Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-15377 CVE record

CVSS 4.3 Medium

Sosh Share Buttons <= 1.1.0 - Cross-Site Request Forgery
- abage Sosh Share Buttons
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jan 2026
CVE-2025-14389 CVE record

CVSS 4.3 Medium

WPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update
- obridgeacademy WPBlogSyn
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jan 2026
CVE-2025-14615 CVE record

CVSS 7.1 High

DASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery to SQL Injection
- dashboardbuilder DASHBOARD BUILDER – WordPress plugin for Charts and Graphs
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jan 2026
CVE-2026-0493 CVE record

CVSS 4.3 Medium

Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation)
- SAP_SE SAP Fiori App (Intercompany Balance Reconciliation)
- Cross-site request forgery (CSRF)
Not analysed yet 13 Jan 2026
CVE-2026-22800 CVE record

CVSS 2.4 Low

PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences
- THM-Health PILOS
- Cross-site request forgery (CSRF)
Not analysed yet 12 Jan 2026
CVE-2021-41074 CVE record

CVSS 5.4 Medium

A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.
- Cross-site request forgery (CSRF)
Not analysed yet 12 Jan 2026
CVE-2025-14976 CVE record

CVSS 5.4 Medium

User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion
- wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jan 2026
CVE-2026-22194 CVE record

CVSS 8.9 High

GestSup <= 3.2.60 CSRF Allows Privileged Actions
- GestSup
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jan 2026
CVE-2025-13749 CVE record

CVSS 4.3 Medium

Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering
- creativemotion Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jan 2026
authlib PyPI

CVSS 5.7 Medium

Authlib has 1-click Account Takeover vulnerability
- Cross-site request forgery (CSRF)
>=1.0.0, <1.6.6 · fixed in 1.6.6

GHSA-fg6f-75jq-6523 · CVE-2025-68158 Not analysed yet 8 Jan 2026
react-router +1 npm

CVSS 6.5 Medium

React Router has CSRF issue in Action/Server Action Request Processing
- Cross-site request forgery (CSRF)
- CWE-346
>=7.0.0, <7.12.0 · fixed in 7.12.0

GHSA-h5cw-625j-3rxh · CVE-2026-22030 Not analysed yet 8 Jan 2026
CVE-2025-61547 CVE record

CVSS 6.8 Medium

Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76).
- Cross-site request forgery (CSRF)
Not analysed yet 8 Jan 2026
CVE-2019-25259 CVE record

CVSS 5.1 Medium

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 Cross-Site Request Forgery
- Leica Geosystems AG Leica Geosystems GR10/GR25/GR30/GR50 GNSS
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-14077 CVE record

CVSS 4.3 Medium

Simcast <= 1.0.0 - Cross-Site Request Forgery to Settings Update
- openchamp Simcast
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-13990 CVE record

CVSS 4.3 Medium

Mamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation
- Mamurjor Employee Info
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-14465 CVE record

CVSS 4.3 Medium

Sticky Action Buttons <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update
- praveentamil Sticky Action Buttons
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-13521 CVE record

CVSS 4.3 Medium

WP Status Notifier <= 1.0 - Cross-Site Request Forgery to Settings Update
- fulippo WP Status Notifier
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-13520 CVE record

CVSS 4.3 Medium

MTCaptcha WordPress Plugin <= 2.7.2 - Cross-Site Request Forgery to Settings Update
- MTCaptcha WordPress Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-13527 CVE record

CVSS 4.3 Medium

xShare <= 1.0.1 - Cross-Site Request Forgery to 'rs_plugin_reset' Parameter
- anwerashif xShare
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-14999 CVE record

CVSS 4.3 Medium

Latest Tabs <= 1.5 - Cross-Site Request Forgery to Plugin's Settings Update
- kentothemes Latest Tabs
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-13519 CVE record

CVSS 6.1 Medium

SVG Map Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting
- SVG Map by Smjrifle
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-31963 CVE record

CVSS 2.9 Low

HCL BigFix IVR is impacted by improper authentication and missing CSRF protection
- HCLSoftware BigFix IVR
- Authentication bypass
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-14845 CVE record

CVSS 4.3 Medium

NS IE Compatibility Fixer <= 2.1.5 - Cross-Site Request Forgery to Plugin Settings Update
- nsthemes NS Ie Compatibility Fixer
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-13657 CVE record

CVSS 4.3 Medium

HelpDesk contact form plugin <= 1.1.5 - Cross-Site Request Forgery to Settings Update via handle_query_args
- helpdeskcom HelpDesk Contact Form
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-14904 CVE record

CVSS 4.3 Medium

Newsletter Email Subscribe <= 2.4 - Cross-Site Request Forgery to Plugin Settings Update
- anilankola Newsletter Email Subscribe
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2025-14468 CVE record

CVSS 4.3 Medium

AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2020-36918 CVE record

CVSS 5.1 Medium

iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery via User Management
- Yerootech iDS6 DSSPro Digital Signage System
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jan 2026
CVE-2020-36908 CVE record

CVSS 5.1 Medium

Secure Computing SnapGear Management Console SG560 3.1.5 Cross-Site Request Forgery via Admin Users
- Secure Computing SnapGear Management Console SG560
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jan 2026
CVE-2020-36906 CVE record

CVSS 5.3 Medium

P5 FNIP-8x16A FNIP-4xSH 1.0.20 Cross-Site Request Forgery via User Management
- P5 FNIP-8x16A
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jan 2026
CVE-2025-53344 CVE record

CVSS 4.3 Medium

WordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability
- ThimPress Thim Core
- Cross-site request forgery (CSRF)
Not analysed yet 5 Jan 2026
CVE-2023-52212 CVE record

CVSS 5.4 Medium

WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- Automattic WP Job Manager
- Cross-site request forgery (CSRF)
Not analysed yet 5 Jan 2026
CVE-2026-21430 CVE record

CVSS 7.0 High

Emlog: CSRF chained with stored XSS leads to ATO
- emlog
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jan 2026
CVE-2025-15405 CVE record

CVSS 5.3 Medium

PHPEMS cross-site request forgery
- PHPEMS
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 1 Jan 2026
CVE-2025-31054 CVE record

CVSS 7.1 High

WordPress Bloggie theme <= 2.0.8 - Cross Site Scripting (XSS) Vulnerability
- Themefy Bloggie
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62101 CVE record

CVSS 4.3 Medium

WordPress Pardakht Delkhah plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- Omid Shamloo Pardakht Delkhah
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62113 CVE record

CVSS 4.3 Medium

WordPress Co-marquage service-public.fr plugin <= 0.5.77 - Cross Site Request Forgery (CSRF) vulnerability
- emendo_seb Co-marquage service-public.fr
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62123 CVE record

CVSS 4.3 Medium

WordPress WP Gmail SMTP plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability
- inkthemes WP Gmail SMTP
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-63040 CVE record

CVSS 4.3 Medium

WordPress Post Snippets plugin <= 4.0.11 - Cross Site Request Forgery (CSRF) vulnerability
- Saad Iqbal Post Snippets
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-59130 CVE record

CVSS 4.3 Medium

WordPress Appointify plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability
- Appointify
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62133 CVE record

CVSS 4.3 Medium

WordPress FormFacade plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability
- manidoraisamy FormFacade
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-63014 CVE record

CVSS 4.3 Medium

WordPress Gmedia Photo Gallery plugin <= 1.25.0 - Cross Site Request Forgery (CSRF) vulnerability
- Serhii Pasyuk Gmedia Photo Gallery
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62089 CVE record

CVSS 4.3 Medium

WordPress Mergado Pack plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability
- Mergado Pack
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62084 CVE record

CVSS 4.3 Medium

WordPress iNext Woo Pincode Checker plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- Imdad Next Web iNext Woo Pincode Checker
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62148 CVE record

CVSS 4.3 Medium

WordPress Robots.txt rewrite plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability
- Eugen Bobrowski Robots.txt rewrite
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62080 CVE record

CVSS 4.3 Medium

WordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Cross Site Request Forgery (CSRF) vulnerability
- Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62117 CVE record

CVSS 5.4 Medium

WordPress EasyIndex plugin <= 1.1.1704 - Cross Site Request Forgery (CSRF) vulnerability
- Jayce53 EasyIndex
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62120 CVE record

CVSS 5.4 Medium

WordPress OpenHook plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- Rick Beckman OpenHook
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62134 CVE record

CVSS 5.4 Medium

WordPress Contact Form Widget plugin <= 1.5.1 - Cross Site Request Forgery (CSRF) vulnerability
- A WP Life Contact Form Widget
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-49028 CVE record

CVSS 7.1 High

WordPress Zoho ZeptoMail plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- Zoho Mail Zoho ZeptoMail
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-62992 CVE record

CVSS 6.5 Medium

WordPress Everest Backup plugin <= 2.3.11 - Cross Site Request Forgery (CSRF) vulnerability
- everestthemes Everest Backup
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-49342 CVE record

CVSS 7.1 High

WordPress Custom Style plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability
- merzedes Custom Style
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-49353 CVE record

CVSS 7.1 High

WordPress Noindex by Path plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability
- Marcin Kijak Noindex by Path
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-68885 CVE record

CVSS 7.1 High

WordPress Custom Post Status plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- page-carbajal Custom Post Status
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-49354 CVE record

CVSS 7.1 High

WordPress Recent Posts From Each Category plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
- Mindstien Technologies Recent Posts From Each Category
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-49343 CVE record

CVSS 7.1 High

WordPress Social Profilr plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability
- socialprofilr Social Profilr
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-49344 CVE record

CVSS 7.1 High

WordPress SensitiveTagCloud plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability
- reneade SensitiveTagCloud
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-49345 CVE record

CVSS 7.1 High

WordPress WP-EasyArchives plugin <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability
- mg12 WP-EasyArchives
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-49346 CVE record

CVSS 7.1 High

WordPress Simple Archive Generator plugin <= 5.2 - Cross Site Request Forgery (CSRF) vulnerability
- peterwsterling Simple Archive Generator
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-59137 CVE record

CVSS 7.1 High

WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability
- eleopard Behance Portfolio Manager
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025
CVE-2025-59131 CVE record

CVSS 7.1 High

WordPress WP-CalDav2ICS plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability
- hoernerfranz WP-CalDav2ICS
- Cross-site request forgery (CSRF)
Not analysed yet 30 Dec 2025