Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-58831 CVE record

CVSS 4.3 Medium

WordPress Parallax Scrolling Enllax.js Plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability
- snagysandor Parallax Scrolling Enllax.js
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58818 CVE record

CVSS 5.4 Medium

WordPress Developer Tools Blocker Plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability
- SwiftNinjaPro Developer Tools Blocker
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58809 CVE record

CVSS 7.1 High

WordPress To Lead For Salesforce Plugin <= 2.7.3.9 - Cross Site Request Forgery (CSRF) Vulnerability
- Nick Ciske To Lead For Salesforce
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58807 CVE record

CVSS 7.1 High

WordPress Purge Varnish Cache Plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability
- Dsingh Purge Varnish Cache
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58806 CVE record

CVSS 7.1 High

WordPress WordPress Error Monitoring by Bugsnag Plugin <= 1.6.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Tom Longridge WordPress Error Monitoring by Bugsnag
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58804 CVE record

CVSS 4.3 Medium

WordPress WooCommerce Single Page Checkout Plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) Vulnerability
- brijrajs WooCommerce Single Page Checkout
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58802 CVE record

CVSS 4.3 Medium

WordPress TrustMate.io – WooCommerce integration plugin <= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerability
- michalzagdan TrustMate.io – WooCommerce integration
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58801 CVE record

CVSS 5.4 Medium

WordPress Responder Plugin <= 4.3.8 - Cross Site Request Forgery (CSRF) Vulnerability
- KCS Responder
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58800 CVE record

CVSS 4.3 Medium

WordPress WP Email Template plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) vulnerability
- Steve Truman WP Email Template
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58799 CVE record

CVSS 4.3 Medium

WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability
- themelocation Custom WooCommerce Checkout Fields Editor
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58798 CVE record

CVSS 4.3 Medium

WordPress BCM Duplicate Menu plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability
- Bjorn Manintveld BCM Duplicate Menu
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58794 CVE record

CVSS 4.3 Medium

WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability
- rainafarai Notification for Telegram
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58792 CVE record

CVSS 4.3 Medium

WordPress Authors List plugin <= 2.0.6.2 - Cross Site Request Forgery (CSRF) vulnerability
- WPKube Authors List
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-9616 CVE record

CVSS 5.3 Medium

PopAd <= 1.0.4 - Cross-Site Request Forgery to Settings Update
- alobaidi PopAd
- Cross-site request forgery (CSRF)
Not analysed yet 4 Sept 2025
CVE-2025-20326 CVE record

CVSS 4.3 Medium

Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability
- Cisco Unified Communications Manager
- Cross-site request forgery (CSRF)
Not analysed yet 3 Sept 2025
CVE-2025-58611 CVE record

CVSS 4.3 Medium

WordPress Tickera Plugin <= 3.5.5.6 - Cross Site Request Forgery (CSRF) Vulnerability
- Tickera
- Cross-site request forgery (CSRF)
Not analysed yet 3 Sept 2025
CVE-2025-58272 CVE record

CVSS 2.0 Low

Cross-site request forgery in NTT EAST, Inc. Web Caster V130 and others
- NTT EAST, Inc. Web Caster V130
- NTT WEST, Inc. Web Caster V130
- Cross-site request forgery (CSRF)
Not analysed yet 3 Sept 2025
CVE-2025-0610 CVE record

CVSS 8.6 High

CSRF in Akinsoft's QR Menu
- Akınsoft QR Menü
- Cross-site request forgery (CSRF)
Not analysed yet 1 Sept 2025
CVE-2025-9747 CVE record

CVSS 5.3 Medium

Koillection csrf_protection_controller.js cross-site request forgery
- Koillection
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 31 Aug 2025
CVE-2025-9618 CVE record

CVSS 4.3 Medium

Related Posts Lite <= 1.12 - Cross-Site Request Forgery
- wpdreams Related Posts Lite
- Cross-site request forgery (CSRF)
Not analysed yet 30 Aug 2025
github.com/gorilla/csrf Go

CVSS 7.3 High

github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks
- Cross-site request forgery (CSRF)
- CWE-346
<=1.7.3 · no fixed version yet

GHSA-82ff-hg59-8x73 · CVE-2025-47909 Not analysed yet 29 Aug 2025
CVE-2025-9374 CVE record

CVSS 4.3 Medium

Ultimate Tag Warrior Importer <= 0.2 - Cross-Site Request Forgery
- briancolinger Ultimate Tag Warrior Importer
- Cross-site request forgery (CSRF)
Not analysed yet 29 Aug 2025
CVE-2025-48363 CVE record

CVSS 4.3 Medium

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability
- Metin Saraç Popup for CF7 with Sweet Alert
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48362 CVE record

CVSS 5.4 Medium

WordPress Hesabfa Accounting plugin <= 2.2.5 - Cross Site Request Forgery (CSRF) vulnerability
- Saeed Sattar Beglou Hesabfa Accounting
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48359 CVE record

CVSS 7.1 High

WordPress ATT YouTube Widget plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- thaihavnn07 ATT YouTube Widget
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48357 CVE record

CVSS 5.4 Medium

WordPress Century ToolKit plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Activation vulnerability
- Theme Century Century ToolKit
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48353 CVE record

CVSS 7.1 High

WordPress Clickbank WordPress Plugin (Niche Storefront) plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- dactum Clickbank WordPress Plugin (Niche Storefront)
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48351 CVE record

CVSS 7.1 High

WordPress Kento Splash Screen plugin <= 1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- PluginsPoint Kento Splash Screen
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48343 CVE record

CVSS 7.1 High

WordPress WPMU Ldap Authentication plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- Aaron Axelsen WPMU Ldap Authentication
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48325 CVE record

CVSS 7.1 High

WordPress WP Admin Theme plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- shmish111 WP Admin Theme
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48321 CVE record

CVSS 7.1 High

WordPress Ultimate twitter profile widget plugin <= 1.0 - CSRF to Stored XSS vulnerability
- dyiosah Ultimate twitter profile widget
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48320 CVE record

CVSS 7.1 High

WordPress 百度分享按钮 plugin <= 1.0.6 - CSRF to Stored XSS vulnerability
- cuckoohello 百度分享按钮
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48318 CVE record

CVSS 4.3 Medium

WordPress 多说社会化评论框 plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
- shen2 多说社会化评论框
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48311 CVE record

CVSS 7.1 High

WordPress Invisible Optin plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- OffClicks Invisible Optin
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48310 CVE record

CVSS 4.3 Medium

WordPress Table Editor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability
- wptableeditor Table Editor
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48309 CVE record

CVSS 7.1 High

WordPress BetPress plugin <= 1.0.1 Lite - CSRF to Stored XSS vulnerability
- web-able BetPress
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48308 CVE record

CVSS 7.1 High

WordPress Newsletter subscription optin module plugin <= 1.2.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- nonletter Newsletter subscription optin module
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48307 CVE record

CVSS 7.1 High

WordPress SEO For Images plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- kasonzhao SEO For Images
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48306 CVE record

CVSS 7.1 High

WordPress Savyour Affiliate Partner plugin <= 2.1.4 - CSRF to Stored XSS vulnerability
- developers savyour Savyour Affiliate Partner
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48304 CVE record

CVSS 7.1 High

WordPress Google XML News Sitemap plugin plugin <= 0.02 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- Gary Illyes Google XML News Sitemap plugin
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-48109 CVE record

CVSS 7.1 High

WordPress XM-Backup plugin <= 0.9.1 - CSRF to Stored XSS vulnerability
- Xavier Media XM-Backup
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-54541 CVE record

CVSS 6.9 Medium

Cross-Site Request Forgery in QuickCMS
- OpenSolution QuickCMS
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-7812 CVE record

CVSS 8.8 High

Video Share VOD – Turnkey Video Site Builder Script <= 2.7.6 - Cross-Site Request Forgery to Command Injection
- videowhisper Video Share VOD – Turnkey Video Site Builder Script
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2025
CVE-2025-58217 CVE record

CVSS 7.1 High

WordPress Instant Breaking News Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- GeroNikolov Instant Breaking News
- Cross-site request forgery (CSRF)
Not analysed yet 27 Aug 2025
CVE-2025-58202 CVE record

CVSS 4.3 Medium

WordPress Simple Page Access Restriction Plugin <= 1.0.32 - Cross Site Request Forgery (CSRF) Vulnerability
- Plugins and Snippets Simple Page Access Restriction
- Cross-site request forgery (CSRF)
Not analysed yet 27 Aug 2025
CVE-2025-49040 CVE record

CVSS 4.3 Medium

WordPress Backup Bolt plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability
- Backup Bolt
- Cross-site request forgery (CSRF)
Not analysed yet 27 Aug 2025
CVE-2025-54598 CVE record

CVSS 6.5 Medium

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via the /notifications/delete/ URI.
- Cross-site request forgery (CSRF)
Not analysed yet 27 Aug 2025
CVE-2025-48303 CVE record

CVSS 4.3 Medium

WordPress Post Type Converter plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerability
- Kevin Langley Jr. Post Type Converter
- Cross-site request forgery (CSRF)
Not analysed yet 25 Aug 2025
CVE-2025-7841 CVE record

CVSS 4.3 Medium

Sertifier Certificate & Badge Maker for WordPress – Tutor LMS <= 1.19 - Cross-Site Request Forgery to Settings Update
- Sertifier Certificate & Badge Maker for WordPress – Tutor LMS
- Cross-site request forgery (CSRF)
Not analysed yet 23 Aug 2025
CVE-2025-7839 CVE record

CVSS 4.3 Medium

Restore Permanently delete Post or Page Data <= 1.0 - Cross-Site Request Forgery
- pokornydavid Restore Permanently delete Post or Page Data
- Cross-site request forgery (CSRF)
Not analysed yet 23 Aug 2025
CVE-2025-7842 CVE record

CVSS 4.3 Medium

Silencesoft RSS Reader <= 0.6 - Cross-Site Request Forgery to RSS Feed Deletion
- Silencesoft RSS Reader
- Cross-site request forgery (CSRF)
Not analysed yet 23 Aug 2025
CVE-2025-57895 CVE record

CVSS 4.3 Medium

WordPress JobWP Plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Hossni Mubarak JobWP
- Cross-site request forgery (CSRF)
Not analysed yet 22 Aug 2025
CVE-2025-57893 CVE record

CVSS 4.3 Medium

WordPress WP Fast Total Search Plugin <= 1.79.270 - Cross Site Request Forgery (CSRF) Vulnerability
- Epsiloncool WP Fast Total Search
- Cross-site request forgery (CSRF)
Not analysed yet 22 Aug 2025
CVE-2025-57892 CVE record

CVSS 4.3 Medium

WordPress Simple Statistics for Feeds Plugin <= 20250322 - Cross Site Request Forgery (CSRF) Vulnerability
- Jeff Starr Simple Statistics for Feeds
- Cross-site request forgery (CSRF)
Not analysed yet 22 Aug 2025
CVE-2025-57885 CVE record

CVSS 4.3 Medium

WordPress Fluent Support Plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Shahjahan Jewel Fluent Support
- Cross-site request forgery (CSRF)
Not analysed yet 22 Aug 2025
unopim/unopim Packagist

CVSS 6.9 Medium

UnoPim vulnerable to CSRF on Product edit feature and creation of other types
- Cross-site request forgery (CSRF)
<0.2.1 · fixed in 0.2.1

GHSA-287x-6r2h-f9mw · CVE-2025-55744 Not analysed yet 21 Aug 2025
CVE-2025-8592 CVE record

CVSS 8.1 High

Inspiro <= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation
- wpzoom Inspiro
- Cross-site request forgery (CSRF)
Not analysed yet 21 Aug 2025
com.liferay.portal:release.portal.bom Maven

CVSS 7.1 High

Liferay Portal Vulnerable to Cross-Site Request Forgery
- Cross-site request forgery (CSRF)
>=7.0.0-a1, <7.4.3.120-ga120 · fixed in 7.4.3.120-ga120

GHSA-p9gc-59hf-x48p · CVE-2025-43748 Not analysed yet 20 Aug 2025
CVE-2025-54174 CVE record

CVSS 5.1 Medium

Cross-Site Request Forgery in QuickCMS
- OpenSolution Quick.CMS
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2025
CVE-2025-8102 CVE record

CVSS 5.4 Medium

Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2025