site Request Forgery (CSRF) Vulnerability
- gopi_plus Image Slider With Description
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53305 CVE record

CVSS 7.1 High

WordPress WP Forum Server plugin <= 1.8.2 - Cross Site Request Forgery (CSRF) Vulnerability
- lucidcrew WP Forum Server
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53277 CVE record

CVSS 8.8 High

WordPress IS-theme-companion plugin <= 1.59 - Cross Site Request Forgery (CSRF) vulnerability
- Infigo Software IS-theme-companion
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53274 CVE record

CVSS 7.1 High

WordPress WP Permalink Translator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) Vulnerability
- Hossin Asaadi WP Permalink Translator
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53273 CVE record

CVSS 4.3 Medium

WordPress Slickstream plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Slickstream
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53272 CVE record

CVSS 4.3 Medium

WordPress Image Cleanup plugin <= 1.9.2 - Cross Site Request Forgery (CSRF) Vulnerability
- opicron Image Cleanup
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53271 CVE record

CVSS 7.1 High

WordPress Additional Order Filters for WooCommerce plugin <= 1.22 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability
- Anton Bond Additional Order Filters for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53270 CVE record

CVSS 4.3 Medium

WordPress CTA plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Blend Media WordPress CTA
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53269 CVE record

CVSS 4.3 Medium

WordPress My Wp Brand plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability
- imw3 My Wp Brand
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53268 CVE record

CVSS 4.3 Medium

WordPress Import external attachments plugin <= 1.5.12 - Cross Site Request Forgery (CSRF) Vulnerability
- ryanpcmcquen Import external attachments
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53267 CVE record

CVSS 4.3 Medium

WordPress Hide Admin Bar From Front End plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Aftab Husain Hide Admin Bar From Front End
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53265 CVE record

CVSS 5.4 Medium

WordPress Virusdie plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Virusdie
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53264 CVE record

CVSS 4.3 Medium

WordPress ONet Regenerate Thumbnails plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability
- Konrád Koller ONet Regenerate Thumbnails
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53263 CVE record

CVSS 5.4 Medium

WordPress Address Autocomplete via Google for Gravity Forms plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability
- PluginsCafe Address Autocomplete via Google for Gravity Forms
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53262 CVE record

CVSS 5.4 Medium

WordPress Writesonic plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability
- Writesonic
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53261 CVE record

CVSS 4.3 Medium

WordPress WP YouTube Live plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
- macbookandrew WP YouTube Live
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53254 CVE record

CVSS 4.3 Medium

WordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability
- Themeisle Cyrlitera
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53203 CVE record

CVSS 4.3 Medium

WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.148 - Cross Site Request Forgery (CSRF) Vulnerability
- EDGARROJAS WooCommerce PDF Invoice Builder
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53197 CVE record

CVSS 4.3 Medium

WordPress Cookiebot plugin <= 4.5.8 - Cross Site Request Forgery (CSRF) Vulnerability
- Cookiebot
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53193 CVE record

CVSS 4.3 Medium

WordPress Burst Statistics plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability
- Burst Statistics
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-32281 CVE record

CVSS 4.3 Medium

WordPress DarkMySite plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerability
- DarkMySite
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-5936 CVE record

CVSS 4.3 Medium

VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync
- innate-images-llc VR Calendar
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-50370 CVE record

CVSS 6.5 Medium

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Inquiry Management functionality /mcgs/admin/readenq.php of the Phpgurukul Medical Card Generation System 1.0.
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-50369 CVE record

CVSS 6.5 Medium

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Manage Card functionality (/mcgs/admin/manage-card.php) of PHPGurukul Medical Card Generation System 1.0.
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-48921 CVE record

CVSS 8.8 High

Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079
- Drupal Open Social
- Cross-site request forgery (CSRF)
Not analysed yet 26 Jun 2025
CVE-2025-48497 CVE record

CVSS 5.1 Medium

Cross-site request forgery in iroha Soft Co., Ltd. iroha Board
- iroha Soft Co., Ltd. iroha Board
- Cross-site request forgery (CSRF)
Not analysed yet 26 Jun 2025
CVE-2025-5932 CVE record

CVSS 4.3 Medium

Homerunner <= 1.0.30 - Cross-Site Request Forgery to Settings Update
- coolrunner Homerunner
- Cross-site request forgery (CSRF)
Not analysed yet 26 Jun 2025
CVE-2025-6664 CVE record

CVSS 5.3 Medium

CodeAstro Patient Record Management System cross-site request forgery
- CodeAstro Patient Record Management System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 25 Jun 2025
CVE-2025-50179 CVE record

CVSS 4.6 Medium

Tuleap missing CSRF protection on tracker reports manipulation
- Enalean tuleap
- Cross-site request forgery (CSRF)
Not analysed yet 25 Jun 2025
CVE-2025-48991 CVE record

CVSS 4.6 Medium

Tuleap missing CSRF protection on tracker canned responses administration
- Enalean tuleap
- Cross-site request forgery (CSRF)
Not analysed yet 25 Jun 2025
CVE-2025-6478 CVE record

CVSS 5.3 Medium

CodeAstro Expense Management System cross-site request forgery
- CodeAstro Expense Management System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 22 Jun 2025
CVE-2025-6476 CVE record

CVSS 5.3 Medium

SourceCodester Gym Management System cross-site request forgery
- SourceCodester Gym Management System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 22 Jun 2025
CVE-2024-4994 CVE record

CVSS 8.1 High

Cross-Site Request Forgery (CSRF) in GitLab
- GitLab
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-49964 CVE record

CVSS 4.3 Medium

WordPress ClipLink plugin <= 1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- indgeek ClipLink
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-49965 CVE record

CVSS 4.3 Medium

WordPress PixelBeds Channel Manager and Hotel Booking Engine plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Oganro PixelBeds Channel Manager and Hotel Booking Engine
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-49966 CVE record

CVSS 4.3 Medium

WordPress Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Oganro Travel Portal Search Widget for HotelBeds APITUDE API
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-49967 CVE record

CVSS 4.3 Medium

WordPress Live Sports Streamthunder plugin <= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability
- marcusjansen Live Sports Streamthunder
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-49968 CVE record

CVSS 4.3 Medium

WordPress XML Travel Portal Widget plugin <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Oganro XML Travel Portal Widget
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-49972 CVE record

CVSS 4.3 Medium

WordPress TM Replace Howdy plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) Vulnerability
- David Wood TM Replace Howdy
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-49975 CVE record

CVSS 4.3 Medium

WordPress JobWP plugin <= 2.4.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Hossni Mubarak JobWP
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-49977 CVE record

CVSS 4.3 Medium

WordPress WP Inventory Manager plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability
- WP Inventory Manager
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-50036 CVE record

CVSS 6.5 Medium

WordPress Mailing Group Listserv plugin <= 3.0.5 - Cross Site Request Forgery (CSRF) Vulnerability
- Yamna Khawaja Mailing Group Listserv
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-50044 CVE record

CVSS 6.5 Medium

WordPress Real Estate Manager plugin <= 7.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Rameez Iqbal Real Estate Manager
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52772 CVE record

CVSS 7.1 High

WordPress Virtual Moderator plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability
- Adnan Haque (a11n) Virtual Moderator
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52780 CVE record

CVSS 7.1 High

WordPress Logo Manager For Samandehi plugin <= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability
- Mohammad Parsa Logo Manager For Samandehi
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52781 CVE record

CVSS 7.1 High

WordPress TinyNav plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability
- Beee TinyNav
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52783 CVE record

CVSS 7.1 High

WordPress Change Cart button Colors WooCommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- themelocation Change Cart button Colors WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52784 CVE record

CVSS 7.1 High

WordPress Bluff Post plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- hideoguchi Bluff Post
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52789 CVE record

CVSS 7.1 High

WordPress Lewe ChordPress plugin <= 4.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability
- George Lewe Lewe ChordPress
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52790 CVE record

CVSS 7.1 High

WordPress WP-DownloadCounter plugin <= 1.01 - Cross Site Request Forgery (CSRF) Vulnerability
- r-win WP-DownloadCounter
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52791 CVE record

CVSS 7.1 High

WordPress Knowledge Base – Knowledge Base Maker plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) Vulnerability
- devfelixmoira Knowledge Base – Knowledge Base Maker
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52792 CVE record

CVSS 7.1 High

WordPress WP User Stylesheet Switcher plugin <= v2.2.0 - Cross Site Request Forgery (CSRF) Vulnerability
- vgstef WP User Stylesheet Switcher
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52793 CVE record

CVSS 7.1 High

WordPress Esselink.nu Settings plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability
- Esselink.nu Settings
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52794 CVE record

CVSS 7.1 High

WordPress Creative Contact Form plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Creative-Solutions Creative Contact Form
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52795 CVE record

CVSS 7.1 High

WordPress WP Front User Submit / Front Editor plugin <= 5.0.6 - Cross Site Request Forgery (CSRF) vulnerability
- aharonyan WP Front User Submit / Front Editor
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52825 CVE record

CVSS 8.8 High

WordPress Real Estate Manager plugin <= 7.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Rameez Iqbal Real Estate Manager
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-52711 CVE record

CVSS 4.3 Medium

WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) Vulnerability
- Post and Page Builder by BoldGrid
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jun 2025
CVE-2025-6341 CVE record

CVSS 5.3 Medium

code-projects School Fees Payment System cross-site request forgery
- code-projects School Fees Payment System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 20 Jun 2025