CWE-352 · Cross-Site Request Forgery (CSRF) (page 14)
Page 14 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8383 | Medium | 4.3 | 2025-10-31 | The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect no… |
CVE-2023-53688 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component. An att… |
CVE-2025-10317 | | 2025-10-30 | Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. Malicious attacker can craft special website, which when visited by t… | |
CVE-2025-10930 | Medium | 4.3 | 2025-10-30 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0. |
CVE-2025-62797 | | 2025-10-29 | FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based w… | |
CVE-2025-12479 | High | 8.8 | 2025-10-29 | Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-64149 | Medium | 5.4 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified U… |
CVE-2025-64141 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2025-64138 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specif… |
CVE-2025-64136 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server. |
CVE-2025-64133 | Medium | 5.4 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandb… |
CVE-2024-45161 | Medium | 4.6 | 2025-10-29 | A CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507. This can be exploited via a URL, an image load, an XMLHttpReques… |
CVE-2025-64290 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Cross Site Request Forgery.This i… |
CVE-2025-64288 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a throu… |
CVE-2025-64286 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in WpEstate WP Rentals wprentals allows Cross Site Request Forgery.This issue affects WP Rentals: from n/a thro… |
CVE-2025-64226 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in colabrio Stockie Extra stockie-extra allows Cross Site Request Forgery.This issue affects Stockie Extra: fro… |
CVE-2025-64201 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Pod… |
CVE-2025-60075 | High | 7.1 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Allegro Marketing hpb seo plugin for WordPress hpbseo allows Reflected XSS.This issue affects hpb seo plugin… |
CVE-2025-58939 | Medium | 4.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in highwarden Super Store Finder superstorefinder-wp allows Cross Site Request Forgery.This issue affects Super… |
CVE-2025-57931 | Medium | 5.3 | 2025-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a thr… |
CVE-2025-55758 | Medium | 5.4 | 2025-10-28 | Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered. |
CVE-2025-62258 | Medium | 6.5 | 2025-10-27 | CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA thr… |
CVE-2025-54969 | Medium | 6.1 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers… |
CVE-2025-34133 | | 2025-10-27 | Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that c… | |
CVE-2025-11154 | Medium | 5.4 | 2025-10-27 | The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers… |
CVE-2025-58918 | Medium | 4.3 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Waituk Entrada theme allows Cross Site Request Forgery.This issue affects Entrada: from n/a through 5.7.7. |
CVE-2025-62986 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in FanBridge FanBridge signup fanbridge-signup allows Stored XSS.This issue affects FanBridge signup: from n/a… |
CVE-2025-62975 | Medium | 4.3 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in raychat Raychat raychat allows Cross Site Request Forgery.This issue affects Raychat: from n/a through <= 2… |
CVE-2025-62962 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio CloudSearch cloud-search allows Stored XSS.This issue affects CloudSearch: from n/a through… |
CVE-2025-62958 | Medium | 4.3 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Clifton Griffin Simple Content Templates for Blog Posts & Pages simple-post-template allows Cross Site Reque… |
CVE-2025-62957 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in NikanWP NikanWP WooCommerce Reporting wc-reports-lite allows Stored XSS.This issue affects NikanWP WooCommer… |
CVE-2025-62956 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in iseremet Reloadly reloadly-topup-widget allows Stored XSS.This issue affects Reloadly: from n/a through <= 2… |
CVE-2025-62945 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Eduard Pinuaga Linares Did Prestashop Display did-prestashop-display allows Stored XSS.This issue affects Di… |
CVE-2025-62934 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Mejar WP Business Hours wp-business-hours allows Stored XSS.This issue affects WP Business Hours: from n/a t… |
CVE-2025-62933 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Prakash Awesome Testimonials awesome-testimonials allows Stored XSS.This issue affects Awesome Testimonials… |
CVE-2025-62896 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Stored XSS.This issue affects Multilang C… |
CVE-2025-62891 | Medium | 4.3 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows Cross Site Request Forgery… |
CVE-2025-62890 | Medium | 4.3 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Brands for WooCommerce premmerce-woocommerce-brands allows Cross Site Request Forgery.Th… |
CVE-2025-62886 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Pricing Table builder wpdevart-pricing-table allows Stored XSS.This issue affects Pricing Table bui… |
CVE-2025-12202 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects un… |
CVE-2025-12221 | High | 8.8 | 2025-10-25 | Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-11976 | Medium | 4.3 | 2025-10-25 | The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to… |
CVE-2025-12095 | High | 8.8 | 2025-10-25 | The Simple Registration for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.8. This is d… |
CVE-2025-12072 | Medium | 4.3 | 2025-10-24 | The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. Th… |
CVE-2025-12028 | High | 8.8 | 2025-10-24 | The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verifi… |
CVE-2025-56009 | Medium | 5.3 | 2025-10-23 | Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take over the device via adding additional… |
CVE-2025-62061 | Medium | 4.3 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in impleCode Product Catalog Simple post-type-x.This issue affects Product Catalog Simple: from n/a through <=… |
CVE-2025-62009 | Medium | 4.3 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Cross Site Re… |
CVE-2025-62005 | High | 7.1 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Cross Site Request Forgery.This iss… |
CVE-2025-60208 | High | 8.8 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Tusko Trush Advanced Custom Fields : CPT Options Pages acf-cpt-options-pages allows Object Injection.This is… |
CVE-2025-60168 | High | 7.1 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in integrationshotelrunner HotelRunner Booking Widget hotelrunner allows Stored XSS.This issue affects HotelRun… |
CVE-2025-60134 | Medium | 4.3 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affec… |
CVE-2025-60132 | High | 7.1 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Stored XSS.This issue affects Video Blogster Lite: fr… |
CVE-2025-49373 | Medium | 4.3 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Cross Site Request Forgery… |
CVE-2025-48099 | Medium | 4.7 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter… |
CVE-2025-10588 | Medium | 4.3 | 2025-10-22 | The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2025-62771 | High | 7.5 | 2025-10-22 | Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks. |
CVE-2025-47410 | High | 8.8 | 2025-10-18 | Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user i… |
CVE-2025-9890 | High | 8.8 | 2025-10-18 | The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrec… |
CVE-2025-41254 | Medium | 4.3 | 2025-10-16 | STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and V… |
CVE-2025-10700 | Medium | 4.3 | 2025-10-16 | The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is… |
CVE-2025-10312 | Medium | 4.3 | 2025-10-15 | The Theme Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce val… |
CVE-2025-10301 | Medium | 4.3 | 2025-10-15 | The FunKItools plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrec… |
CVE-2025-10300 | Medium | 4.3 | 2025-10-15 | The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect no… |
CVE-2025-60535 | High | 7.3 | 2025-10-14 | A Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a craft… |
CVE-2025-59428 | Medium | 5.4 | 2025-10-14 | EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including adm… |
CVE-2025-7330 | Medium | 6.5 | 2025-10-14 | A cross-site request forgery security issue exists in the product and version listed. The vulnerability stems from missing CSRF checks on the impacted form. Th… |
CVE-2025-42908 | Medium | 5.4 | 2025-10-14 | Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions di… |
CVE-2025-9626 | Medium | 4.3 | 2025-10-11 | The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorre… |
CVE-2025-9621 | Medium | 4.3 | 2025-10-11 | The WidgetPack Comment System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to miss… |
CVE-2025-8606 | Low | 2.4 | 2025-10-11 | The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due… |
CVE-2025-10376 | Medium | 4.3 | 2025-10-11 | The Course Redirects for Learndash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4. This is due to m… |
CVE-2025-10375 | Medium | 4.3 | 2025-10-11 | The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to… |
CVE-2025-62245 | Medium | 4.3 | 2025-10-10 | Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023… |
CVE-2025-61930 | High | 8.1 | 2025-10-10 | Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password chan… |
CVE-2025-43296 | Medium | 5.5 | 2025-10-09 | A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26. An app may bypass Gatekeeper checks. |
CVE-2025-11166 | Medium | 5.4 | 2025-10-09 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46… |
CVE-2025-11442 | Medium | 4.3 | 2025-10-08 | A security flaw has been discovered in JhumanJ OpnForm up to 1.9.3. The impacted element is an unknown function of the component API Endpoint. The manipulation… |
CVE-2025-60956 | High | 8.0 | 2025-10-06 | Cross Site Request Forgery (CSRF) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to exec… |
CVE-2025-9886 | Medium | 4.3 | 2025-10-04 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versio… |
CVE-2025-9945 | Medium | 4.3 | 2025-10-03 | The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing o… |
CVE-2025-9897 | Medium | 4.3 | 2025-10-03 | The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incor… |
CVE-2025-9895 | Medium | 4.3 | 2025-10-03 | The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or inco… |
CVE-2025-9892 | Medium | 5.3 | 2025-10-03 | The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to mis… |
CVE-2025-9889 | Medium | 4.3 | 2025-10-03 | The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to mi… |
CVE-2025-9885 | Medium | 4.3 | 2025-10-03 | The MPWizard – Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1… |
CVE-2025-9884 | Medium | 6.1 | 2025-10-03 | The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing o… |
CVE-2025-9630 | Medium | 4.3 | 2025-10-03 | The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect… |
CVE-2025-9213 | High | 8.8 | 2025-10-03 | The TextBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1.0.0 to 1.1.1. This is due to missing or incorrect nonce validati… |
CVE-2025-8669 | Medium | 4.3 | 2025-10-03 | The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the re… |
CVE-2025-10311 | Medium | 4.3 | 2025-10-03 | The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing… |
CVE-2025-10309 | Medium | 4.3 | 2025-10-03 | The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce val… |
CVE-2025-10302 | Medium | 4.3 | 2025-10-03 | The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or i… |
CVE-2025-61604 | High | 7.1 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerabilit… |
CVE-2025-54286 | High | 8.8 | 2025-10-02 | Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user c… |
CVE-2025-9948 | Medium | 4.3 | 2025-09-30 | The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or inc… |
CVE-2025-9946 | Medium | 6.1 | 2025-09-30 | The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is… |
CVE-2025-8119 | Medium | 4.3 | 2025-09-30 | PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the… |
CVE-2025-7052 | High | 8.8 | 2025-09-30 | The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.94. This is due to missing nonce valid… |
CVE-2025-35030 | High | 8.1 | 2025-09-29 | Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrativ… |