CWE-352 · Cross-Site Request Forgery (CSRF) (page 14)
Page 14 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-50255 | High | 7.8 | 2025-09-18 | Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request. |
CVE-2025-54390 | Medium | 6.3 | 2025-09-17 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswor… |
CVE-2025-10188 | Medium | 5.4 | 2025-09-17 | The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is… |
CVE-2025-9891 | Medium | 4.3 | 2025-09-17 | The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to m… |
CVE-2025-9629 | Medium | 4.3 | 2025-09-17 | The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect… |
CVE-2025-56710 | High | 7.3 | 2025-09-15 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. This fl… |
CVE-2025-9881 | Medium | 6.1 | 2025-09-12 | The Ultimate Blogroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or i… |
CVE-2025-9880 | Medium | 6.1 | 2025-09-12 | The Side Slide Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missi… |
CVE-2025-9635 | Medium | 4.3 | 2025-09-11 | The Analytics Reduce Bounce Rate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to mis… |
CVE-2025-9634 | Medium | 4.3 | 2025-09-11 | The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing o… |
CVE-2025-9633 | Medium | 4.3 | 2025-09-11 | The LH Signing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.83. This is due to missing or incorrect… |
CVE-2025-9632 | Medium | 4.3 | 2025-09-11 | The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorr… |
CVE-2025-9631 | Medium | 4.3 | 2025-09-11 | The AutoCatSet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.4. This is due to missing or incorrec… |
CVE-2025-9628 | Medium | 4.3 | 2025-09-11 | The The integration of the AMO.CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to… |
CVE-2025-9627 | Medium | 4.3 | 2025-09-11 | The Run Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.10. This is due to missing or incorrect… |
CVE-2025-9623 | Medium | 4.3 | 2025-09-11 | The Admin in English with Switch plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to mis… |
CVE-2025-9620 | Medium | 6.1 | 2025-09-11 | The Seo Monster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.3. This is due to missing or incorre… |
CVE-2025-9617 | Medium | 5.3 | 2025-09-11 | The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or inco… |
CVE-2025-8481 | Medium | 4.3 | 2025-09-11 | The Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.1.7. This… |
CVE-2025-8479 | Medium | 4.3 | 2025-09-11 | The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect no… |
CVE-2025-9888 | Medium | 4.3 | 2025-09-10 | The Maspik – Ultimate Spam Protection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.6. This is due… |
CVE-2025-9622 | Medium | 4.3 | 2025-09-10 | The WP Blast | SEO & Performance Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.6. This is… |
CVE-2025-58430 | Medium | 6.1 | 2025-09-09 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the sessio… |
CVE-2025-54256 | High | 8.6 | 2025-09-09 | Dreamweaver Desktop versions 21.5 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in arbitrary code execution i… |
CVE-2025-58997 | Critical | 9.6 | 2025-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Frenify Mow mow allows Code Injection.This issue affects Mow: from n/a through <= 4.10. |
CVE-2025-58991 | High | 7.1 | 2025-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Cristiano Zanca WooCommerce Booking Bundle Hours allows Stored XSS. This issue affects WooCommerce Booking B… |
CVE-2025-58975 | Medium | 4.3 | 2025-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanc… |
CVE-2025-8711 | Medium | 5.4 | 2025-09-09 | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Sec… |
CVE-2025-55147 | High | 8.8 | 2025-09-09 | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Sec… |
CVE-2025-42923 | Medium | 4.3 | 2025-09-09 | Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended reques… |
CVE-2024-48341 | Low | 3.7 | 2025-09-08 | dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop |
CVE-2025-48104 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in ericzane Floating Window Music Player floating-window-music-player allows Stored XSS.This issue affects Floa… |
CVE-2025-27003 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in fullworks Quick Paypal Payments quick-paypal-payments allows Cross Site Request Forgery.This issue affects Q… |
CVE-2025-58878 | Medium | 6.5 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in usamafarooq Woocommerce Gifts Product woo-gift-product allows Cross Site Request Forgery.This issue affects… |
CVE-2025-58869 | Medium | 6.5 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Simasicher SimaCookie simasicher-dsgvo-cookie allows Stored XSS.This issue affects SimaCookie: from n/a thro… |
CVE-2025-58865 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in reimund Compact Admin compact-admin allows Cross Site Request Forgery.This issue affects Compact Admin: from… |
CVE-2025-58861 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Stored XSS.This issue affects Quick Event Calenda… |
CVE-2025-58860 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Enable Latex enable-latex allows Stored XSS.This issue affects Enable Latex: from n/a through <… |
CVE-2025-58859 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in David Merinas Add to Feedly add-to-feedly allows Stored XSS.This issue affects Add to Feedly: from n/a throu… |
CVE-2025-58856 | Medium | 6.5 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Notify Updated Product woocommerce-notify-updated-product allows Stored XSS.This issu… |
CVE-2025-58854 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Samer Bechara Ultimate AJAX Login ultimate-ajax-login allows Reflected XSS.This issue affects Ultimate AJAX… |
CVE-2025-58853 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Reflected XSS.This is… |
CVE-2025-58852 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Mark O'Donnell MSTW League Manager mstw-league-manager allows Stored XSS.This issue affects MSTW League Mana… |
CVE-2025-58849 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Deepak S Hide Real Download Path hide-real-download-path allows Stored XSS.This issue affects Hide Real Down… |
CVE-2025-58848 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in aakash1911 WP likes wp-likes allows Reflected XSS.This issue affects WP likes: from n/a through <= 3.1.1. |
CVE-2025-58847 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Yaidier WN Flipbox Pro wn-flipbox-pro allows Reflected XSS.This issue affects WN Flipbox Pro: from n/a throu… |
CVE-2025-58846 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Dejan Markovic WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule… |
CVE-2025-58845 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Bulk Watermark bulk-watermark allows Reflected XSS.This issue affects Bulk Watermark: from n/a th… |
CVE-2025-58844 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Subhash Kumar Database to Excel database-to-excel allows Stored XSS.This issue affects Database to Excel: fr… |
CVE-2025-58843 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in David Merinas Auto Last Youtube Video auto-last-youtube-video allows Stored XSS.This issue affects Auto Last… |
CVE-2025-58833 | High | 8.8 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in INVELITY Invelity MyGLS connect invelity-mygls-connect allows Object Injection.This issue affects Invelity M… |
CVE-2025-58831 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolling-enllax-js allows Cross Site Request Forgery.This… |
CVE-2025-58818 | Medium | 5.4 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in SwiftNinjaPro Developer Tools Blocker swiftninjapro-inspect-element-console-blocker allows Cross Site Reques… |
CVE-2025-58809 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Nick Ciske To Lead For Salesforce salesforce-wordpress-to-lead allows Reflected XSS.This issue affects To Le… |
CVE-2025-58807 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Dsingh Purge Varnish Cache purge-varnish allows Stored XSS.This issue affects Purge Varnish Cache: from n/a… |
CVE-2025-58806 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Tom Longridge WordPress Error Monitoring by Bugsnag bugsnag allows Stored XSS.This issue affects WordPress E… |
CVE-2025-58804 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in brijrajs WooCommerce Single Page Checkout woo-single-page-checkout allows Cross Site Request Forgery.This is… |
CVE-2025-58802 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in michalzagdan TrustMate.io – WooCommerce integration trustmate-io-integration-for-woocommerce allows Cross Si… |
CVE-2025-58801 | Medium | 5.4 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in KCS Responder responder allows Cross Site Request Forgery.This issue affects Responder: from n/a through <=… |
CVE-2025-58800 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Steve Truman WP Email Template wp-email-template allows Cross Site Request Forgery.This issue affects WP Ema… |
CVE-2025-58799 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in themelocation Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce allows Cross… |
CVE-2025-58798 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Bjorn Manintveld BCM Duplicate Menu bcm-duplicate-menu allows Cross Site Request Forgery.This issue affects… |
CVE-2025-58794 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue… |
CVE-2025-58792 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in WPKube Authors List authors-list allows Cross Site Request Forgery.This issue affects Authors List: from n/a… |
CVE-2025-9616 | Medium | 5.3 | 2025-09-04 | The PopAd plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect non… |
CVE-2025-20326 | Medium | 4.3 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edi… |
CVE-2025-58611 | Medium | 4.3 | 2025-09-03 | Cross-Site Request Forgery (CSRF) vulnerability in Tickera Tickera tickera-event-ticketing-system allows Cross Site Request Forgery.This issue affects Tickera… |
CVE-2025-58272 | Low | 3.7 | 2025-09-03 | Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier. If a logged-in user views a malicious page created by an attacker… |
CVE-2025-0610 | High | 8.6 | 2025-09-01 | Cross-Site Request Forgery (CSRF) vulnerability in Akınsoft QR Menü allows Cross Site Request Forgery. This issue affects QR Menü: from s1.05.06 before v1.05… |
CVE-2025-9747 | Medium | 4.3 | 2025-08-31 | A vulnerability has been found in Koillection up to 1.6.18. Affected is an unknown function of the file assets/controllers/csrf_protection_controller.js. Such… |
CVE-2025-9618 | Medium | 4.3 | 2025-08-30 | The Related Posts Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or i… |
CVE-2025-9374 | Medium | 4.3 | 2025-08-29 | The Ultimate Tag Warrior Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to mi… |
CVE-2025-48363 | Medium | 4.3 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Metin Saraç Popup for CF7 with Sweet Alert cf7-sweet-alert-popup allows Cross Site Request Forgery.This issu… |
CVE-2025-48362 | Medium | 5.4 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affec… |
CVE-2025-48359 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a… |
CVE-2025-48357 | Medium | 5.4 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Theme Century Century ToolKit century-toolkit allows Cross Site Request Forgery.This issue affects Century T… |
CVE-2025-48353 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in dactum Clickbank WordPress Plugin (Niche Storefront) clickbank-niche-storefronts allows Stored XSS.This issu… |
CVE-2025-48351 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in PluginsPoint Kento Splash Screen kento-splash-screen allows Stored XSS.This issue affects Kento Splash Scree… |
CVE-2025-48343 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Aaron Axelsen WPMU Ldap Authentication wpmuldap allows Stored XSS.This issue affects WPMU Ldap Authenticatio… |
CVE-2025-48325 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in shmish111 WP Admin Theme wp-admin-theme allows Stored XSS.This issue affects WP Admin Theme: from n/a throug… |
CVE-2025-48321 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects… |
CVE-2025-48320 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in cuckoohello 百度分享按钮 baidushare-wp allows Stored XSS.This issue affects 百度分享按钮: from n/a through <= 1.0.6. |
CVE-2025-48318 | Medium | 4.3 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in shen2 多说社会化评论框 duoshuo allows Cross Site Request Forgery.This issue affects 多说社会化评论框: from n/a through <= 1… |
CVE-2025-48311 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in OffClicks Invisible Optin invisible-optin allows Stored XSS.This issue affects Invisible Optin: from n/a thr… |
CVE-2025-48310 | Medium | 4.3 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in wptableeditor Table Editor wp-table-editor allows Cross Site Request Forgery.This issue affects Table Editor… |
CVE-2025-48309 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in web-able BetPress betpress allows Stored XSS.This issue affects BetPress: from n/a through <= 1.0.1 Lite. |
CVE-2025-48308 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored… |
CVE-2025-48307 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a throug… |
CVE-2025-48306 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in developers savyour Savyour Affiliate Partner savyour-affiliate-partner allows Stored XSS.This issue affects… |
CVE-2025-48304 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Gary Illyes Google XML News Sitemap plugin gn-xml-sitemap allows Stored XSS.This issue affects Google XML Ne… |
CVE-2025-48109 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Xavier Media XM-Backup xm-backup allows Stored XSS.This issue affects XM-Backup: from n/a through <= 0.9.1. |
CVE-2025-54541 | Medium | 4.3 | 2025-08-28 | QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the ad… |
CVE-2025-7812 | High | 8.8 | 2025-08-28 | The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2025-58217 | High | 7.1 | 2025-08-27 | Cross-Site Request Forgery (CSRF) vulnerability in GeroNikolov Instant Breaking News instant-breaking-news allows Stored XSS.This issue affects Instant Breakin… |
CVE-2025-58202 | Medium | 4.3 | 2025-08-27 | Cross-Site Request Forgery (CSRF) vulnerability in Plugins and Snippets Simple Page Access Restriction simple-page-access-restriction allows Cross Site Request… |
CVE-2025-54598 | Medium | 6.5 | 2025-08-27 | The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via the /notifications/… |
CVE-2025-49040 | Medium | 4.3 | 2025-08-27 | Cross-Site Request Forgery (CSRF) vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n… |
CVE-2025-48303 | Medium | 4.3 | 2025-08-25 | Cross-Site Request Forgery (CSRF) vulnerability in Kevin Langley Jr. Post Type Converter post-type-converter allows Cross Site Request Forgery.This issue affec… |
CVE-2025-7842 | Medium | 4.3 | 2025-08-23 | The Silencesoft RSS Reader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.6. This is due to missing o… |
CVE-2025-7841 | Medium | 4.3 | 2025-08-23 | The Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i… |