Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-58999 CVE record

CVSS 4.3 Medium

WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Cross Site Request Forgery (CSRF) vulnerability
- loopus WP Attractive Donations System - Easy Stripe & Paypal donations
- Cross-site request forgery (CSRF)
Not analysed yet 16 Dec 2025
CVE-2025-65593 CVE record

CVSS 8.8 High

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.
- Cross-site request forgery (CSRF)
Not analysed yet 16 Dec 2025
CVE-2025-14394 CVE record

CVSS 4.3 Medium

Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update
- melodicmedia Popover Windows
- Cross-site request forgery (CSRF)
Not analysed yet 13 Dec 2025
CVE-2025-14462 CVE record

CVSS 4.3 Medium

Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update
- owais4377 Lucky Draw Contests
- Cross-site request forgery (CSRF)
Not analysed yet 13 Dec 2025
CVE-2025-14454 CVE record

CVSS 4.3 Medium

Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion
- ays-pro Image Slider by Ays- Responsive Slider and Carousel
- Cross-site request forgery (CSRF)
Not analysed yet 13 Dec 2025
CVE-2025-13970 CVE record

CVSS 7.0 High

OpenPLC_V3 Cross-Site Request Forgery
- OpenPLC_V3
- Cross-site request forgery (CSRF)
Not analysed yet 13 Dec 2025
CVE-2025-12407 CVE record

CVSS 4.3 Medium

Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-14159 CVE record

CVSS 4.3 Medium

Secure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data Export
- ays-pro Secure Copy Content Protection and Content Locking
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-10684 CVE record

CVSS 4.3 Medium

Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation
- Construction Light
- Authentication bypass
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-58576 CVE record

CVSS 5.1 Medium

Cross-site request forgery in Japan Total System Co.,Ltd. GroupSession Free edition and others
- Japan Total System Co.,Ltd. GroupSession Free edition
- Japan Total System Co.,Ltd. GroupSession byCloud
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-14391 CVE record

CVSS 4.3 Medium

Simple Theme Changer <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update
- darendev Simple Theme Changer
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-13366 CVE record

CVSS 4.3 Medium

Rabbit Hole <= 1.1 - Cross-Site Request Forgery to Settings Reset
- frapesce Rabbit Hole
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-14160 CVE record

CVSS 4.3 Medium

Upcoming for Calendly <= 1.2.4 - Cross-Site Request Forgery to Settings Update
- justdave Upcoming for Calendly
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-13987 CVE record

CVSS 4.3 Medium

Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion
- codnloc Purchase and Expense Manager
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-14062 CVE record

CVSS 4.3 Medium

Animated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter
- tekafran Animated Pixel Marquee Creator
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-14161 CVE record

CVSS 4.3 Medium

Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update
- Truefy Embed
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-14354 CVE record

CVSS 4.3 Medium

Resource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions
- doubledome Resource Library for Logged In Users
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-14165 CVE record

CVSS 4.3 Medium

Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update
- developerke Kirim.Email WooCommerce Integration
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-13363 CVE record

CVSS 4.3 Medium

IMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update
- imaqpress IMAQ CORE
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-14158 CVE record

CVSS 4.3 Medium

Coding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update
- octagonsimon Coding Blocks
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-13408 CVE record

CVSS 4.3 Medium

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection
- foxtheme Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-14162 CVE record

CVSS 4.3 Medium

BMLT WordPress Plugin <= 3.11.4 - Cross-Site Request Forgery to Settings Creation and Deletion
- magblogapi BMLT WordPress Satellite
- Cross-site request forgery (CSRF)
Not analysed yet 12 Dec 2025
CVE-2025-65472 CVE record

CVSS 8.8 High

A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malic…
- Cross-site request forgery (CSRF)
Not analysed yet 11 Dec 2025
CVE-2025-67646 CVE record

CVSS 3.5 Low

TableProgressTracking's missing CSRF protection allows unauthorized state changes
- Telepedia TableProgressTracking
- Cross-site request forgery (CSRF)
Not analysed yet 10 Dec 2025
github.com/1Panel-dev/1Panel Go

CVSS 7.0 High

1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality
- Cross-site request forgery (CSRF)
>=1.10.33, <=2.0.15 · no fixed version yet

GHSA-wrvc-x3wf-j5f5 · CVE-2025-34429 Not analysed yet 10 Dec 2025
github.com/1Panel-dev/1Panel Go

CVSS 5.1 Medium

1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name management functionality
- Cross-site request forgery (CSRF)
>=1.10.33, <=2.0.15 · no fixed version yet

GHSA-5xpq-2vmc-5cqp · CVE-2025-34430 Not analysed yet 10 Dec 2025
CVE-2020-36901 CVE record

CVSS 8.6 High

UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management
- UBICOD Co., Ltd. | MEDIVISION INC. UBICOD Medivision Digital Signage
- Cross-site request forgery (CSRF)
Not analysed yet 10 Dec 2025
CVE-2020-36900 CVE record

CVSS 8.6 High

All-Dynamics Digital Signage System 2.0.2 Cross-Site Request Forgery via User Management
- All-Dynamics Software GmbH Digital Signage System
- Cross-site request forgery (CSRF)
Not analysed yet 10 Dec 2025
CVE-2020-36886 CVE record

CVSS 6.9 Medium

SpinetiX Fusion Digital Signage 3.4.8 Cross-Site Request Forgery via User Creation
- SpenetiX AG Fusion Digital Signage
- Cross-site request forgery (CSRF)
Not analysed yet 10 Dec 2025
org.jenkins-ci.main:jenkins-core Maven

CVSS 3.5 Low

Jenkins has a CSRF vulnerability on the login form
- Cross-site request forgery (CSRF)
>=2.529, <2.541 || <2.528.3 · fixed in 2.541, 2.528.3

GHSA-6837-qgrc-x5p6 · CVE-2025-67639 Not analysed yet 10 Dec 2025
github.com/1Panel-dev/1Panel Go

CVSS 7.0 High

1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username functionality
- Cross-site request forgery (CSRF)
>=1.10.33, <=2.0.15 · no fixed version yet

GHSA-rpr2-4hqj-hc4q · CVE-2025-34410 Not analysed yet 10 Dec 2025
CVE-2021-47730 CVE record

CVSS 8.5 High

Selea Targa IP Camera Cross-Site Request Forgery via Admin Creation
- Selea s.r.l. Selea Targa IP OCR-ANPR Camera
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2021-47723 CVE record

CVSS 6.9 Medium

STVS ProVision Cross-Site Request Forgery (Add Admin)
- STVS SA STVS ProVision
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2021-47702 CVE record

CVSS 5.3 Medium

OpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.php
- OPEN BMCS OpenBMCS
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-13924 CVE record

CVSS 4.3 Medium

Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication
- maartenbelmans Advanced Product Fields (Product Addons) for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2023-22675 CVE record

CVSS 4.3 Medium

WordPress WP Fast Cache plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability
- Taylor Hawkes WP Fast Cache
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67467 CVE record

CVSS 5.4 Medium

WordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerability
- StellarWP GiveWP
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-63060 CVE record

CVSS 4.3 Medium

WordPress KALLYAS theme < 4.25.0 - Cross Site Request Forgery (CSRF) vulnerability
- hogash KALLYAS
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-63030 CVE record

CVSS 7.1 High

WordPress New User Approve plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability
- Saad Iqbal New User Approve
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-63012 CVE record

CVSS 4.3 Medium

WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability
- ThimPress WP Hotel Booking
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-62873 CVE record

CVSS 4.3 Medium

WordPress WP Flashy Marketing Automation plugin <= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability
- Flashyapp WP Flashy Marketing Automation
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-62872 CVE record

CVSS 4.3 Medium

WordPress Social Photo Fetcher plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability
- JK Social Photo Fetcher
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-62871 CVE record

CVSS 4.3 Medium

WordPress Just TinyMCE Custom Styles plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability
- Alex Prokopenko / JustCoded Just TinyMCE Custom Styles
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-62866 CVE record

CVSS 4.3 Medium

WordPress Auto Alt Text plugin <= 2.5.2 - Cross Site Request Forgery (CSRF) vulnerability
- Valerio Monti Auto Alt Text
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-62762 CVE record

CVSS 4.3 Medium

WordPress SMTP Mail plugin <= 1.3.51 - Cross Site Request Forgery (CSRF) vulnerability
- photoboxone SMTP Mail
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-62739 CVE record

CVSS 6.5 Medium

WordPress Add Custom Codes plugin <= 4.80 - Cross Site Request Forgery (CSRF) vulnerability
- SaifuMak Add Custom Codes
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-62734 CVE record

CVSS 4.3 Medium

WordPress Media Library Downloader plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
- M.Code Media Library Downloader
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-62733 CVE record

CVSS 4.3 Medium

WordPress Custom Sidebars by ProteusThemes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability
- Custom Sidebars by ProteusThemes
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-62103 CVE record

CVSS 4.3 Medium

WordPress Media Library File Download plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
- wpmediadownload Media Library File Download
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-62102 CVE record

CVSS 4.3 Medium

WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability
- apasionados DoFollow Case by Case
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-59132 CVE record

CVSS 4.3 Medium

WordPress Duplicate Content Cure plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability
- Badi Jones Duplicate Content Cure
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-49351 CVE record

CVSS 7.1 High

WordPress Create Posts & Terms plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- Valentin Agachi Create Posts & Terms
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-49347 CVE record

CVSS 7.1 High

WordPress WP sIFR plugin <= 0.6.8.1 - Cross Site Request Forgery (CSRF) vulnerability
- Jupitercow WP sIFR
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-49341 CVE record

CVSS 7.1 High

WordPress PDF Creator Lite plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability
- Alex Furr PDF Creator Lite
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67598 CVE record

CVSS 4.3 Medium

WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability
- PSM Plugins SupportCandy
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67596 CVE record

CVSS 4.3 Medium

WordPress Business Directory plugin <= 6.4.19 - Cross Site Request Forgery (CSRF) vulnerability
- Strategy11 Team Business Directory
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67595 CVE record

CVSS 4.3 Medium

WordPress Quiz Maker plugin <= 6.7.0.82 - Cross Site Request Forgery (CSRF) vulnerability
- Ays Pro Quiz Maker
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67593 CVE record

CVSS 4.3 Medium

WordPress UsersWP plugin <= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerability
- Stiofan UsersWP
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67591 CVE record

CVSS 4.3 Medium

WordPress JNews Paywall plugin < 12.0.1 - Cross Site Request Forgery (CSRF) vulnerability
- jegtheme JNews Paywall
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-67590 CVE record

CVSS 4.3 Medium

WordPress Ultimate FAQ plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability
- Rustaurius Ultimate FAQ
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025