Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-62771 CVE record

CVSS 7.5 High

Cross-site request forgery in Mercku M6a
- Mercku M6a
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025
org.apache.geode:geode-web Maven

CVSS 8.8 High

Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system
- Cross-site request forgery (CSRF)
>=1.10.0, <1.15.2 · fixed in 1.15.2

GHSA-gjp8-99fv-cgcw · CVE-2025-47410 Not analysed yet 18 Oct 2025
CVE-2025-9890 CVE record

CVSS 8.8 High

Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution
- mndpsingh287 Theme Editor
- Cross-site request forgery (CSRF)
Not analysed yet 18 Oct 2025
org.springframework:spring-websocket Maven

CVSS 4.3 Medium

Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages
- Cross-site request forgery (CSRF)
>=6.2.0, <6.2.12 || >=6.1.0, <=6.1.21 || >=6.0.0, <=6.0.23 || <=5.3.39 · fixed in 6.2.12

GHSA-7fch-4f2f-jcgm · CVE-2025-41254 Not analysed yet 16 Oct 2025
CVE-2025-10700 CVE record

CVSS 4.3 Medium

Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update
- elemntor Ally – Web Accessibility & Usability
- Cross-site request forgery (CSRF)
Not analysed yet 16 Oct 2025
CVE-2025-10312 CVE record

CVSS 4.3 Medium

Theme Importer <= 1.0 - Cross-Site Request Forgery
- steve-forster Theme Importer
- Cross-site request forgery (CSRF)
Not analysed yet 15 Oct 2025
CVE-2025-10300 CVE record

CVSS 4.3 Medium

TopBar <= 1.0.0 - Cross-Site Request Forgery to Settings Update
- fmeaddons TopBar
- Cross-site request forgery (CSRF)
Not analysed yet 15 Oct 2025
CVE-2025-10301 CVE record

CVSS 4.3 Medium

FunKItools <= 1.0.2 - Cross-Site Request Forgery to Settings Update
- flenskiproject FunKItools
- Cross-site request forgery (CSRF)
Not analysed yet 15 Oct 2025
CVE-2025-59428 CVE record

CVSS 5.4 Medium

EspoCRM allows arbitrary user creation via stored SVG injection and CSRF
- espocrm
- Cross-site request forgery (CSRF)
Not analysed yet 14 Oct 2025
CVE-2025-7330 CVE record

CVSS 7.0 High

Rockwell Automation 1783-NATR Cross-Site Request Forgery Vulnerability
- Rockwell Automation Comms - 1783-NATR
- Cross-site request forgery (CSRF)
Not analysed yet 14 Oct 2025
CVE-2025-42908 CVE record

CVSS 5.4 Medium

Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP
- SAP_SE SAP NetWeaver Application Server for ABAP
- Cross-site request forgery (CSRF)
Not analysed yet 14 Oct 2025
CVE-2025-60535 CVE record

CVSS 7.3 High

A Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request.
- Cross-site request forgery (CSRF)
Not analysed yet 14 Oct 2025
CVE-2025-10376 CVE record

CVSS 4.3 Medium

Course Redirects for Learndash Plugin <= 0.4 - Cross-Site Request Forgery
- ercbs Course Redirects for Learndash Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 11 Oct 2025
CVE-2025-10375 CVE record

CVSS 4.3 Medium

Web Accessibility By accessiBe <= 2.10 - Cross-Site Request Forgery
- accessibewp Web Accessibility by accessiBe
- Cross-site request forgery (CSRF)
Not analysed yet 11 Oct 2025
CVE-2025-8606 CVE record

CVSS 2.4 Low

GSheetConnector For Gravity Forms <= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation
- westerndeal GSheetConnector for Gravity Forms – Send Gravity Forms Entries to Google Sheets in Real-Time
- Cross-site request forgery (CSRF)
Not analysed yet 11 Oct 2025
CVE-2025-9626 CVE record

CVSS 4.3 Medium

Page Blocks <= 1.1.0 - Cross-Site Request Forgery
- softwud Page Blocks
- Cross-site request forgery (CSRF)
Not analysed yet 11 Oct 2025
CVE-2025-9621 CVE record

CVSS 4.3 Medium

WidgetPack Comment System <= 1.6.1 - Cross-Site Request Forgery
- WidgetPack Comment System
- Cross-site request forgery (CSRF)
Not analysed yet 11 Oct 2025
com.liferay:com.liferay.change.tracking.web Maven

CVSS 5.1 Medium

Liferay Portal is vulnerable to CSRF through publication comments
- Cross-site request forgery (CSRF)
>=2.0.9, <2.0.121 · fixed in 2.0.121

GHSA-9676-rh83-cr86 · CVE-2025-62245 Not analysed yet 10 Oct 2025
CVE-2025-61930 CVE record

CVSS 8.1 High

Emlog Pro has CSRF issue that Enables Admin Password Reset
- emlog
- Cross-site request forgery (CSRF)
Not analysed yet 10 Oct 2025
CVE-2025-43296 CVE record

CVSS 5.5 Medium

Cross-site request forgery in Apple macOS
- Apple macOS
- Cross-site request forgery (CSRF)
- CWE-693
Not analysed yet 9 Oct 2025
CVE-2025-11166 CVE record

CVSS 5.4 Medium

WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update
- wpgmaps WP Go Maps (formerly WP Google Maps)
- Cross-site request forgery (CSRF)
Not analysed yet 9 Oct 2025
CVE-2025-11442 CVE record

CVSS 5.3 Medium

JhumanJ OpnForm API Endpoint cross-site request forgery
- JhumanJ OpnForm
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 8 Oct 2025
CVE-2025-60956 CVE record

CVSS 8.0 High

Cross Site Request Forgery (CSRF) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of se…
- Cross-site request forgery (CSRF)
Not analysed yet 6 Oct 2025
CVE-2025-9886 CVE record

CVSS 4.3 Medium

Trinity Audio <= 5.20.2 - Cross-Site Request Forgery
- sergiotrinity Trinity Audio – Text to Speech AI audio player to convert content into audio
- Cross-site request forgery (CSRF)
Not analysed yet 4 Oct 2025
CVE-2025-10302 CVE record

CVSS 4.3 Medium

Ultimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Update
- hameha Ultimate Viral Quiz
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-9897 CVE record

CVSS 4.3 Medium

AP Background <= 3.8.2 - Cross-Site Request Forgery
- hovanesvn AP Background
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-9895 CVE record

CVSS 4.3 Medium

Notification Bar <= 2.2 - Cross-Site Request Forgery
- umarbajwa Notification Bar
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-9630 CVE record

CVSS 4.3 Medium

WP SinoType <= 1.0 - Cross-Site Request Forgery
- samueljesse WP SinoType
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-9889 CVE record

CVSS 4.3 Medium

ContentMX Content Publisher <= 1.0.6 - Cross-Site Request Forgery
- ContentMX Content Publisher
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-8669 CVE record

CVSS 4.3 Medium

Customify <= 0.4.11 - Cross-Site Request Forgery
- pressmaximum Customify
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-9892 CVE record

CVSS 5.3 Medium

Restrict User Registration <= 1.0.1 - Cross-Site Request Forgery to Settings Update
- devrix Restrict User Registration
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-10309 CVE record

CVSS 4.3 Medium

PayPal Forms <= 1.0.3 - Cross-Site Request Forgery
- bsmye PayPal Forms
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-9945 CVE record

CVSS 4.3 Medium

Optimize More! – CSS <= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Reset
- aryadhiratara Optimize More! – CSS
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-9884 CVE record

CVSS 6.1 Medium

Mobile Site Redirect <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- webdevabq Mobile Site Redirect
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-9885 CVE record

CVSS 4.3 Medium

MPWizard – Create Mercado Pago Payment Links <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion
- laudanumsoft MPWizard – Create Mercado Pago Payment Links
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-10311 CVE record

CVSS 4.3 Medium

Comment Info Detector <= 1.0.5 - Cross-Site Request Forgery to Settings Update
- tom_riddle Comment Info Detector
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
CVE-2025-9213 CVE record

CVSS 8.8 High

TextBuilder 1.0.0 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation via Account Takeover
- TextBuilder
- Cross-site request forgery (CSRF)
Not analysed yet 3 Oct 2025
github.com/canonical/lxd Go

CVSS 7.5 High

Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI
- Cross-site request forgery (CSRF)
>=0.0.0-20220401034332-1e1349e3cbf3, <0.0.0-20250827065555-0494f5d47e41 || >=5.0, <5.0.5 || >=5.1, <5.21.4 || >=6.0, <6.5 · fixed in 0.0.0-20250827065555-0494f5d47e41, 5.0.5, 5.21.4, 6.5

GHSA-p8hw-rfjg-689h · CVE-2025-54286 Not analysed yet 2 Oct 2025
CVE-2025-61604 CVE record

CVSS 7.1 High

WeGIA: Cross-Site Request Forgery (CSRF) Vulnerability in `control.php` Endpoint
- LabRedesCefetRJ WeGIA
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2025
CVE-2025-8119 CVE record

CVSS 5.1 Medium

Cross-Site Request Forgery in PAD CMS
- Polska Akademia Dostępności PAD CMS
- Cross-site request forgery (CSRF)
Not analysed yet 30 Sept 2025
CVE-2025-7052 CVE record

CVSS 8.8 High

LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site request forgery (CSRF)
Not analysed yet 30 Sept 2025
CVE-2025-9946 CVE record

CVSS 6.1 Medium

LockerPress – WordPress Security Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- LockerPress – WordPress Security Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 30 Sept 2025
CVE-2025-9948 CVE record

CVSS 4.3 Medium

Chat by Chatwee <= 2.1.3 - Cross-Site Request Forgery to Settings Update
- paulq Chat by Chatwee
- Cross-site request forgery (CSRF)
Not analysed yet 30 Sept 2025
CVE-2025-35030 CVE record

CVSS 8.6 High

Medical Informatics Engineering Enterprise Health cross site request forgery
- Medical Informatics Engineering Enterprise Health
- Cross-site request forgery (CSRF)
Not analysed yet 29 Sept 2025
CVE-2025-9893 CVE record

CVSS 4.3 Medium

VM Menu Reorder plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update
- milankyada VM Menu Reorder plugin
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2025
CVE-2025-9944 CVE record

CVSS 4.3 Medium

Professional Contact Form <= 1.0.0 - Cross-Site Request Forgery to Test Email Sending
- kelderic Professional Contact Form
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2025
CVE-2025-9898 CVE record

CVSS 4.3 Medium

cForms – Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgery
- compojoom cForms – Light speed fast Form Builder
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2025
CVE-2025-9899 CVE record

CVSS 6.1 Medium

Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms <= 1.0 - Cross-Site Request Forgery
- trustreviews Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2025
CVE-2025-9894 CVE record

CVSS 4.3 Medium

Sync Feedly <= 1.0.1 - Cross-Site Request Forgery to Sync Trigger
- cristianr909090 Sync Feedly
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2025
CVE-2025-9896 CVE record

CVSS 4.3 Medium

HidePost <= 2.3.8 - Cross-Site Request Forgery
- funnnny HidePost
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2025
CVE-2025-11051 CVE record

CVSS 5.3 Medium

SourceCodester Pet Grooming Management Software cross-site request forgery
- SourceCodester Pet Grooming Management Software
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 27 Sept 2025
CVE-2025-10498 CVE record

CVSS 4.3 Medium

Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion
- kstover Ninja Forms – The Contact Form Builder That Grows With You
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2025
CVE-2025-10499 CVE record

CVSS 4.3 Medium

Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update
- kstover Ninja Forms – The Contact Form Builder That Grows With You
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2025
CVE-2024-43192 CVE record

CVSS 6.5 Medium

IBM Storage TS4500 Library cross-site request forgery
- IBM Storage TS4500 Library
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2025
CVE-2025-11029 CVE record

CVSS 5.3 Medium

givanz Vvveb cross-site request forgery
- givanz Vvveb
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 26 Sept 2025
@apollo/explorer +1 npm

CVSS 8.2 High

Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass
- Cross-site request forgery (CSRF)
- CWE-346
<3.7.3 · fixed in 3.7.3

GHSA-w87v-7w53-wwxv · CVE-2025-59845 Not analysed yet 26 Sept 2025
CVE-2025-60173 CVE record

CVSS 7.1 High

WordPress GST for WooCommerce Plugin <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Ashwani kumar GST for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60172 CVE record

CVSS 7.1 High

WordPress Flytedesk Digital Plugin <= 20181101 - Cross Site Request Forgery (CSRF) Vulnerability
- Flytedesk Digital
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60171 CVE record

CVSS 7.1 High

WordPress Conditional Cart Messages for WooCommerce – YourPlugins.com Plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) Vulnerability
- Conditional Cart Messages for WooCommerce – YourPlugins.com
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025
CVE-2025-60170 CVE record

CVSS 7.1 High

WordPress HTACCESS IP Blocker Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Taraprasad Swain HTACCESS IP Blocker
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2025