Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-12188 CVE record

CVSS 4.3 Medium

Posts Navigation Links for Sections and Headings - Free by WP Masters <= 1.0.1 - Cross-Site Request Forgery to Settings Update
- wpmasterscom Posts Navigation Links for Sections and Headings – Free by WP Masters
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12069 CVE record

CVSS 4.3 Medium

WP Global Screen Options <= 0.2 - Cross-Site Request Forgery to Screen Options Update
- stiand WP Global Screen Options
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12401 CVE record

CVSS 6.1 Medium

Label Plugins <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- theode Label Plugins
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12070 CVE record

CVSS 4.3 Medium

ViaAds <= 2.1.2 - Cross-Site Request Forgery to API Key Update
- ViaAds
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-64368 CVE record

CVSS 5.4 Medium

WordPress Bard theme <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability
- Mikado-Themes Bard
- Cross-site request forgery (CSRF)
Not analysed yet 31 Oct 2025
CVE-2025-64357 CVE record

CVSS 4.3 Medium

WordPress Advanced Database Cleaner plugin <= 3.1.6 - Cross Site Request Forgery (CSRF) vulnerability
- Younes JFR. Advanced Database Cleaner
- Cross-site request forgery (CSRF)
Not analysed yet 31 Oct 2025
CVE-2025-8383 CVE record

CVSS 4.3 Medium

Depicter <= 4.0.4 - Cross-Site Request Forgery
- averta Depicter — Popup & Slider Builder
- Cross-site request forgery (CSRF)
Not analysed yet 31 Oct 2025
CVE-2023-53688 CVE record

CVSS 5.1 Medium

Nagios XI < 5.11.3 XSS & CSRF via Hypermap Replay
- Nagios XI
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2025
CVE-2025-10317 CVE record

CVSS 5.1 Medium

Multiple Cross-Site Request Forgery in Quick.Cart
- OpenSolution Quick.Cart
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2025
drupal/currency Packagist

CVSS 6.5 Medium

Drupal Currency allows Cross Site Request Forgery
- Cross-site request forgery (CSRF)
<3.5.0 · fixed in 3.5.0

GHSA-27fv-rpgj-4c6m · CVE-2025-10930 Not analysed yet 30 Oct 2025
CVE-2025-62797 CVE record

CVSS 8.6 High

CSRF in FluxCP account endpoints allows account takeover / state-changing actions
- rathena FluxCP
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
CVE-2025-12479 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation
- Azure Access Technology BLU-IC2
- Azure Access Technology BLU-IC4
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
org.jenkins-ci.plugins:publish-to-bitbucket Maven

CVSS 5.4 Medium

Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check
- Cross-site request forgery (CSRF)
<=0.4 · no fixed version yet

GHSA-m244-6mff-p355 · CVE-2025-64149 Not analysed yet 29 Oct 2025
org.jenkins-ci.plugins:nexus-task-runner Maven

CVSS 4.3 Medium

Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery
- Cross-site request forgery (CSRF)
<=0.9.2 · no fixed version yet

GHSA-x2pv-fph3-phfx · CVE-2025-64141 Not analysed yet 29 Oct 2025
org.jenkins-ci.plugins:themis Maven

CVSS 4.3 Medium

Jenkins Themis Plugin vulnerable to cross-site request forgery
- Cross-site request forgery (CSRF)
<=1.4.1 · no fixed version yet

GHSA-93mh-mx9w-m69q · CVE-2025-64136 Not analysed yet 29 Oct 2025
org.jenkins-ci.plugins:windocks-start-container Maven

CVSS 4.3 Medium

Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery
- Cross-site request forgery (CSRF)
<=1.4 · no fixed version yet

GHSA-6mgr-3374-4p3c · CVE-2025-64138 Not analysed yet 29 Oct 2025
jp.ikedam.jenkins.plugins:extensible-choice-parameter Maven

CVSS 5.4 Medium

Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery
- Cross-site request forgery (CSRF)
<=239.v5f5c278708cf · no fixed version yet

GHSA-3jw2-5hjg-hc2c · CVE-2025-64133 Not analysed yet 29 Oct 2025
CVE-2025-64290 CVE record

CVSS 4.3 Medium

WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
- Premmerce Product Search for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
CVE-2025-64288 CVE record

CVSS 4.3 Medium

WordPress Premmerce plugin <= 1.3.19 - Cross Site Request Forgery (CSRF) vulnerability
- Premmerce
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
CVE-2025-64286 CVE record

CVSS 4.3 Medium

WordPress WP Rentals theme <= 3.13.1 - Cross Site Request Forgery (CSRF) vulnerability
- WpEstate WP Rentals
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
CVE-2025-64226 CVE record

CVSS 4.3 Medium

WordPress Stockie Extra plugin <= 1.2.11 - Cross Site Request Forgery (CSRF) vulnerability
- colabrio Stockie Extra
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
CVE-2025-64201 CVE record

CVSS 4.3 Medium

WordPress PowerPress Podcasting plugin <= 11.13.12 - Cross Site Request Forgery (CSRF) vulnerability
- blubrry PowerPress Podcasting
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
CVE-2025-60075 CVE record

CVSS 7.1 High

WordPress hpb seo plugin for WordPress plugin <= 3.0.1 - Cross Site Request Forgery (CSRF) vulnerability
- Allegro Marketing hpb seo plugin for WordPress
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
CVE-2025-58939 CVE record

CVSS 4.3 Medium

WordPress Super Store Finder plugin <= 7.5 - Cross Site Request Forgery (CSRF) vulnerability
- highwarden Super Store Finder
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
CVE-2025-57931 CVE record

CVSS 5.3 Medium

WordPress Popup box plugin <= 5.5.4 - Cross Site Request Forgery (CSRF) vulnerability
- Ays Pro Popup box
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
CVE-2024-45161 CVE record

CVSS 4.6 Medium

A CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507.
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2025
CVE-2025-55758 CVE record

CVSS 5.4 Medium

Extension - jdownloads.com - CSRF vectors in jDownloads component 1.0.0 - 4.0.47 for Joomla
- jdownloads.com JDownloads component for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 28 Oct 2025
com.liferay.portal:release.portal.bom Maven

CVSS 7.0 High

Liferay Portal Vulnerable to CSRF in Headless APIs
- Cross-site request forgery (CSRF)
>=7.4.0-ga1, <7.4.3.108 · fixed in 7.4.3.108

GHSA-gh4w-8qgq-8w9r · CVE-2025-62258 Not analysed yet 28 Oct 2025
CVE-2025-34133 CVE record

CVSS 7.0 High

Wimi Teamwork < v7.38.17 CSRF
- Cloud Solutions SAS Wimi Teamwork
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-58918 CVE record

CVSS 4.3 Medium

WordPress Entrada theme <= 5.7.7 - Cross Site Request Forgery (CSRF) vulnerability
- Waituk Entrada
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62986 CVE record

CVSS 7.1 High

WordPress FanBridge signup plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerability
- FanBridge signup
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62975 CVE record

CVSS 4.3 Medium

WordPress Raychat plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability
- Raychat
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62962 CVE record

CVSS 7.1 High

WordPress CloudSearch plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- Andrea Landonio CloudSearch
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62958 CVE record

CVSS 4.3 Medium

WordPress Simple Content Templates for Blog Posts & Pages plugin <= 2.2.61 - Cross Site Request Forgery (CSRF) vulnerability
- Clifton Griffin Simple Content Templates for Blog Posts & Pages
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62957 CVE record

CVSS 7.1 High

WordPress NikanWP WooCommerce Reporting plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- NikanWP WooCommerce Reporting
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62956 CVE record

CVSS 7.1 High

WordPress Reloadly plugin <= 2.0.1 - Cross Site Request Forgery (CSRF) vulnerability
- iseremet Reloadly
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62945 CVE record

CVSS 7.1 High

WordPress Did Prestashop Display plugin <= 1.0.30 - Cross Site Request Forgery (CSRF) vulnerability
- Eduard Pinuaga Linares Did Prestashop Display
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62934 CVE record

CVSS 7.1 High

WordPress WP Business Hours plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
- Mejar WP Business Hours
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62933 CVE record

CVSS 7.1 High

WordPress Awesome Testimonials plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability
- Prakash Awesome Testimonials
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62896 CVE record

CVSS 7.1 High

WordPress Multilang Contact Form plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability
- digitaldonkey Multilang Contact Form
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62891 CVE record

CVSS 4.3 Medium

WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.5 - Cross Site Request Forgery (CSRF) vulnerability
- Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars)
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62890 CVE record

CVSS 4.3 Medium

WordPress Premmerce Brands for WooCommerce plugin <= 1.2.13 - Cross Site Request Forgery (CSRF) vulnerability
- Premmerce Brands for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-62886 CVE record

CVSS 7.1 High

WordPress Pricing Table builder plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability
- wpdevart Pricing Table builder
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-12202 CVE record

CVSS 5.3 Medium

ajayrandhawa User-Management-PHP-MYSQL web cross-site request forgery
- ajayrandhawa User-Management-PHP-MYSQL web
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 27 Oct 2025
CVE-2025-54969 CVE record

CVSS 6.1 Medium

An issue was discovered in BAE SOCET GXP before 4.6.0.2.
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2025
CVE-2025-11976 CVE record

CVSS 4.3 Medium

FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule Creation
- FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)
- Cross-site request forgery (CSRF)
Not analysed yet 25 Oct 2025
CVE-2025-12095 CVE record

CVSS 8.8 High

Simple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval
- astoundify Simple Registration for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 25 Oct 2025
CVE-2025-12028 CVE record

CVSS 8.8 High

IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens
- indieweb IndieAuth
- Cross-site request forgery (CSRF)
Not analysed yet 24 Oct 2025
CVE-2025-12072 CVE record

CVSS 4.3 Medium

Disable Content Editor For Specific Template <= 2.0 - Cross-Site Request Forgery to Template Configuration Update
- mynamevenu24 Disable Content Editor For Specific Template
- Cross-site request forgery (CSRF)
Not analysed yet 24 Oct 2025
CVE-2025-56009 CVE record

CVSS 5.3 Medium

Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing…
- Cross-site request forgery (CSRF)
Not analysed yet 23 Oct 2025
CVE-2025-62061 CVE record

CVSS 4.3 Medium

WordPress Product Catalog Simple plugin <= 1.8.4 - Cross Site Request Forgery (CSRF) vulnerability
- impleCode Product Catalog Simple
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025
CVE-2025-62009 CVE record

CVSS 4.3 Medium

WordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability
- Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025
CVE-2025-62005 CVE record

CVSS 7.1 High

WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Cross Site Request Forgery (CSRF) vulnerability
- FantasticPlugins SUMO Memberships for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025
CVE-2025-60208 CVE record

CVSS 8.8 High

WordPress Advanced Custom Fields : CPT Options Pages plugin <= 2.0.9 - Cross Site Request Forgery (CSRF) vulnerability
- Tusko Trush Advanced Custom Fields : CPT Options Pages
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025
CVE-2025-60168 CVE record

CVSS 7.1 High

WordPress HotelRunner Booking Widget Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability
- integrationshotelrunner HotelRunner Booking Widget
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025
CVE-2025-60134 CVE record

CVSS 4.3 Medium

WordPress WP Media Categories Plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability
- John James Jacoby WP Media Categories
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025
CVE-2025-60132 CVE record

CVSS 7.1 High

WordPress Video Blogster Lite Plugin <= 1.2 - Cross Site Request Forgery (CSRF) Vulnerability
- johnh10 Video Blogster Lite
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025
CVE-2025-49373 CVE record

CVSS 4.3 Medium

WordPress Evergreen Content Poster plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability
- Evergreen Content Poster
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025
CVE-2025-48099 CVE record

CVSS 4.7 Medium

WordPress Search & Filter plugin <= 1.2.17 - Cross Site Request Forgery (CSRF) to Open Redirect vulnerability
- Code Amp Search & Filter
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025
CVE-2025-10588 CVE record

CVSS 4.3 Medium

PixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification
- PixelYourSite – Your smart PIXEL (TAG) & API Manager
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2025