Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-6284 CVE record

CVSS 5.3 Medium

PHPGurukul Car Rental Portal cross-site request forgery
- PHPGurukul Car Rental Portal
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 19 Jun 2025
CVE-2024-54172 CVE record

CVSS 4.3 Medium

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site request forgery
- IBM Sterling B2B Integrator
- Cross-site request forgery (CSRF)
Not analysed yet 18 Jun 2025
CVE-2025-48111 CVE record

CVSS 4.3 Medium

WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability
- YITHEMES YITH PayPal Express Checkout for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 17 Jun 2025
CVE-2025-49856 CVE record

CVSS 4.3 Medium

WordPress Responsive Plus plugin <= 3.2.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
- CyberChimps Responsive Plus
- Cross-site request forgery (CSRF)
Not analysed yet 17 Jun 2025
CVE-2025-49865 CVE record

CVSS 4.3 Medium

WordPress Advanced Settings plugin <= 3.0.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Helmut Wandl Advanced Settings
- Cross-site request forgery (CSRF)
Not analysed yet 17 Jun 2025
CVE-2025-6106 CVE record

CVSS 5.3 Medium

WuKongOpenSource WukongCRM AdminRoleController.java cross-site request forgery
- WuKongOpenSource WukongCRM
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 16 Jun 2025
CVE-2025-6105 CVE record

CVSS 5.3 Medium

jflyfox jfinal_cms HOME.java cross-site request forgery
- jflyfox jfinal_cms
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 16 Jun 2025
CVE-2025-6063 CVE record

CVSS 6.1 Medium

XiSearch bar <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- dmitry78 XiSearch bar
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jun 2025
CVE-2025-6062 CVE record

CVSS 4.3 Medium

Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update
- netlatch Yougler Blogger Profile Page
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jun 2025
CVE-2025-4592 CVE record

CVSS 4.3 Medium

AI Image Lab – Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update
- aspengrovestudios AI Image Lab – Free AI Image Generator
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jun 2025
CVE-2025-6055 CVE record

CVSS 6.1 Medium

Zen Sticky Social <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- bogdanding Zen Sticky Social
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jun 2025
CVE-2025-6064 CVE record

CVSS 6.1 Medium

WP URL Shortener <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- djerba WP URL Shortener
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jun 2025
CVE-2025-6059 CVE record

CVSS 4.3 Medium

Seraphinite Accelerator <= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actions
- seraphinitesoft Seraphinite Accelerator
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jun 2025
CVE-2025-5928 CVE record

CVSS 4.3 Medium

WP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Update
- fay-1 WP Sliding Login/Dashboard Panel
- Cross-site request forgery (CSRF)
Not analysed yet 13 Jun 2025
CVE-2025-5938 CVE record

CVSS 5.3 Medium

Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Import
- themebon Digital Marketing and Agency Templates Addons for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 13 Jun 2025
CVE-2025-5930 CVE record

CVSS 4.3 Medium

WP2HTML <= 1.0.2 - Cross-Site Request Forgery to Settings Update
- digitalacornjp WP2HTML
- Cross-site request forgery (CSRF)
Not analysed yet 13 Jun 2025
CVE-2025-5926 CVE record

CVSS 6.1 Medium

Link Shield <= 0.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- jconti Link Shield
- Cross-site request forgery (CSRF)
Not analysed yet 13 Jun 2025
CVE-2025-6001 CVE record

CVSS 8.3 High

VirtueMart - Cross Site Request Forgery (CSRF)
- VirtueMart
- Cross-site request forgery (CSRF)
Not analysed yet 11 Jun 2025
CVE-2025-41661 CVE record

CVSS 8.8 High

Weidmueller: Security routers IE-SR-2TX are affected by CSRF
- Weidmueller IE-SR-2TX-WL
- Weidmueller IE-SR-2TX-WL-4G-EU
- Cross-site request forgery (CSRF)
Not analysed yet 11 Jun 2025
CVE-2025-36576 CVE record

CVSS 2.7 Low

Cross-site request forgery in Dell Wyse Management Suite
- Dell Wyse Management Suite
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jun 2025
CVE-2025-49510 CVE record

CVSS 4.3 Medium

WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- WPFactory Min Max Step Quantity Limits Manager for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jun 2025
CVE-2025-49511 CVE record

CVSS 7.1 High

WordPress Civi Framework plugin <= 2.1.6 - Cross Site Request Forgery (CSRF) to User Deactivation vulnerability
- uxper Civi Framework
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jun 2025
CVE-2025-5925 CVE record

CVSS 4.3 Medium

Bunny’s Print CSS <= 0.95 - Cross-Site Request Forgery to Settings Update
- steph Bunny’s Print CSS
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jun 2025
CVE-2025-5900 CVE record

CVSS 5.3 Medium

Tenda AC9 cross-site request forgery
- Tenda AC9
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 9 Jun 2025
CVE-2025-5888 CVE record

CVSS 5.3 Medium

jsnjfz WebStack-Guns cross-site request forgery
- jsnjfz WebStack-Guns
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 9 Jun 2025
CVE-2025-5885 CVE record

CVSS 5.3 Medium

Konica Minolta bizhub cross-site request forgery
- Konica Minolta bizhub
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 9 Jun 2025
CVE-2025-5766 CVE record

CVSS 5.3 Medium

code-projects Laundry System cross-site request forgery
- code-projects Laundry System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 6 Jun 2025
CVE-2025-49425 CVE record

CVSS 7.1 High

WordPress Konami Easter Egg plugin <= v0.4 - Cross Site Request Forgery (CSRF) Vulnerability
- Adrian Hanft Konami Easter Egg
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49435 CVE record

CVSS 4.3 Medium

WordPress Wp Easy Allopass plugin <= 4.1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Hasina77 Wp Easy Allopass
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49439 CVE record

CVSS 4.3 Medium

WordPress Atelier Create CV plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
- mariusz88atelierweb Atelier Create CV
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49440 CVE record

CVSS 4.3 Medium

WordPress WP Security Master plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) Vulnerability
- Vuong Nguyen WP Security Master
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49445 CVE record

CVSS 4.3 Medium

WordPress Interactive UK Regional Map plugin <= 2.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
- WP Map Plugins Interactive UK Regional Map
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49446 CVE record

CVSS 4.3 Medium

WordPress Admin Notes plugin <=1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- minhlaobao Admin Notes
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49449 CVE record

CVSS 4.3 Medium

WordPress Interactive Regional Map of Africa plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- WP Map Plugins Interactive Regional Map of Africa
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-49453 CVE record

CVSS 7.1 High

WordPress BP Profile as Homepage plugin <= 1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- Jatinder Pal Singh BP Profile as Homepage
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-24772 CVE record

CVSS 5.4 Medium

WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Request Forgery (CSRF) Vulnerability
- cmsMinds Pay with Contact Form 7
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-26593 CVE record

CVSS 4.3 Medium

WordPress FastBook plugin <= 1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- FasterThemes FastBook
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-27359 CVE record

CVSS 4.3 Medium

WordPress WP Media File Type Manager plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- Seerox WP Media File Type Manager
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-27360 CVE record

CVSS 4.3 Medium

WordPress Quick Event Calendar plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability
- WP Corner Quick Event Calendar
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28948 CVE record

CVSS 7.1 High

WordPress Mediabay - WordPress Media Library Folders plugin <= 1.4 - CSRF to Reflected XSS vulnerability
- codedraft Mediabay - WordPress Media Library Folders
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28950 CVE record

CVSS 7.1 High

WordPress Post Author plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- David Shabtai Post Author
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28952 CVE record

CVSS 4.3 Medium

WordPress CubePoints plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Jonathan Lau CubePoints
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28954 CVE record

CVSS 7.4 High

WordPress Backwp plugin <= 2.0.2 - CSRF to Arbitrary File Deletion vulnerability
- wphobby Backwp
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28958 CVE record

CVSS 7.1 High

WordPress Bg Orthodox Calendar plugin <= 0.13.10 - CSRF to Stored XSS vulnerability
- Vadim Bogaiskov Bg Orthodox Calendar
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28964 CVE record

CVSS 7.1 High

WordPress Personal Favicon plugin <= 2.0 - CSRF to Stored XSS vulnerability
- mangup Personal Favicon
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28966 CVE record

CVSS 7.1 High

WordPress Recent Posts Slider Responsive plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) vulnerability
- dilemma123 Recent Posts Slider Responsive
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28974 CVE record

CVSS 7.1 High

WordPress Free WP Mail SMTP plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- mail250 Free WP Mail SMTP
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28981 CVE record

CVSS 7.1 High

WordPress WP Mail Options plugin <= 0.2.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- Soli WP Mail Options
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28984 CVE record

CVSS 4.3 Medium

WordPress Subscription Renewal Reminders for WooCommerce plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability
- storepro Subscription Renewal Reminders for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-28986 CVE record

CVSS 8.2 High

WordPress Epicwin Plugin plugin <= 1.5 - CSRF to SQL Injection vulnerability
- Webaholicson Epicwin Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-29005 CVE record

CVSS 4.3 Medium

WordPress HR Management Lite plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerability
- Weblizar - WordPress Themes & Plugin HR Management Lite
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-30629 CVE record

CVSS 4.3 Medium

WordPress Bitly URL Shortener plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability
- Codehaveli Bitly URL Shortener
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-30632 CVE record

CVSS 5.4 Medium

WordPress Global Translator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) Vulnerability
- pozzad Global Translator
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-30946 CVE record

CVSS 4.3 Medium

WordPress Custom Bulk/Quick Edit plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) Vulnerability
- Michael Cannon Custom Bulk/Quick Edit
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-30948 CVE record

CVSS 4.3 Medium

WordPress Layouts for Elementor plugin <= 1.11 - Cross Site Request Forgery (CSRF) Vulnerability
- Giraphix Creative Layouts for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-30956 CVE record

CVSS 4.3 Medium

WordPress Booqable Rental plugin <= 2.4.25 - Cross Site Request Forgery (CSRF) vulnerability
- Booqable Rental
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-30968 CVE record

CVSS 5.4 Medium

WordPress Advanced Post List plugin <= 0.5.6.2 - Cross Site Request Forgery (CSRF) Vulnerability
- jokerbr313 Advanced Post List
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-30980 CVE record

CVSS 4.3 Medium

WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability
- Alessandro Piconi Simple Keyword to Link
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-30981 CVE record

CVSS 6.3 Medium

WordPress WP-Recall plugin <= 16.26.14 - CSRF to Privilege Escalation vulnerability
- tggfref WP-Recall
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025
CVE-2025-30986 CVE record

CVSS 5.4 Medium

WordPress Elite Video Player plugin <= 10.0.5 - Cross Site Request Forgery (CSRF) Vulnerability
- _CreativeMedia_ Elite Video Player
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2025