Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-58677 CVE record

CVSS 7.1 High

WordPress ShrinkTheWeb (STW) Website Previews Plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) Vulnerability
- puravida1976 ShrinkTheWeb (STW) Website Previews
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58687 CVE record

CVSS 7.1 High

WordPress Current Age Plugin Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability
- WP CMS Ninja Current Age Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58688 CVE record

CVSS 7.1 High

WordPress Casengo Live Chat Support Plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) Vulnerability
- Casengo Live Chat Support
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-58690 CVE record

CVSS 7.1 High

WordPress Doliconnect Plugin <= 9.5.7 - Cross Site Request Forgery (CSRF) Vulnerability
- ptibogxiv Doliconnect
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2025
CVE-2025-9887 CVE record

CVSS 4.3 Medium

Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery
- bittokazi Custom Login And Signup Widget
- Cross-site request forgery (CSRF)
Not analysed yet 20 Sept 2025
CVE-2025-9883 CVE record

CVSS 6.1 Medium

Browser Sniff <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- bpedrassani Browser Sniff
- Cross-site request forgery (CSRF)
Not analysed yet 20 Sept 2025
CVE-2025-9882 CVE record

CVSS 6.1 Medium

osTicket WP Bridge <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- michaelbo osTicket WP Bridge
- Cross-site request forgery (CSRF)
Not analysed yet 20 Sept 2025
CVE-2025-9949 CVE record

CVSS 4.3 Medium

Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery
- webraketen Internal Links Manager
- Cross-site request forgery (CSRF)
Not analysed yet 20 Sept 2025
com.liferay.portal:com.liferay.portal.impl Maven

CVSS 5.1 Medium

Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability
- Cross-site request forgery (CSRF)
<101.0.0 · fixed in 101.0.0

GHSA-697h-3q6m-jwp4 · CVE-2025-43809 Not analysed yet 19 Sept 2025
CVE-2025-50255 CVE record

CVSS 7.8 High

Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request.
- Cross-site request forgery (CSRF)
Not analysed yet 18 Sept 2025
CVE-2025-10188 CVE record

CVSS 5.4 Medium

The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content
- tvcnet The Hack Repair Guy's Plugin Archiver
- Cross-site request forgery (CSRF)
Not analysed yet 17 Sept 2025
CVE-2025-9891 CVE record

CVSS 4.3 Medium

User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation
- cyberlord92 User Sync
- Cross-site request forgery (CSRF)
Not analysed yet 17 Sept 2025
CVE-2025-9629 CVE record

CVSS 4.3 Medium

USS Upyun <= 1.5.0 - Cross-Site Request Forgery
- shenyanzhi USS Upyun
- Cross-site request forgery (CSRF)
Not analysed yet 17 Sept 2025
CVE-2025-54390 CVE record

CVSS 6.3 Medium

A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswordStatus attribute is enabled.
- Cross-site request forgery (CSRF)
Not analysed yet 17 Sept 2025
CVE-2025-56710 CVE record

CVSS 7.3 High

A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0.
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2025
CVE-2025-9881 CVE record

CVSS 6.1 Medium

Ultimate Blogroll <= 2.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- jensg Ultimate Blogroll
- Cross-site request forgery (CSRF)
Not analysed yet 12 Sept 2025
CVE-2025-9880 CVE record

CVSS 6.1 Medium

Side Slide Responsive Menu <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- dejocar Side Slide Responsive Menu
- Cross-site request forgery (CSRF)
Not analysed yet 12 Sept 2025
CVE-2025-9633 CVE record

CVSS 4.3 Medium

LH Signing <= 2.83 - Cross-Site Request Forgery
- shawfactor LH Signing
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-9632 CVE record

CVSS 4.3 Medium

PhpList Subber <= 1.1 - Cross-Site Request Forgery
- vinzzb PhpList Subber
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-9617 CVE record

CVSS 5.3 Medium

Publish approval <= 1.1 - Cross-Site Request Forgery
- evidentlycube Publish approval
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-9620 CVE record

CVSS 6.1 Medium

Seo Monster <= 3.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- edsteep Seo Monster
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-8481 CVE record

CVSS 4.3 Medium

Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery
- mdimran41 Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-9623 CVE record

CVSS 4.3 Medium

Admin in English with Switch <= 1.1 - Cross-Site Request Forgery
- dontcare Admin in English with Switch
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-9627 CVE record

CVSS 4.3 Medium

Run Log <= 1.7.10 - Cross-Site Request Forgery to Settings Update
- izem Run Log
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-9635 CVE record

CVSS 4.3 Medium

Analytics Reduce Bounce Rate <= 2.3 - Cross-Site Request Forgery
- ishan001 Analytics Reduce Bounce Rate
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-9634 CVE record

CVSS 4.3 Medium

Plugin updates blocker <= 0.2 - Cross-Site Request Forgery
- jegerwan Plugin updates blocker
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-9628 CVE record

CVSS 4.3 Medium

The integration of the AMO.CRM <= 1.0.1 - Cross-Site Request Forgery
- jh5ru The integration of the AMO.CRM
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-9631 CVE record

CVSS 4.3 Medium

AutoCatSet <= 2.1.4 - Cross-Site Request Forgery
- gyaku AutoCatSet
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-8479 CVE record

CVSS 4.3 Medium

Zoho Flow <= 2.14.1 - Cross-Site Request Forgery
- zohoflow Zoho Flow – Integrate 100+ plugins with 1000+ business apps, no-code workflow automation
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2025
CVE-2025-9888 CVE record

CVSS 4.3 Medium

Maspik <= 2.5.6 - Cross-Site Request Forgery
- yonifre Maspik – Ultimate Spam Protection
- Cross-site request forgery (CSRF)
Not analysed yet 10 Sept 2025
CVE-2025-9622 CVE record

CVSS 4.3 Medium

WP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing
- wpblast WP Blast | SEO & Performance Booster
- Cross-site request forgery (CSRF)
Not analysed yet 10 Sept 2025
github.com/knadh/listmonk Go

CVSS 8.6 High

listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
<=1.1.0 · no fixed version yet

GHSA-rf24-wg77-gq7w · CVE-2025-58430 Not analysed yet 9 Sept 2025
CVE-2025-54256 CVE record

CVSS 8.6 High

Dreamweaver Desktop | Cross-Site Request Forgery (CSRF) (CWE-352)
- Adobe Dreamweaver Desktop
- Cross-site request forgery (CSRF)
Not analysed yet 9 Sept 2025
CVE-2025-58975 CVE record

CVSS 4.3 Medium

WordPress Advanced Settings Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Helmut Wandl Advanced Settings
- Cross-site request forgery (CSRF)
Not analysed yet 9 Sept 2025
CVE-2025-58991 CVE record

CVSS 7.1 High

WordPress WooCommerce Booking Bundle Hours Plugin <= 0.7.4 - Cross Site Request Forgery (CSRF) Vulnerability
- Cristiano Zanca WooCommerce Booking Bundle Hours
- Cross-site request forgery (CSRF)
Not analysed yet 9 Sept 2025
CVE-2025-58997 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Mow Theme <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability
- Frenify Mow
- Cross-site request forgery (CSRF)
Not analysed yet 9 Sept 2025
CVE-2025-55147 CVE record

CVSS 8.8 High

Cross-site request forgery in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Cross-site request forgery (CSRF)
Not analysed yet 9 Sept 2025
CVE-2025-8711 CVE record

CVSS 5.4 Medium

Cross-site request forgery in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Cross-site request forgery (CSRF)
Not analysed yet 9 Sept 2025
CVE-2025-42923 CVE record

CVSS 4.3 Medium

Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups)
- SAP_SE SAP Fiori App (F4044 Manage Work Center Groups)
- Cross-site request forgery (CSRF)
Not analysed yet 9 Sept 2025
CVE-2024-48341 CVE record

CVSS 3.7 Low

dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop
- Cross-site request forgery (CSRF)
Not analysed yet 8 Sept 2025
CVE-2025-27003 CVE record

CVSS 4.3 Medium

WordPress Quick Paypal Payments Plugin <= 5.7.46 - Cross Site Request Forgery (CSRF) vulnerability
- fullworks Quick Paypal Payments
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-48104 CVE record

CVSS 7.1 High

WordPress Floating Window Music Player plugin <= 3.4.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- ericzane Floating Window Music Player
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58878 CVE record

CVSS 6.5 Medium

WordPress Woocommerce Gifts Product Plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability
- usamafarooq Woocommerce Gifts Product
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58869 CVE record

CVSS 6.5 Medium

WordPress SimaCookie Plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) Vulnerability
- Simasicher SimaCookie
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58865 CVE record

CVSS 4.3 Medium

WordPress Compact Admin plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability
- reimund Compact Admin
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58861 CVE record

CVSS 7.1 High

WordPress Quick Event Calendar Plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability
- WP Corner Quick Event Calendar
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58860 CVE record

CVSS 7.1 High

WordPress Enable Latex Plugin <= 1.2.16 - Cross Site Request Forgery (CSRF) Vulnerability
- KaizenCoders Enable Latex
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58859 CVE record

CVSS 7.1 High

WordPress Add to Feedly Plugin <= 1.2.11 - Cross Site Request Forgery (CSRF) Vulnerability
- David Merinas Add to Feedly
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58856 CVE record

CVSS 6.5 Medium

WordPress Woocommerce Notify Updated Product Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability
- ablancodev Woocommerce Notify Updated Product
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58854 CVE record

CVSS 7.1 High

WordPress Ultimate AJAX Login Plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Samer Bechara Ultimate AJAX Login
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58853 CVE record

CVSS 7.1 High

WordPress Popping Sidebars and Widgets Light Plugin <= 1.27 - Cross Site Request Forgery (CSRF) Vulnerability
- OTWthemes Popping Sidebars and Widgets Light
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58852 CVE record

CVSS 7.1 High

WordPress MSTW League Manager Plugin <= 2.10 - Cross Site Request Forgery (CSRF) Vulnerability
- Mark O'Donnell MSTW League Manager
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58849 CVE record

CVSS 7.1 High

WordPress Hide Real Download Path Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability
- Deepak S Hide Real Download Path
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58848 CVE record

CVSS 7.1 High

WordPress WP likes Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- aakash1911 WP likes
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58847 CVE record

CVSS 7.1 High

WordPress WN Flipbox Pro Plugin <= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Yaidier WN Flipbox Pro
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58846 CVE record

CVSS 7.1 High

WordPress WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule Plugin <= 2020.1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Dejan Markovic WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58845 CVE record

CVSS 7.1 High

WordPress Bulk Watermark Plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) Vulnerability
- ChrisHurst Bulk Watermark
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58844 CVE record

CVSS 7.1 High

WordPress Database to Excel Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Subhash Kumar Database to Excel
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58843 CVE record

CVSS 7.1 High

WordPress Auto Last Youtube Video Plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability
- David Merinas Auto Last Youtube Video
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025
CVE-2025-58833 CVE record

CVSS 8.8 High

WordPress Invelity MyGLS connect Plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability
- Invelity MyGLS connect
- Cross-site request forgery (CSRF)
Not analysed yet 5 Sept 2025