Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-49381 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress ads.txt Guru Connect Plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- ads.txt Guru Connect
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2025
CVE-2025-49382 CVE record

CVSS 8.8 High

WordPress JobZilla - Job Board WordPress Theme Theme <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability
- DexignZone JobZilla - Job Board WordPress Theme
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2025
CVE-2025-49391 CVE record

CVSS 4.3 Medium

WordPress Sign-up Sheets Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Fetch Designs Sign-up Sheets
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2025
CVE-2025-49399 CVE record

CVSS 8.8 High

WordPress NEX-Forms Plugin <= 9.1.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Basix NEX-Forms
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2025
CVE-2025-49896 CVE record

CVSS 5.3 Medium

WordPress WP Discord Post Plus – Supports Unlimited Channels plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability
- wptasker WP Discord Post Plus – Supports Unlimited Channels
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2025
CVE-2025-54052 CVE record

CVSS 7.5 High

WordPress Realtyna Organic IDX plugin <= 5.0.0 - Local File Inclusion Vulnerability
- Realtyna Organic IDX plugin
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2025
CVE-2025-50902 CVE record

CVSS 8.8 High

Cross Site Request Forgery (CSRF) vulnerability in old-peanut Open-Shop (aka old-peanut/wechat_applet__open_source) thru 1.0.0 allows attackers to gain sensitive information via crafted HTTP Post mes…
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2025
com.liferay.portal:release.portal.bom Maven

CVSS 6.9 Medium

Liferay Portal CSRF Vulnerability via Endpoint Parameter
- Cross-site request forgery (CSRF)
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet

GHSA-7q33-gwcm-r6cj · CVE-2025-43745 Not analysed yet 19 Aug 2025
CVE-2025-7686 CVE record

CVSS 6.1 Medium

weichuncai(WP伪春菜) <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- lmyoaoa weichuncai(WP伪春菜)
- Cross-site request forgery (CSRF)
Not analysed yet 16 Aug 2025
CVE-2025-7683 CVE record

CVSS 6.1 Medium

LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- janyksteenbeek LatestCheckins
- Cross-site request forgery (CSRF)
Not analysed yet 16 Aug 2025
CVE-2025-7668 CVE record

CVSS 6.1 Medium

Linux Promotional Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- timothyja Linux Promotional Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 16 Aug 2025
CVE-2025-7684 CVE record

CVSS 6.1 Medium

Last.fm Recent Album Artwork <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- remysharp Last.fm Recent Album Artwork
- Cross-site request forgery (CSRF)
Not analysed yet 16 Aug 2025
CVE-2025-49895 CVE record

CVSS 6.5 Medium

WordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerability
- iThemes ServerBuddy by PluginBuddy.com
- Cross-site request forgery (CSRF)
Not analysed yet 16 Aug 2025
CVE-2025-7688 CVE record

CVSS 6.1 Medium

Add User Meta <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- jason-lau Add User Meta
- Cross-site request forgery (CSRF)
Not analysed yet 15 Aug 2025
CVE-2025-8992 CVE record

CVSS 5.3 Medium

mtons mblog cross-site request forgery
- mtons mblog
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 15 Aug 2025
CVE-2025-52765 CVE record

CVSS 7.1 High

WordPress NetInsight Analytics Implementation Plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability
- lisensee NetInsight Analytics Implementation Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-52767 CVE record

CVSS 4.3 Medium

WordPress NetInsight Analytics Implementation Plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability
- lisensee NetInsight Analytics Implementation Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-52769 CVE record

CVSS 4.3 Medium

WordPress flexo-social-gallery Plugin <= 1.0006 - Cross Site Request Forgery (CSRF) Vulnerability
- flexostudio flexo-social-gallery
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-52797 CVE record

CVSS 8.2 High

WordPress StoryMap Plugin <= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability
- josepsitjar StoryMap
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-53219 CVE record

CVSS 5.4 Medium

WordPress WP-Database-Optimizer-Tools Plugin <= 0.2 - Cross Site Request Forgery (CSRF) Vulnerability
- pl4g4 WP-Database-Optimizer-Tools
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-53249 CVE record

CVSS 6.5 Medium

WordPress Build App Online Plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) Vulnerability
- hakeemnala Build App Online
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-53347 CVE record

CVSS 4.3 Medium

WordPress Kalium Theme <= 3.18.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Laborator Kalium
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-53587 CVE record

CVSS 8.8 High

WordPress Findgo Theme <= 1.3.57 - Cross Site Request Forgery (CSRF) Vulnerability
- ApusTheme Findgo
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54728 CVE record

CVSS 4.3 Medium

WordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) Vulnerability
- CreativeMindsSolutions CM On Demand Search And Replace
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54732 CVE record

CVSS 4.3 Medium

WordPress WPDM – Premium Packages Plugin <= 6.0.2 - Cross Site Request Forgery (CSRF) Vulnerability
- Shahjada WPDM – Premium Packages
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54703 CVE record

CVSS 4.3 Medium

WordPress Integrate Google Drive plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) vulnerability
- princeahmed Integrate Google Drive
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54702 CVE record

CVSS 4.3 Medium

WordPress Ebook Store Plugin plugin <= 5.8013 - Cross Site Request Forgery (CSRF) Vulnerability
- motov.net Ebook Store
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54694 CVE record

CVSS 4.3 Medium

WordPress Button Block Plugin plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability
- bPlugins Button Block
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54682 CVE record

CVSS 5.4 Medium

WordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Cross Site Request Forgery (CSRF) Vulnerability
- CRM Perks Connector for Gravity Forms and Google Sheets
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54675 CVE record

CVSS 4.3 Medium

WordPress YITH WooCommerce Popup Plugin plugin <= 1.48.0 - Cross Site Request Forgery (CSRF) Vulnerability
- YITHEMES YITH WooCommerce Popup
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54674 CVE record

CVSS 5.4 Medium

WordPress Product Configurator for WooCommerce Plugin plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability
- mklacroix Product Configurator for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54673 CVE record

CVSS 4.3 Medium

WordPress Chartify plugin <= 3.5.3 - Cross Site Request Forgery (CSRF) vulnerability
- Ays Pro Chartify
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54672 CVE record

CVSS 4.3 Medium

WordPress Photo Engine Plugin plugin <= 6.4.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Jordy Meow Photo Engine
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-54671 CVE record

CVSS 4.3 Medium

WordPress oik plugin <= 4.15.2 - Cross Site Request Forgery (CSRF) vulnerability
- bobbingwide oik
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-49044 CVE record

CVSS 7.1 High

WordPress Simple Poll plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- tosend.it Simple Poll
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2024-53946 CVE record

CVSS 8.8 High

The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface.
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2025
CVE-2025-8491 CVE record

CVSS 4.3 Medium

Easy restaurant menu manager <= 2.0.2 - Cross-Site Request Forgery to Menu Upload
- nikelschubert Easy restaurant menu manager
- Cross-site request forgery (CSRF)
Not analysed yet 13 Aug 2025
CVE-2025-8891 CVE record

CVSS 4.3 Medium

OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation
- OceanWP
- Cross-site request forgery (CSRF)
Not analysed yet 13 Aug 2025
magento/community-edition +1 Packagist

CVSS 8.1 High

Magento Cross-Site Request Forgery (CSRF) vulnerability
- Cross-site request forgery (CSRF)
<2.4.5-p14 || >=2.4.6-p1, <2.4.6-p12 || >=2.4.7-beta1, <2.4.7-p7 || >=2.4.8-beta1, <2.4.8-p2 || >=2.4.9-alpha1, <2.4.9-alpha2 · fixed in 2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9-alpha2

GHSA-5777-jj7p-mpqw · CVE-2025-49555 Not analysed yet 12 Aug 2025
CVE-2025-7965 CVE record

CVSS 4.3 Medium

CBX Restaurant Booking <= 1.2.1 - Plugin Reset via CSRF
- CBX Restaurant Booking
- Cross-site request forgery (CSRF)
Not analysed yet 11 Aug 2025
CVE-2025-8814 CVE record

CVSS 5.3 Medium

atjiu pybbs CookieUtil.java setCookie cross-site request forgery
- atjiu pybbs
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 10 Aug 2025
CVE-2025-8739 CVE record

CVSS 5.3 Medium

zhenfeng13 My-Blog save cross-site request forgery
- zhenfeng13 My-Blog
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 8 Aug 2025
CVE-2020-9322 CVE record

CVSS 8.8 High

The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user.
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 8 Aug 2025
CVE-2025-7202 CVE record

CVSS 5.1 Medium

Cross-Site Request Forgery (CSRF) allowed remote control of Elgato Key Lights
- Elgato Key Light
- Elgato Key Light Air
- Cross-site request forgery (CSRF)
Not analysed yet 6 Aug 2025
CVE-2025-5988 CVE record

CVSS 5.3 Medium

Aap-gateway: csrf origin checking is disabled
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Cross-site request forgery (CSRF)
Not analysed yet 4 Aug 2025
CVE-2025-8505 CVE record

CVSS 5.3 Medium

495300897 wx-shop cross-site request forgery
- 495300897 wx-shop
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 3 Aug 2025
@nestjs/devtools-integration npm

CVSS 9.4 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers
- Command injection
- Cross-site request forgery (CSRF)
<0.2.1 · fixed in 0.2.1

GHSA-85cg-cmq5-qjm7 · CVE-2025-54782 Not analysed yet 1 Aug 2025
CVE-2025-50847 CVE record

CVSS 6.5 Medium

Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafted HTTP request.
- Cross-site request forgery (CSRF)
Not analysed yet 31 Jul 2025
CVE-2025-8335 CVE record

CVSS 5.3 Medium

code-projects Simple Car Rental System cross-site request forgery
- code-projects Simple Car Rental System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 30 Jul 2025
CVE-2025-54536 CVE record

CVSS 5.4 Medium

Cross-site request forgery in JetBrains TeamCity
- JetBrains TeamCity
- Cross-site request forgery (CSRF)
Not analysed yet 28 Jul 2025
CVE-2025-54529 CVE record

CVSS 3.7 Low

Cross-site request forgery in JetBrains TeamCity
- JetBrains TeamCity
- Cross-site request forgery (CSRF)
Not analysed yet 28 Jul 2025
CVE-2025-54528 CVE record

CVSS 5.4 Medium

Cross-site request forgery in JetBrains TeamCity
- JetBrains TeamCity
- Cross-site request forgery (CSRF)
Not analysed yet 28 Jul 2025
CVE-2025-8223 CVE record

CVSS 5.3 Medium

jerryshensjf JPACookieShop 蛋糕商城JPA版 AdminTypeCustController.java cross-site request forgery
- jerryshensjf JPACookieShop 蛋糕商城JPA版
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 27 Jul 2025
CVE-2025-8104 CVE record

CVSS 4.3 Medium

Memory Usage <= 3.98 - Cross-Site Request Forgery to Limited Plugin Installation via wpmemory_install_plugin Function
- sminozzi Memory Usage, Memory Limit, PHP and Server Memory Health Check and Provide Suggestions
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jul 2025
CVE-2025-8103 CVE record

CVSS 4.3 Medium

WPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function
- etruel WPeMatico RSS Feed Fetcher
- Cross-site request forgery (CSRF)
Not analysed yet 26 Jul 2025
CVE-2025-36728 CVE record

CVSS 6.3 Medium

SimpleHelp Cross Site Request Forgery
- Simplehelp
- Cross-site request forgery (CSRF)
Not analysed yet 25 Jul 2025
CVE-2025-7690 CVE record

CVSS 6.1 Medium

Affiliate Plus <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- mindnl Affiliate Plus
- Cross-site request forgery (CSRF)
Not analysed yet 24 Jul 2025
CVE-2025-7835 CVE record

CVSS 4.3 Medium

iThoughts Advanced Code Editor <= 1.2.10 - Cross-Site Request Forgery to Settings Update
- gerkin iThoughts Advanced Code Editor
- Cross-site request forgery (CSRF)
Not analysed yet 24 Jul 2025
CVE-2025-6214 CVE record

CVSS 6.5 Medium

Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint
- Omnishop – Mobile shop apps complementing your WooCommerce webshop
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2025
CVE-2025-6054 CVE record

CVSS 6.1 Medium

YANewsflash <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- stratosg YANewsflash
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2025