Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-60169 CVE record

CVSS 7.1 High

WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 3.2 - Cross Site Request Forgery (CSRF) vulnerability
- W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60164 CVE record

CVSS 7.1 High

WordPress NewsmanApp plugin <= 2.7.7 - Cross Site Request Forgery (CSRF) vulnerability
- NewsmanApp
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60156 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability
- webandprint AR For WordPress
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60145 CVE record

CVSS 4.3 Medium

WordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Request Forgery (CSRF) Vulnerability
- yonifre Lenix scss compiler
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60139 CVE record

CVSS 4.3 Medium

WordPress Sendle Shipping plugin <= 6.02 - Cross Site Request Forgery (CSRF) vulnerability
- Joovii Sendle Shipping
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60137 CVE record

CVSS 4.3 Medium

WordPress Post Featured Video Plugin <= 1.7 - Cross Site Request Forgery (CSRF) Vulnerability
- Galaxy Weblinks Post Featured Video
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60117 CVE record

CVSS 4.3 Medium

WordPress Vehica Core Plugin <= 1.0.100 - Cross Site Request Forgery (CSRF) Vulnerability
- TangibleWP Vehica Core
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60115 CVE record

CVSS 4.3 Medium

WordPress Instapage plugin plugin <= 3.7.0 - Cross Site Request Forgery (CSRF) vulnerability
- instapagedev Instapage Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60113 CVE record

CVSS 4.3 Medium

WordPress Groovy Menu Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability
- grooni Groovy Menu
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60111 CVE record

CVSS 8.8 High

WordPress Javo Core Plugin <= 3.0.0.266 - Cross Site Request Forgery (CSRF) Vulnerability
- javothemes Javo Core
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60093 CVE record

CVSS 4.3 Medium

WordPress Download Manager Plugin <= 3.3.24 - Cross Site Request Forgery (CSRF) Vulnerability
- Shahjada Download Manager
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-58914 CVE record

CVSS 4.3 Medium

WordPress Di Themes Demo Site Importer plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Plugin Activation vulnerability
- Di Themes Demo Site Importer
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-10377 CVE record

CVSS 4.3 Medium

System Dashboard <= 2.8.20 - Cross-Site Request Forgery
- qriouslad System Dashboard
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-10752 CVE record

CVSS 4.3 Medium

OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery
- cyberlord92 OAuth Single Sign On – SSO (OAuth Client)
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-56311 CVE record

CVSS 6.5 Medium

In Shenzhen C-Data Technology Co.
- Cross-site request forgery (CSRF)
Not analysed yet 23 Sept 2025
CVE-2025-58956 CVE record

CVSS 7.1 High

WordPress WP Attractive Donations System Plugin < 1.29 - Cross Site Request Forgery (CSRF) Vulnerability
- loopus WP Attractive Donations System
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-59568 CVE record

CVSS 4.3 Medium

WordPress Zoho Flow Plugin <= 2.14.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Zoho Flow
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-59572 CVE record

CVSS 8.8 High

WordPress WorkScout-Core Plugin < 1.7.06 - Cross Site Request Forgery (CSRF) Vulnerability
- purethemes WorkScout-Core
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-53451 CVE record

CVSS 5.4 Medium

WordPress Mihdan: No External Links Plugin <= 5.1.6.2 - Cross Site Request Forgery (CSRF) Vulnerability
- Mihdan: No External Links
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-53456 CVE record

CVSS 4.3 Medium

WordPress SEO Backlink Monitor plugin <= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability
- activewebsight SEO Backlink Monitor
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57902 CVE record

CVSS 6.5 Medium

WordPress RIS Version Switcher – Downgrade or Upgrade WP Versions Easily Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Md Taufiqur Rahman RIS Version Switcher – Downgrade or Upgrade WP Versions Easily
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57905 CVE record

CVSS 4.3 Medium

WordPress AgreeMe Checkboxes For WooCommerce Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Amin Y AgreeMe Checkboxes For WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57914 CVE record

CVSS 4.3 Medium

WordPress Deliver via Shipos for WooCommerce plugin <= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerability
- Matat Technologies Deliver via Shipos for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57915 CVE record

CVSS 4.3 Medium

WordPress TOCHAT.BE Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability
- César Martín TOCHAT.BE
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57918 CVE record

CVSS 7.1 High

WordPress LinkedInclude Plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) Vulnerability
- ERA404 LinkedInclude
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57924 CVE record

CVSS 4.3 Medium

WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability
- Automattic Developer
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57927 CVE record

CVSS 4.3 Medium

WordPress Dashboard Notepad Plugin <= 1.42 - Cross Site Request Forgery (CSRF) Vulnerability
- Stephanie Leary Dashboard Notepad
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57930 CVE record

CVSS 4.3 Medium

WordPress Double the Donation Plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) Vulnerability
- kanwei_doublethedonation Double the Donation
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57933 CVE record

CVSS 4.3 Medium

WordPress Piotnet Forms Plugin <= 1.0.30 - Cross Site Request Forgery (CSRF) Vulnerability
- piotnetdotcom Piotnet Forms
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57934 CVE record

CVSS 4.3 Medium

WordPress LWS Affiliation Plugin <= 2.3.6 - Cross Site Request Forgery (CSRF) Vulnerability
- Aurélien LWS LWS Affiliation
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57942 CVE record

CVSS 4.3 Medium

WordPress Emergency Password Reset plugin <= 9.3 - Cross Site Request Forgery (CSRF) vulnerability
- andy_moyle Emergency Password Reset
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57946 CVE record

CVSS 5.4 Medium

WordPress payOS plugin <= 1.0.73 - Cross Site Request Forgery (CSRF) vulnerability
- Loc Bui payOS
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57960 CVE record

CVSS 4.3 Medium

WordPress Travel Map Plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability
- TravelMap Travel Map
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57970 CVE record

CVSS 4.3 Medium

WordPress SALESmanago Plugin <= 3.8.1 - Cross Site Request Forgery (CSRF) Vulnerability
- SALESmanago & Leadoo
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57977 CVE record

CVSS 7.1 High

WordPress Flexible PDF Invoices for WooCommerce & WordPress Plugin <= 6.0.13 - Cross Site Request Forgery (CSRF) Vulnerability
- wpdesk Flexible PDF Invoices for WooCommerce & WordPress
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57978 CVE record

CVSS 4.3 Medium

WordPress Advanced Appointment Booking & Scheduling plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability
- themespride Advanced Appointment Booking & Scheduling
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57983 CVE record

CVSS 6.5 Medium

WordPress BP Disable Activation Reloaded Plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Damian BP Disable Activation Reloaded
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-57992 CVE record

CVSS 4.3 Medium

WordPress Mail Baby SMTP plugin <= 2.8 - Cross Site Request Forgery (CSRF) vulnerability
- InterServer Mail Baby SMTP
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58010 CVE record

CVSS 4.3 Medium

WordPress SV Proven Expert Plugin <= 2.0.06 - Cross Site Request Forgery (CSRF) Vulnerability
- straightvisions GmbH SV Proven Expert
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58013 CVE record

CVSS 8.8 High

WordPress CouponXxL Theme <= 4.5.0 - Cross Site Request Forgery (CSRF) Vulnerability
- pebas CouponXxL
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58014 CVE record

CVSS 4.3 Medium

WordPress Quiz Maker Plugin <= 6.7.0.64 - Cross Site Request Forgery (CSRF) Vulnerability
- Ays Pro Quiz Maker
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58032 CVE record

CVSS 4.3 Medium

WordPress WP Compiler Plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Bytes.co WP Compiler
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58199 CVE record

CVSS 4.3 Medium

WordPress Fastly plugin <= 1.2.28 - Cross Site Request Forgery (CSRF) vulnerability
- Fastly
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58200 CVE record

CVSS 4.3 Medium

WordPress Flexible FAQ Plugin <= 0.2 - Cross Site Request Forgery (CSRF) Vulnerability
- Bage Flexible FAQ
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58219 CVE record

CVSS 4.3 Medium

WordPress Show Pages List Plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability
- LIJE Show Pages List
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58224 CVE record

CVSS 5.4 Medium

WordPress Printeers Print & Ship Plugin <= 1.17.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Printeers Print & Ship
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58236 CVE record

CVSS 4.3 Medium

WordPress Force Update Translations plugin <= 0.5 - Cross Site Request Forgery (CSRF) vulnerability
- Mayo Moriyama Force Update Translations
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58244 CVE record

CVSS 8.8 High

WordPress Constructo Theme <= 4.3.9 - Cross Site Request Forgery (CSRF) Vulnerability
- Anps Constructo
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58250 CVE record

CVSS 8.8 High

WordPress Findgo Theme <= 1.3.55 - Cross Site Request Forgery (CSRF) Vulnerability
- ApusTheme Findgo
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58255 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Custom Post Type Images Plugin <= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability
- yonisink Custom Post Type Images
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58259 CVE record

CVSS 7.1 High

WordPress Nokri Theme <= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerability
- scriptsbundle Nokri
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58261 CVE record

CVSS 7.1 High

WordPress Mavis HTTPS to HTTP Redirection Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability
- PressPage Entertainment Inc Mavis HTTPS to HTTP Redirection
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58262 CVE record

CVSS 7.1 High

WordPress Sweet Energy Efficiency plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability
- WPDirectoryKit Sweet Energy Efficiency
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58267 CVE record

CVSS 7.1 High

WordPress Stock Message Plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Aftabul Islam Stock Message
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58268 CVE record

CVSS 7.1 High

WordPress WPMK PDF Generator Plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) Vulnerability
- WPMK PDF Generator
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58270 CVE record

CVSS 7.1 High

WordPress NIX Anti-Spam Light Plugin <= 0.0.4 - Cross Site Request Forgery (CSRF) Vulnerability
- NIX Solutions Ltd NIX Anti-Spam Light
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58657 CVE record

CVSS 7.1 High

WordPress Grid plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- EdwardBock Grid
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58670 CVE record

CVSS 7.1 High

WordPress WP Content Protection Plugin <= 1.3 - Cross Site Request Forgery (CSRF) Vulnerability
- Shankaranand Maurya WP Content Protection
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58675 CVE record

CVSS 4.3 Medium

WordPress Interact: Embed A Quiz On Your Site Plugin <= 3.1 - Cross Site Request Forgery (CSRF) Vulnerability
- tryinteract Interact: Embed A Quiz On Your Site
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58676 CVE record

CVSS 7.1 High

WordPress HORIZONTAL SLIDER Plugin <= 2.4 - Cross Site Request Forgery (CSRF) Vulnerability
- extendyourweb HORIZONTAL SLIDER
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025