CWE-352 · Cross-Site Request Forgery (CSRF) (page 15)
Page 15 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7839 | Medium | 4.3 | 2025-08-23 | The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. Th… |
CVE-2025-57895 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2… |
CVE-2025-57893 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fas… |
CVE-2025-57892 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Jeff Starr Simple Statistics for Feeds simple-feed-stats allows Cross Site Request Forgery.This issue affect… |
CVE-2025-57885 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Cross Site Request Forgery.This issue affects Fluent Su… |
CVE-2025-55744 | Medium | 4.3 | 2025-08-21 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some of the endpoints of the application is… |
CVE-2025-8592 | High | 8.1 | 2025-08-21 | The Inspiro theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing or incorrect no… |
CVE-2025-50902 | High | 8.8 | 2025-08-20 | Cross Site Request Forgery (CSRF) vulnerability in old-peanut Open-Shop (aka old-peanut/wechat_applet__open_source) thru 1.0.0 allows attackers to gain sensiti… |
CVE-2025-43748 | Medium | 6.8 | 2025-08-20 | Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 thr… |
CVE-2025-54174 | Medium | 4.3 | 2025-08-20 | QuickCMS is vulnerable to Cross-Site Request Forgery in article creation functionality. Malicious attacker can craft special website, which when visited by the… |
CVE-2025-8102 | Medium | 5.4 | 2025-08-20 | The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing… |
CVE-2025-54052 | High | 7.5 | 2025-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows PHP Local File Inclusion.This i… |
CVE-2025-49896 | Medium | 5.3 | 2025-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus – Supports Unlimited Channels allows Cross Site Request Forgery. This issue a… |
CVE-2025-49399 | High | 8.8 | 2025-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Cross Site Request Forgery.This issue affects NEX-F… |
CVE-2025-49391 | Medium | 4.3 | 2025-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Cross Site Request Forgery.This issue affects Sign-up She… |
CVE-2025-49382 | High | 8.8 | 2025-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in DexignZone JobZilla - Job Board WordPress Theme jobzilla allows Privilege Escalation.This issue affects JobZ… |
CVE-2025-49381 | Critical | 9.6 | 2025-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in ads.txt Guru ads.txt Guru Connect adstxt-guru-connect allows Cross Site Request Forgery.This issue affects a… |
CVE-2025-43745 | Medium | 6.5 | 2025-08-19 | A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 20… |
CVE-2025-7686 | Medium | 6.1 | 2025-08-16 | The weichuncai(WP伪春菜) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or inc… |
CVE-2025-7684 | Medium | 6.1 | 2025-08-16 | The Last.fm Recent Album Artwork plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to m… |
CVE-2025-7683 | Medium | 6.1 | 2025-08-16 | The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. This is due to missing or incorrec… |
CVE-2025-7668 | Medium | 6.1 | 2025-08-16 | The Linux Promotional Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing… |
CVE-2025-49895 | Medium | 6.5 | 2025-08-16 | Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy… |
CVE-2025-7688 | Medium | 6.1 | 2025-08-15 | The Add User Meta plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incor… |
CVE-2025-8992 | Medium | 4.3 | 2025-08-15 | A vulnerability has been found in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request f… |
CVE-2025-54732 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Cross Site Request Forgery.This issue affects… |
CVE-2025-54728 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Cross Site Req… |
CVE-2025-53587 | High | 8.8 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo findgo allows Cross Site Request Forgery.This issue affects Findgo: from n/a through <= 1.3… |
CVE-2025-53347 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium kalium allows Cross Site Request Forgery.This issue affects Kalium: from n/a through <= 3.1… |
CVE-2025-53249 | Medium | 6.5 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App… |
CVE-2025-53219 | Medium | 5.4 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in pl4g4 WP-Database-Optimizer-Tools wp-database-optimizer-tools allows Cross Site Request Forgery.This issue a… |
CVE-2025-52797 | High | 8.2 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in josepsitjar StoryMap wp-storymap allows SQL Injection.This issue affects StoryMap: from n/a through <= 2.1. |
CVE-2025-52769 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in flexostudio flexo-social-gallery flexo-social-gallery allows Cross Site Request Forgery.This issue affects f… |
CVE-2025-52767 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Cross… |
CVE-2025-52765 | High | 7.1 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Stored… |
CVE-2024-53946 | High | 8.8 | 2025-08-14 | The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. This vulnerability allows an attacker… |
CVE-2025-54703 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Cross Site Request Forgery.This issue affec… |
CVE-2025-54702 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in motov.net Ebook Store ebook-store allows Cross Site Request Forgery.This issue affects Ebook Store: from n/a… |
CVE-2025-54694 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n… |
CVE-2025-54682 | Medium | 5.4 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Cross Site Requ… |
CVE-2025-54675 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Popup yith-woocommerce-popup allows Cross Site Request Forgery.This issue affects… |
CVE-2025-54674 | Medium | 5.4 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Cross Site Reques… |
CVE-2025-54673 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify chart-builder allows Cross Site Request Forgery.This issue affects Chartify: from n/a throu… |
CVE-2025-54672 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in Jordy Meow Photo Engine wplr-sync allows Cross Site Request Forgery.This issue affects Photo Engine: from n/… |
CVE-2025-54671 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide oik oik allows Cross Site Request Forgery.This issue affects oik: from n/a through <= 4.15.2. |
CVE-2025-49044 | High | 7.1 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in tosend.it Simple Poll simple-poll allows Stored XSS.This issue affects Simple Poll: from n/a through <= 1.1… |
CVE-2025-8891 | Medium | 4.3 | 2025-08-13 | The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on… |
CVE-2025-8491 | Medium | 4.3 | 2025-08-13 | The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to m… |
CVE-2025-49555 | High | 8.1 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulne… |
CVE-2025-7965 | Medium | 4.3 | 2025-08-11 | The CBX Restaurant Booking WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a l… |
CVE-2025-8814 | Medium | 4.3 | 2025-08-10 | A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu… |
CVE-2025-8739 | Medium | 4.3 | 2025-08-08 | A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /admin/tags/s… |
CVE-2020-9322 | High | 8.8 | 2025-08-08 | The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScri… |
CVE-2025-7202 | | 2025-08-06 | A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that remotely controlles t… | |
CVE-2025-5988 | Medium | 5.3 | 2025-08-04 | A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components… |
CVE-2025-8505 | Medium | 4.3 | 2025-08-03 | A vulnerability has been found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This vulnerability affects un… |
CVE-2025-54782 | High | 8.8 | 2025-08-02 | Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability w… |
CVE-2025-50847 | Medium | 6.5 | 2025-07-31 | Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafted HTTP request. |
CVE-2025-8335 | Medium | 4.3 | 2025-07-30 | A vulnerability classified as problematic has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part. The manipulation leads to… |
CVE-2025-54536 | Medium | 5.4 | 2025-07-28 | In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint |
CVE-2025-54529 | Low | 3.7 | 2025-07-28 | In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration |
CVE-2025-54528 | Medium | 5.4 | 2025-07-28 | In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow |
CVE-2025-8223 | Medium | 4.3 | 2025-07-27 | A vulnerability, which was classified as problematic, was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. This aff… |
CVE-2025-8104 | Medium | 4.3 | 2025-07-27 | The Memory Usage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.98. This is due to missing nonce vali… |
CVE-2025-8103 | Medium | 4.3 | 2025-07-26 | The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7. This is due to mis… |
CVE-2025-36728 | Medium | 6.3 | 2025-07-25 | Cross-Site Request Forgery (CSRF) vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.11. |
CVE-2025-7835 | Medium | 4.3 | 2025-07-24 | The iThoughts Advanced Code Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.10. This is due t… |
CVE-2025-7690 | Medium | 6.1 | 2025-07-24 | The Affiliate Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or inco… |
CVE-2025-6214 | Medium | 6.5 | 2025-07-23 | The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9. The… |
CVE-2025-6054 | Medium | 6.1 | 2025-07-23 | The YANewsflash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorre… |
CVE-2025-7687 | Medium | 6.1 | 2025-07-22 | The Latest Post Accordian Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to mis… |
CVE-2025-7685 | Medium | 6.1 | 2025-07-22 | The Like & Share My Site plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or… |
CVE-2025-7369 | Medium | 6.1 | 2025-07-21 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. Th… |
CVE-2025-7834 | Medium | 4.3 | 2025-07-19 | A vulnerability, which was classified as problematic, was found in PHPGurukul Complaint Management System 2.0. Affected is an unknown function. The manipulatio… |
CVE-2025-7669 | Medium | 6.1 | 2025-07-19 | The Avishi WP PayPal Payment Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to… |
CVE-2025-50586 | Medium | 6.5 | 2025-07-18 | StudentManage v1.0 was discovered to contain Cross-Site Request Forgery (CSRF). |
CVE-2025-6781 | Medium | 4.3 | 2025-07-18 | The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This… |
CVE-2025-6053 | Medium | 6.1 | 2025-07-18 | The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missin… |
CVE-2025-7756 | Medium | 4.3 | 2025-07-17 | A vulnerability classified as problematic has been found in code-projects E-Commerce Site 1.0. Affected is an unknown function. The manipulation leads to cross… |
CVE-2025-54042 | Medium | 4.3 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in Xfinitysoft WP Post Hide wp-post-hide allows Cross Site Request Forgery.This issue affects WP Post Hide: fro… |
CVE-2025-54041 | Medium | 4.3 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Cross Site Request Forgery.This… |
CVE-2025-54039 | Medium | 4.3 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Animator scroll-triggered-animations allows Cross Site Request Forgery.This issue affects Anim… |
CVE-2025-54038 | Medium | 5.4 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Cross Site Request Forgery.This issue aff… |
CVE-2025-54036 | Medium | 4.3 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Cross Site Request Forgery.This issue affe… |
CVE-2025-54035 | Medium | 4.3 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newslet… |
CVE-2025-54033 | Medium | 6.5 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in BlocksWP Theme Builder For Elementor theme-builder-for-elementor allows Cross Site Request Forgery.This issu… |
CVE-2025-54030 | Medium | 4.3 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in WesternDeal WooCommerce Google Sheet Connector wc-gsheetconnector allows Cross Site Request Forgery.This iss… |
CVE-2025-54022 | Medium | 6.5 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Cross Site Request Forgery.This issue aff… |
CVE-2025-54020 | Medium | 5.4 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in Erik AntiSpam for Contact Form 7 cf7-antispam allows Cross Site Request Forgery.This issue affects AntiSpam… |
CVE-2025-54010 | Critical | 9.6 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel FluentSnippets easy-code-manager allows Cross Site Request Forgery.This issue affects Fluent… |
CVE-2025-48153 | High | 7.1 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au Import CDN-Remote Images import-cdn-remote-images allows Stored XSS.This issue affects Import CDN-… |
CVE-2025-50090 | Medium | 5.4 | 2025-07-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 1… |
CVE-2025-30756 | Medium | 6.1 | 2025-07-15 | Vulnerability in Oracle REST Data Services (component: General). The supported version that is affected is 24.2.0. Easily exploitable vulnerability allows un… |
CVE-2025-30746 | Medium | 6.1 | 2025-07-15 | Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.14. Eas… |
CVE-2025-30745 | Medium | 6.1 | 2025-07-15 | Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration). Supported versions that are affe… |
CVE-2025-7667 | High | 8.1 | 2025-07-15 | The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing o… |
CVE-2025-49462 | Low | 3.5 | 2025-07-10 | Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access. |
CVE-2025-7379 | | 2025-07-09 | A security bypass vulnerability allows exploitation via Reverse Tabnabbing, a type of phishing attack where attackers can manipulate the content of the origina… | |
CVE-2025-53540 | | 2025-07-07 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Several OTA update examples and the HTTPU… | |
CVE-2025-20322 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an… |