Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-67534 CVE record

CVSS 7.1 High

WordPress Rencontre plugin <= 3.13.7 - Cross Site Request Forgery (CSRF) vulnerability
- Jacques Malgrange Rencontre
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67473 CVE record

CVSS 4.3 Medium

WordPress CWW Companion plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability
- codeworkweb CWW Companion
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67472 CVE record

CVSS 4.3 Medium

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67471 CVE record

CVSS 4.3 Medium

WordPress Quick Contact Form plugin <= 8.2.5 - Cross Site Request Forgery (CSRF) vulnerability
- Saad Iqbal Quick Contact Form
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67469 CVE record

CVSS 4.3 Medium

WordPress PDF Thumbnail Generator plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
- kubiq PDF Thumbnail Generator
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67465 CVE record

CVSS 4.3 Medium

WordPress Simple Link Directory plugin <= 8.8.3 - Cross Site Request Forgery (CSRF) vulnerability
- QuantumCloud Simple Link Directory
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-66531 CVE record

CVSS 4.3 Medium

WordPress Salon booking system plugin <= 10.30.3 - Cross Site Request Forgery (CSRF) vulnerability
- Dimitri Grassi Salon booking system
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-66529 CVE record

CVSS 4.3 Medium

WordPress Chartify plugin <= 3.6.3 - Cross Site Request Forgery (CSRF) vulnerability
- Ays Pro Chartify
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-64256 CVE record

CVSS 4.3 Medium

WordPress Simple Folio plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- PressTigers Simple Folio
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-11022 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

CSRF in Panilux
- Personal Project Panilux
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-65573 CVE record

CVSS 8.8 High

Cross Site Request Forgery (CSRF) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to cause a denial of service via function handle_interface_POST_and_status.
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-65962 CVE record

CVSS 4.6 Medium

Tuleap has missing CSRF protections its in tracker field dependencies
- Enalean tuleap
- Cross-site request forgery (CSRF)
Not analysed yet 8 Dec 2025
CVE-2025-64760 CVE record

CVSS 4.6 Medium

Tuleap has missing CSRF protections in its tracker trigger management system
- Enalean tuleap
- Cross-site request forgery (CSRF)
Not analysed yet 8 Dec 2025
CVE-2025-64499 CVE record

CVSS 4.6 Medium

Tuleap is missing CSRF protections for its planning management API
- Enalean tuleap
- Cross-site request forgery (CSRF)
Not analysed yet 8 Dec 2025
CVE-2025-64498 CVE record

CVSS 4.6 Medium

Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability
- Enalean tuleap
- Cross-site request forgery (CSRF)
Not analysed yet 8 Dec 2025
CVE-2025-42616 CVE record

CVSS 7.0 High

CSRF vulnerability in CIRCL Vulnerability-Lookup
- CIRCL Vulnerability-Lookup
- Cross-site request forgery (CSRF)
Not analysed yet 8 Dec 2025
CVE-2025-60912 CVE record

CVSS 3.3 Low

phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality.
- Cross-site request forgery (CSRF)
Not analysed yet 8 Dec 2025
CVE-2025-13629 CVE record

CVSS 4.3 Medium

WP Landing Page <= 0.9.3 - Cross-Site Request Forgery to Arbitrary Post Meta Update
- xbenx WP Landing Page
- Cross-site request forgery (CSRF)
Not analysed yet 6 Dec 2025
CVE-2025-14117 CVE record

CVSS 5.3 Medium

fit2cloud Halo cross-site request forgery
- fit2cloud Halo
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 6 Dec 2025
CVE-2025-66629 CVE record

CVSS 3.7 Low

HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF
- hedgedoc
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-12879 CVE record

CVSS 8.8 High

User Generator and Importer <= 1.2.2 - Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation
- vinoth06 User Generator and Importer
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-12130 CVE record

CVSS 4.3 Medium

WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion
- wcvendors WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-13684 CVE record

CVSS 4.3 Medium

ARK Related Posts <= 2.19 - Cross-Site Request Forgery to Settings Update
- alexkar ARK Related Posts
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-12373 CVE record

CVSS 4.3 Medium

Torod – The smart shipping and delivery portal for e-shops and retailers <= 1.9 - Cross-Site Request Forgery To Plugin's Settings Modification
- Torod – The smart shipping and delivery portal for e-shops and retailers
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-12190 CVE record

CVSS 4.3 Medium

Image Optimizer by wps.sk <= 1.2.0 - Cross-Site Request Forgery to Bulk Image Optimization
- duddi Image Optimizer by wps.sk
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-12189 CVE record

CVSS 4.3 Medium

Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload
- breadbutter Bread & Butter: AI-Powered Lead Intelligence
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-12128 CVE record

CVSS 4.3 Medium

Hide Categories Or Products On Shop Page <= 1.0.7 - Cross-Site Request Forgery to Settings Update
- kaushikankrani Hide Categories Or Products On Shop Page
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-10055 CVE record

CVSS 4.3 Medium

Time Sheets <= 2.1.3 - Cross-Site Request Forgery
- mrdenny Time Sheets
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-13360 CVE record

CVSS 4.3 Medium

Quantic Social Image Hover <= 1.0.8 - Cross-Site Request Forgery to Settings Update
- monkeyboz Quantic Social Image Hover
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-13621 CVE record

CVSS 6.1 Medium

dream gallery <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action
- teamdream dream gallery
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-13144 CVE record

CVSS 4.3 Medium

ContentStudio <= 1.3.7 - Cross-Site Request Forgery to Settings Update
- ContentStudio
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-13362 CVE record

CVSS 4.3 Medium

Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update
- jevgenisultanov Norby AI
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-11759 CVE record

CVSS 4.3 Medium

Backup, Restore and Migrate your sites with XCloner <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save()
- watchful Backup, Restore and Migrate your sites with XCloner
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2024-45538 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Cross-site request forgery in Synology DiskStation Manager (DSM) and others
- Synology DiskStation Manager (DSM)
- Synology Unified Controller (DSMUC)
- Cross-site request forgery (CSRF)
Not analysed yet 4 Dec 2025
CVE-2025-65027 CVE record

CVSS 7.6 High

RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover
- romm
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 3 Dec 2025
CVE-2025-12358 CVE record

CVSS 4.3 Medium

ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation
- roxnor ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
- Cross-site request forgery (CSRF)
Not analysed yet 3 Dec 2025
CVE-2025-13871 CVE record

CVSS 2.3 Low

The feature to manage resources is prone to Cross-Site Request Forgery attacks
- ObjectPlanet Opinio
- Cross-site request forgery (CSRF)
Not analysed yet 2 Dec 2025
CVE-2025-13140 CVE record

CVSS 4.3 Medium

SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletion
- devsoftbaltic SurveyJS: Drag & Drop Form Builder
- Cross-site request forgery (CSRF)
Not analysed yet 2 Dec 2025
CVE-2025-13685 CVE record

CVSS 4.3 Medium

Photo Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actions
- ays-pro Photo Gallery by Ays – Responsive Image Gallery
- Cross-site request forgery (CSRF)
Not analysed yet 2 Dec 2025
CVE-2025-13606 CVE record

CVSS 6.5 Medium

Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure
- smackcoders Export All Posts, Products, Orders, Refunds & Users
- Cross-site request forgery (CSRF)
Not analysed yet 2 Dec 2025
CVE-2024-53684 CVE record

CVSS 7.5 High

Cross-site request forgery in Socomec DIRIS Digiware M-70
- Socomec DIRIS Digiware M-70
- Cross-site request forgery (CSRF)
Not analysed yet 1 Dec 2025
CVE-2025-13296 CVE record

CVSS 5.4 Medium

CSRF in Tekrom Technology's T-Soft E-Commerce
- Tekrom Technology Inc. T-Soft E-Commerce
- Cross-site request forgery (CSRF)
Not analysed yet 1 Dec 2025
CVE-2025-65840 CVE record

CVSS 8.8 High

PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.
- Cross-site request forgery (CSRF)
Not analysed yet 1 Dec 2025
CVE-2025-13790 CVE record

CVSS 5.3 Medium

Scada-LTS cross-site request forgery
- Scada-LTS
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 30 Nov 2025
CVE-2025-53897 CVE record

CVSS 6.8 Medium

Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability
- kiteworks security-advisories
- Cross-site request forgery (CSRF)
Not analysed yet 29 Nov 2025
CVE-2025-13737 CVE record

CVSS 4.3 Medium

Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login
- nextendweb Nextend Social Login and Register
- Cross-site request forgery (CSRF)
Not analysed yet 28 Nov 2025
CVE-2025-51733 CVE record

CVSS 5.5 Medium

Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd.
- Cross-site request forgery (CSRF)
Not analysed yet 28 Nov 2025
CVE-2025-13143 CVE record

CVSS 4.3 Medium

Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.12.0 - Cross-Site Request Forgery to Account Disconnection
- assafp Quiz, Poll & Survey Maker by Opinion Stage
- Cross-site request forgery (CSRF)
Not analysed yet 27 Nov 2025
CVE-2025-12578 CVE record

CVSS 4.3 Medium

Reuters Direct <= 3.0.0 - Cross-Site Request Forgery to Settings Reset
- rnags Reuters Direct
- Cross-site request forgery (CSRF)
Not analysed yet 27 Nov 2025
ray PyPI

CVSS 9.4 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack
- Code injection
- Cross-site request forgery (CSRF)
<2.52.0 · fixed in 2.52.0

GHSA-q279-jhrf-cc6v · CVE-2025-62593 Not analysed yet 26 Nov 2025
CVE-2025-12061 CVE record

CVSS 8.6 High

Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution
- TAX SERVICE Electronic HDM
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 26 Nov 2025
CVE-2025-12587 CVE record

CVSS 4.3 Medium

Peer Publish <= 1.0 - Cross-Site Request Forgery
- webgarh Peer Publish
- Cross-site request forgery (CSRF)
Not analysed yet 25 Nov 2025
CVE-2025-12586 CVE record

CVSS 4.3 Medium

Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery
- evolurise Conditionnal Maintenance Mode for WordPress
- Cross-site request forgery (CSRF)
Not analysed yet 25 Nov 2025
CVE-2025-62497 CVE record

CVSS 2.1 Low

Cross-site request forgery in Sony Corporation SNC-CX600W
- Sony Corporation SNC-CX600W
- Cross-site request forgery (CSRF)
Not analysed yet 25 Nov 2025
CVE-2025-60739 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code…
- Cross-site scripting (XSS)
- Information disclosure
Not analysed yet 25 Nov 2025
CVE-2025-63953 CVE record

CVSS 6.5 Medium

A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
- Cross-site request forgery (CSRF)
Not analysed yet 24 Nov 2025
CVE-2025-63952 CVE record

CVSS 5.7 Medium

A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
- Cross-site request forgery (CSRF)
Not analysed yet 24 Nov 2025
CVE-2025-56400 CVE record

CVSS 8.8 High

Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third…
- Cross-site request forgery (CSRF)
- Authentication bypass
Not analysed yet 24 Nov 2025
CVE-2025-65107 CVE record

CVSS 6.5 Medium

Langfuse SSO Account Takeover via CSRF or phishing attack
- langfuse
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 21 Nov 2025
CVE-2025-11087 CVE record

CVSS 8.8 High

Zegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload
- zozothemes Zegen Core
- Cross-site request forgery (CSRF)
Not analysed yet 21 Nov 2025