Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-66097 CVE record

CVSS 4.3 Medium

WordPress I Order Terms plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability
- Igor Jerosimić I Order Terms
- Cross-site request forgery (CSRF)
Not analysed yet 21 Nov 2025
CVE-2025-66064 CVE record

CVSS 4.3 Medium

WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability
- Syed Balkhi Giveaways and Contests by RafflePress
- Cross-site request forgery (CSRF)
Not analysed yet 21 Nov 2025
CVE-2025-66061 CVE record

CVSS 4.3 Medium

WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Cross Site Request Forgery (CSRF) vulnerability
- Craig Hewitt Seriously Simple Podcasting
- Cross-site request forgery (CSRF)
Not analysed yet 21 Nov 2025
CVE-2025-13134 CVE record

CVSS 6.1 Medium

AuthorSure <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- powerblogservice AuthorSure
- Cross-site request forgery (CSRF)
Not analysed yet 21 Nov 2025
CVE-2025-13142 CVE record

CVSS 4.3 Medium

Custom Post Type <= 1.0 - Cross-Site Request Forgery to Custom Post Type Deletion
- farvehandleren Custom Post Type
- Cross-site request forgery (CSRF)
Not analysed yet 21 Nov 2025
CVE-2025-62687 CVE record

CVSS 6.9 Medium

Cross-site request forgery in LogStare Inc. LogStare Collector (for Windows) and others
- LogStare Inc. LogStare Collector (for Windows)
- LogStare Inc. LogStare Collector (for Linux)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Nov 2025
CVE-2025-62346 CVE record

CVSS 6.8 Medium

HCL Glovius Cloud is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability
- HCL Software Glovius Cloud
- Cross-site request forgery (CSRF)
Not analysed yet 20 Nov 2025
CVE-2025-12535 CVE record

CVSS 5.3 Medium

SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution
- brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder
- Cross-site request forgery (CSRF)
Not analysed yet 19 Nov 2025
CVE-2025-59114 CVE record

CVSS 5.1 Medium

Cross-Site Request Forgery in Windu CMS
- JCD Windu CMS
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-59112 CVE record

CVSS 5.1 Medium

Cross-Site Request Forgery in Windu CMS
- JCD Windu CMS
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-59110 CVE record

CVSS 6.8 Medium

Cross-Site Request Forgery in Windu CMS
- JCD Windu CMS
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-6670 CVE record

CVSS 8.8 High

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
- WSO2 Open Banking AM
- WSO2 Open Banking IAM
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-12406 CVE record

CVSS 6.1 Medium

Project Honey Pot Spam Trap <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- awensley Project Honey Pot Spam Trap
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-12173 CVE record

CVSS 4.3 Medium

WP Admin Microblog <= 3.1.1 - Cross-Site Request Forgery to Message Creation
- winkm89 WP Admin Microblog
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-12827 CVE record

CVSS 4.3 Medium

Top Friends <= 0.3 - Cross-Site Request Forgery to Settings Update
- denishua Top Friends
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-12404 CVE record

CVSS 6.1 Medium

Like-it <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- nikolayyordanov Like-it
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-9625 CVE record

CVSS 4.3 Medium

Coil Web Monetization <= 2.0.2 - Cross-Site Request Forgery
- interledger Coil Web Monetization
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-63955 CVE record

CVSS 7.5 High

A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an attacker to trick an authenticated administrator into submitt…
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-55057 CVE record

CVSS 4.5 Medium

Cross-site request forgery in Rumpus FTP Server
- Rumpus FTP Server
- Cross-site request forgery (CSRF)
Not analysed yet 17 Nov 2025
CVE-2025-13283 CVE record

CVSS 7.0 High

Chunghwa Telecom｜TenderDocTransfer - Arbitrary File Copy and Paste
- Chunghwa Telecom TenderDocTransfer
- Path traversal
- Cross-site request forgery (CSRF)
Not analysed yet 17 Nov 2025
CVE-2025-13282 CVE record

CVSS 7.0 High

Chunghwa Telecom｜TenderDocTransfer - Arbitrary File Delete
- Chunghwa Telecom TenderDocTransfer
- Path traversal
- Cross-site request forgery (CSRF)
Not analysed yet 17 Nov 2025
CVE-2025-13179 CVE record

CVSS 5.3 Medium

Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System cross-site request forgery
- Bdtask Wholesale Inventory Control and Inventory Management System
- CodeCanyon Wholesale Inventory Control and Inventory Management System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 14 Nov 2025
CVE-2025-13177 CVE record

CVSS 5.3 Medium

Bdtask/CodeCanyon SalesERP cross-site request forgery
- Bdtask SalesERP
- CodeCanyon SalesERP
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 14 Nov 2025
CVE-2025-59480 CVE record

CVSS 6.1 Medium

Inadequate validation of SSO redirect credentials permits credential theft
- Mattermost
- Cross-site request forgery (CSRF)
Not analysed yet 13 Nov 2025
CVE-2025-13119 CVE record

CVSS 5.3 Medium

Fabian Ros/SourceCodester Simple E-Banking System cross-site request forgery
- Fabian Ros Simple E-Banking System
- SourceCodester Simple E-Banking System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 13 Nov 2025
CVE-2025-64271 CVE record

CVSS 4.3 Medium

WordPress WP Plugin Manager plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability
- HasThemes WP Plugin Manager
- Cross-site request forgery (CSRF)
Not analysed yet 13 Nov 2025
CVE-2025-64262 CVE record

CVSS 6.5 Medium

WordPress Auto Prune Posts plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- ramon fincken Auto Prune Posts
- Cross-site request forgery (CSRF)
Not analysed yet 13 Nov 2025
CVE-2025-64482 CVE record

CVSS 4.6 Medium

Tuleap missing CSRF protections in the File Release System
- Enalean tuleap
- Cross-site request forgery (CSRF)
Not analysed yet 12 Nov 2025
CVE-2025-64117 CVE record

CVSS 4.6 Medium

Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags
- Enalean tuleap
- Cross-site request forgery (CSRF)
Not analysed yet 12 Nov 2025
CVE-2025-12901 CVE record

CVSS 4.3 Medium

Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update
- Asgaros Forum
- Cross-site request forgery (CSRF)
Not analysed yet 12 Nov 2025
CVE-2025-60645 CVE record

CVSS 6.5 Medium

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.
- Cross-site request forgery (CSRF)
Not analysed yet 12 Nov 2025
CVE-2025-57310 CVE record

CVSS 8.8 High

A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code.
- Cross-site request forgery (CSRF)
Not analysed yet 12 Nov 2025
CVE-2025-12590 CVE record

CVSS 6.1 Medium

YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- andreaferracani YSlider
- Cross-site request forgery (CSRF)
Not analysed yet 11 Nov 2025
CVE-2025-12588 CVE record

CVSS 4.3 Medium

USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update
- behzadrohizadeh USB Qr Code Scanner For Woocommerce
- Cross-site request forgery (CSRF)
Not analysed yet 11 Nov 2025
CVE-2025-12132 CVE record

CVSS 4.3 Medium

WP Custom Admin Login Page Logo <= 1.4.8.4 - Cross-Site Request Forgery to Settings Update
- larsactionhero WP Custom Admin Login Page Logo
- Cross-site request forgery (CSRF)
Not analysed yet 11 Nov 2025
CVE-2025-12589 CVE record

CVSS 6.1 Medium

WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- baronen WP-Walla
- Cross-site request forgery (CSRF)
Not analysed yet 11 Nov 2025
CVE-2025-11886 CVE record

CVSS 4.3 Medium

CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation
- codethislab CTL Arcade Lite
- Cross-site request forgery (CSRF)
Not analysed yet 11 Nov 2025
CVE-2025-63712 CVE record

CVSS 4.5 Medium

Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System.
- Cross-site request forgery (CSRF)
Not analysed yet 10 Nov 2025
CVE-2025-63711 CVE record

CVSS 7.1 High

A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion…
- Cross-site request forgery (CSRF)
Not analysed yet 10 Nov 2025
CVE-2025-63710 CVE record

CVSS 6.5 Medium

The send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF).
- Cross-site request forgery (CSRF)
Not analysed yet 10 Nov 2025
CVE-2025-58469 CVE record

CVSS 1.2 Low

QuLog Center
- QNAP Systems Inc. QuLog Center
- Cross-site request forgery (CSRF)
Not analysed yet 7 Nov 2025
CVE-2025-63717 CVE record

CVSS 6.5 Medium

The change password functionality at /pet_grooming/admin/change_pass.php in SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks.
- Cross-site request forgery (CSRF)
Not analysed yet 7 Nov 2025
CVE-2025-63716 CVE record

CVSS 6.5 Medium

The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing operations.
- Cross-site request forgery (CSRF)
Not analysed yet 7 Nov 2025
CVE-2025-62950 CVE record

CVSS 4.3 Medium

WordPress Contest Gallery plugin <= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- Wasiliy Strecker / ContestGallery developer Contest Gallery
- Cross-site request forgery (CSRF)
Not analysed yet 6 Nov 2025
CVE-2025-53316 CVE record

CVSS 7.1 High

WordPress WP GDPR Cookie Consent plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Shahjahan Jewel WP GDPR Cookie Consent
- Cross-site request forgery (CSRF)
Not analysed yet 6 Nov 2025
CVE-2025-48085 CVE record

CVSS 7.1 High

WordPress Simple Stripe plugin <= 0.9.17 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- ZIPANG Simple Stripe
- Cross-site request forgery (CSRF)
Not analysed yet 6 Nov 2025
CVE-2025-48083 CVE record

CVSS 7.1 High

WordPress wpNamedUsers plugin <= 0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- andriassundskard wpNamedUsers
- Cross-site request forgery (CSRF)
Not analysed yet 6 Nov 2025
CVE-2025-48078 CVE record

CVSS 7.1 High

WordPress Slick Google Map plugin <= 0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- Norbert Slick Google Map
- Cross-site request forgery (CSRF)
Not analysed yet 6 Nov 2025
CVE-2025-48077 CVE record

CVSS 7.1 High

WordPress Block Country plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- nitinmaurya12 Block Country
- Cross-site request forgery (CSRF)
Not analysed yet 6 Nov 2025
CVE-2025-10691 CVE record

CVSS 4.3 Medium

Easy Email Subscription <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion
- yudiz Easy Email Subscription
- Cross-site request forgery (CSRF)
Not analysed yet 6 Nov 2025
CVE-2025-12403 CVE record

CVSS 6.1 Medium

Associados Amazon Plugin <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- revokee Associados Amazon Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12452 CVE record

CVSS 6.1 Medium

Visit Counter 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- bestiadurmiente Visit Counter
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12402 CVE record

CVSS 6.1 Medium

LinkedIn Resume <= 2.00 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- bondnono LinkedIn Resume
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12415 CVE record

CVSS 6.1 Medium

MapMap <= 1.1 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting
- sugiartha MapMap
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12456 CVE record

CVSS 6.1 Medium

Centangle Team Showcase <= 1.0.0 - Cross-Site Request Forgery To Plugin's Settings Modification And Stored Cross-Site Scripting
- Centangle-Team
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12400 CVE record

CVSS 6.1 Medium

LMB^Box Smileys <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- lmbbox LMB^Box Smileys
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12410 CVE record

CVSS 6.1 Medium

SH Contextual Help <= 3.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- samhoamt SH Contextual Help
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12413 CVE record

CVSS 5.4 Medium

Social Media WPCF7 Stop Words <= 1.1.3 - Cross-Site Request Forgery to Settings Update
- socialmedialtd WPCF7 Stop words
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12416 CVE record

CVSS 6.1 Medium

Pagerank Tools <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- mahype Pagerank tools
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025
CVE-2025-12412 CVE record

CVSS 6.1 Medium

Top Bar Notification <= 1.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- josereyev Top Bar Notification
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2025