Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-7685 CVE record

CVSS 6.1 Medium

Like & Share My Site <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- sflack Like & Share My Site
- Cross-site request forgery (CSRF)
Not analysed yet 22 Jul 2025
CVE-2025-7687 CVE record

CVSS 6.1 Medium

Latest Post Accordian Slider <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- anop-goswami Latest Post Accordian Slider
- Cross-site request forgery (CSRF)
Not analysed yet 22 Jul 2025
CVE-2025-7369 CVE record

CVSS 6.1 Medium

Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2025
CVE-2025-7834 CVE record

CVSS 5.3 Medium

PHPGurukul Complaint Management System cross-site request forgery
- PHPGurukul Complaint Management System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 19 Jul 2025
CVE-2025-7669 CVE record

CVSS 6.1 Medium

Avishi WP PayPal Payment Button <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- avishika Avishi WP PayPal Payment Button
- Cross-site request forgery (CSRF)
Not analysed yet 19 Jul 2025
CVE-2025-6781 CVE record

CVSS 4.3 Medium

Copymatic – AI Content Writer & Generator <= 2.1 - Cross-Site Request Forgery to Settings Update
- ryanfaber Copymatic – AI Content Writer & Generator
- Cross-site request forgery (CSRF)
Not analysed yet 18 Jul 2025
CVE-2025-6053 CVE record

CVSS 6.1 Medium

Zuppler Online Ordering <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- bogdansilivestru Zuppler Online Ordering
- Cross-site request forgery (CSRF)
Not analysed yet 18 Jul 2025
CVE-2025-50586 CVE record

CVSS 6.5 Medium

StudentManage v1.0 was discovered to contain Cross-Site Request Forgery (CSRF).
- Cross-site request forgery (CSRF)
Not analysed yet 18 Jul 2025
CVE-2025-7756 CVE record

CVSS 5.3 Medium

code-projects E-Commerce Site cross-site request forgery
- code-projects E-Commerce Site
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 17 Jul 2025
CVE-2025-48153 CVE record

CVSS 7.1 High

WordPress Import CDN-Remote Images plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) Vulnerability
- Atakan Au Import CDN-Remote Images
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54042 CVE record

CVSS 4.3 Medium

WordPress WP Post Hide plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) Vulnerability
- Xfinitysoft WP Post Hide
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54041 CVE record

CVSS 4.3 Medium

WordPress Wallet System for WooCommerce plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability
- WP Swings Wallet System for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54039 CVE record

CVSS 4.3 Medium

WordPress Animator plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) Vulnerability
- Toast Plugins Animator
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54038 CVE record

CVSS 5.4 Medium

WordPress Restaurant Menu by MotoPress plugin <= 2.4.6 - Cross Site Request Forgery (CSRF) Vulnerability
- jetmonsters Restaurant Menu by MotoPress
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54036 CVE record

CVSS 4.3 Medium

WordPress Webba Booking plugin <= 5.1.20 - Cross Site Request Forgery (CSRF) Vulnerability
- Webba Appointment Booking Webba Booking
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54035 CVE record

CVSS 4.3 Medium

WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability
- Tribulant Software Newsletters
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54033 CVE record

CVSS 6.5 Medium

WordPress Theme Builder For Elementor plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) Vulnerability
- BlocksWP Theme Builder For Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54030 CVE record

CVSS 4.3 Medium

WordPress WooCommerce Google Sheet Connector plugin <= 1.3.20 - Cross Site Request Forgery (CSRF) Vulnerability
- WesternDeal WooCommerce Google Sheet Connector
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54022 CVE record

CVSS 6.5 Medium

WordPress Coupon Affiliates plugin <= 6.4.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Elliot Sowersby / RelyWP Coupon Affiliates
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54020 CVE record

CVSS 5.4 Medium

WordPress AntiSpam for Contact Form 7 plugin <= 0.6.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Erik AntiSpam for Contact Form 7
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-54010 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress FluentSnippets plugin <= 10.50 - Cross Site Request Forgery (CSRF) Vulnerability
- Shahjahan Jewel FluentSnippets
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2025
CVE-2025-50090 CVE record

CVSS 5.4 Medium

Cross-site request forgery in Oracle Corporation Oracle Applications Framework
- Oracle Corporation Oracle Applications Framework
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jul 2025
CVE-2025-30756 CVE record

CVSS 6.1 Medium

Cross-site request forgery in Oracle Corporation Oracle REST Data Services
- Oracle Corporation Oracle REST Data Services
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jul 2025
CVE-2025-30746 CVE record

CVSS 6.1 Medium

Cross-site request forgery in Oracle Corporation Oracle iStore
- Oracle Corporation Oracle iStore
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jul 2025
CVE-2025-30745 CVE record

CVSS 6.1 Medium

Cross-site request forgery in Oracle Corporation Oracle MES for Process Manufacturing
- Oracle Corporation Oracle MES for Process Manufacturing
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jul 2025
CVE-2025-7667 CVE record

CVSS 8.1 High

Restrict File Access <= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion
- josxha Restrict File Access
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jul 2025
CVE-2025-49462 CVE record

CVSS 3.5 Low

Zoom Clients - Cross-site Scripting
- Zoom Communications Inc. Zoom Clients
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jul 2025
CVE-2025-7379 CVE record

CVSS 5.2 Medium

A security bypass vulnerability was found in DataSync Center installed on ADM
- ASUSTOR ADM
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jul 2025
CVE-2025-53540 CVE record

CVSS 8.7 High

CSRF Vulnerability in Firmware Update Endpoints Allows Remote Code Execution
- espressif arduino-esp32
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jul 2025
CVE-2025-20322 CVE record

CVSS 4.3 Medium

Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise
- Splunk Enterprise
- Splunk Enterprise Cloud
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jul 2025
CVE-2025-20321 CVE record

CVSS 6.5 Medium

Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise
- Splunk Enterprise
- Splunk Enterprise Cloud
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jul 2025
CVE-2025-7133 CVE record

CVSS 5.3 Medium

CodeAstro Online Movie Ticket Booking System cross-site request forgery
- CodeAstro Online Movie Ticket Booking System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 7 Jul 2025
CVE-2025-7078 CVE record

CVSS 5.3 Medium

07FLYCMS/07FLY-CMS/07FlyCRM cross-site request forgery
- 07FLYCMS
- 07FLY-CMS
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 6 Jul 2025
CVE-2025-53483 CVE record

CVSS 8.8 High

SecurePoll: Multiple admin actions vulnerable to Cross-Site Request Forgery
- Wikimedia Foundation Mediawiki - SecurePoll extension
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jul 2025
CVE-2025-23972 CVE record

CVSS 4.3 Medium

WordPress Contact Form 7 reCAPTCHA plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Brian S. Reed Contact Form 7 reCAPTCHA
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jul 2025
CVE-2025-53569 CVE record

CVSS 4.3 Medium

WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability
- Trust Payments Gateway for WooCommerce (JavaScript Library)
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jul 2025
CVE-2025-53568 CVE record

CVSS 4.3 Medium

WordPress Radio Station plugin <= 2.5.12 - Cross Site Request Forgery (CSRF) Vulnerability
- Tony Zeoli Radio Station
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jul 2025
CVE-2025-5924 CVE record

CVSS 4.3 Medium

WP Firebase Push Notification <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification
- skywaveinfo WP Firebase Push Notification
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jul 2025
CVE-2025-6041 CVE record

CVSS 6.1 Medium

yContributors <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- yonisink yContributors
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jul 2025
CVE-2025-5933 CVE record

CVSS 4.3 Medium

RD Contacto <= 1.4 - Cross-Site Request Forgery to Settings Update
- richarddev7 RD Contacto
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jul 2025
CVE-2025-27454 CVE record

CVSS 4.3 Medium

CVE-2025-27454
- Endress+Hauser MEAC300-FNADE4
- Cross-site request forgery (CSRF)
Not analysed yet 3 Jul 2025
CVE-2025-52841 CVE record

CVSS 8.5 High

Laundry 2.3.0 - Account Takeover via CSRF
- Laundry
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jul 2025
CVE-2025-52463 CVE record

CVSS 2.1 Low

Cross-site request forgery in QUALITIA CO., LTD. Active! mail 6
- QUALITIA CO., LTD. Active! mail 6
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jul 2025
CVE-2025-6459 CVE record

CVSS 8.8 High

Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate
- scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jul 2025
CVE-2025-34050 CVE record

CVSS 5.1 Medium

AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery
- AVTECH IP cameras
- AVTECH DVR devices
- Cross-site request forgery (CSRF)
Not analysed yet 1 Jul 2025
CVE-2025-53095 CVE record

CVSS 9.7 CriticalCritical · CVSS 9+

Sunshine application-wide CSRF in the UI leads to command injection as Administrator
- LizardByte Sunshine
- Cross-site request forgery (CSRF)
Not analysed yet 1 Jul 2025
CVE-2025-24289 CVE record

CVSS 7.5 High

Cross-site request forgery in Ubiquiti Inc UCRM Client Signup Plugin
- Ubiquiti Inc UCRM Client Signup Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 29 Jun 2025
CVE-2025-6865 CVE record

CVSS 5.3 Medium

DaiCuo index cross-site request forgery
- DaiCuo
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 29 Jun 2025
CVE-2025-6864 CVE record

CVSS 5.3 Medium

SeaCMS admin_type.php cross-site request forgery
- SeaCMS
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 29 Jun 2025
CVE-2025-5937 CVE record

CVSS 4.3 Medium

MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset
- videowhisper MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
- Cross-site request forgery (CSRF)
Not analysed yet 28 Jun 2025
CVE-2025-53338 CVE record

CVSS 7.1 High

WordPress re.place plugin <= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerability
- dor re.place
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53332 CVE record

CVSS 7.1 High

WordPress Track Everything plugin <= 2.0.1 - Cross Site Request Forgery (CSRF) Vulnerability
- ethoseo Track Everything
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53331 CVE record

CVSS 7.1 High

WordPress RSS Digest plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability
- samcharrington RSS Digest
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53329 CVE record

CVSS 7.1 High

WordPress Społecznościowa 6 PL 2013 plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability
- szajenw Społecznościowa 6 PL 2013
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53327 CVE record

CVSS 4.3 Medium

WordPress Aioseo Multibyte Descriptions plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability
- rui_mashita Aioseo Multibyte Descriptions
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53317 CVE record

CVSS 7.1 High

WordPress WPShapere Lite plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) Vulnerability
- AcmeeDesign WPShapere - WordPress admin theme
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53315 CVE record

CVSS 7.1 High

WordPress Relocate Upload plugin <= 0.24.1 - Cross Site Request Forgery (CSRF) Vulnerability
- alanft Relocate Upload
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53314 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress WP Optimizer plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerability
- sh1zen WP Optimizer
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53313 CVE record

CVSS 7.1 High

WordPress Twitch TV Embed Suite plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- plumwd Twitch TV Embed Suite
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025
CVE-2025-53312 CVE record

CVSS 7.1 High

WordPress OnionBuzz plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability
- Looks Awesome OnionBuzz
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jun 2025