CWE-352 · Cross-Site Request Forgery (CSRF) (page 25)
Page 25 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-26899 | Medium | 6.5 | 2025-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Recapture Cart Recovery and Email Marketing Recapture for WooCommerce recapture-for-woocommerce allows Cross… |
CVE-2025-1530 | Medium | 4.3 | 2025-03-15 | The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validat… |
CVE-2025-2163 | Medium | 6.1 | 2025-03-15 | The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incor… |
CVE-2025-25873 | Medium | 5.5 | 2025-03-14 | Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root Password function |
CVE-2025-1764 | High | 7.5 | 2025-03-14 | The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3… |
CVE-2024-13913 | High | 8.8 | 2025-03-14 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1… |
CVE-2025-1436 | High | 7.1 | 2025-03-13 | The Limit Bio WordPress plugin through 1.0 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could al… |
CVE-2025-27792 | | 2025-03-11 | Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, the protections against cross-site request forgery (… | |
CVE-2025-28941 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in ohtan Spam Byebye spam-byebye allows Cross Site Request Forgery.This issue affects Spam Byebye: from n/a thr… |
CVE-2025-28940 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in arkapravamajumder Back To Top backtotop allows Cross Site Request Forgery.This issue affects Back To Top: fr… |
CVE-2025-28933 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in maxfoundry MaxA/B maxab allows Stored XSS.This issue affects MaxA/B: from n/a through <= 2.2.2. |
CVE-2025-28932 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in BCS Website Solutions Insert Code insert-code allows Stored XSS.This issue affects Insert Code: from n/a thr… |
CVE-2025-28931 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in DevriX Hashtags wp-hashtags allows Stored XSS.This issue affects Hashtags: from n/a through <= 0.3.2. |
CVE-2025-28927 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in A. Chappard Display Template Name display-template-name allows Cross Site Request Forgery.This issue affects… |
CVE-2025-28925 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Hieu Nguyen WATI Chat and Notification wati-chat-and-notification allows Stored XSS.This issue affects WATI… |
CVE-2025-28923 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in philippe No Disposable Email no-disposable-email allows Stored XSS.This issue affects No Disposable Email: f… |
CVE-2025-28922 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Terence D. Go To Top go-to-top allows Stored XSS.This issue affects Go To Top: from n/a through <= 0.0.8. |
CVE-2025-28913 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Aftab Ali Muni WP Add Active Class To Menu Item wp-add-active-class-to-menu-item allows Cross Site Request F… |
CVE-2025-28912 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue aff… |
CVE-2025-28910 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Ravinder Khurana WP Hide Admin Bar wp-hide-admin-bar allows Cross Site Request Forgery.This issue affects WP… |
CVE-2025-28909 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in edwardw WP No-Bot Question wp-no-bot-question allows Cross Site Request Forgery.This issue affects WP No-Bot… |
CVE-2025-28902 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Benjamin Pick Contact Form 7 Select Box Editor Button contact-form-7-select-box-editor-button allows Cross S… |
CVE-2025-28901 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Naren Members page only for logged in users members-page-only-for-logged-in-users allows Stored XSS.This iss… |
CVE-2025-28900 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in webgarb TabGarb Pro tabgarb allows Stored XSS.This issue affects TabGarb Pro: from n/a through <= 2.6. |
CVE-2025-28897 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Steveorevo Domain Theme domain-theme allows Stored XSS.This issue affects Domain Theme: from n/a through <=… |
CVE-2025-28894 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.Th… |
CVE-2025-28892 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in a2rocklobster FTP Sync ftp-sync allows Stored XSS.This issue affects FTP Sync: from n/a through <= 1.1.6. |
CVE-2025-28891 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in jazzigor price-calc price-calc allows Stored XSS.This issue affects price-calc: from n/a through <= 0.6.3. |
CVE-2025-28887 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Fastmover Plugins Last Updated Column plugins-last-updated-column allows Cross Site Request Forgery.This iss… |
CVE-2025-28886 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in xjb REST API TO MiniProgram rest-api-to-miniprogram allows Cross Site Request Forgery.This issue affects RES… |
CVE-2025-28884 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Kumar WP Bulk Post Duplicator wp-bulk-post-duplicator allows Cross Site Request Forgery.This issue af… |
CVE-2025-28883 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Martin WP Compare Tables wp-compare-tables allows Stored XSS.This issue affects WP Compare Tables: from n/a… |
CVE-2025-28881 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in mg12 Mobile Themes wp-mobile-themes allows Cross Site Request Forgery.This issue affects Mobile Themes: from… |
CVE-2025-28876 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Skrill_Team Skrill Official official-skrill-woocommerce allows Cross Site Request Forgery.This issue affects… |
CVE-2025-28868 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in ZipList ZipList Recipe ziplist-recipe-plugin allows Cross Site Request Forgery.This issue affects ZipList Re… |
CVE-2025-28867 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in stesvis Frontpage category filter frontpage-category-filter allows Cross Site Request Forgery.This issue aff… |
CVE-2025-28866 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger login-logger allows Cross Site Request Forgery.This issue affects Login Logger: from… |
CVE-2025-28864 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This i… |
CVE-2025-28863 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Carlos Minatti Delete Original Image delete-original-image allows Cross Site Request Forgery.This issue affe… |
CVE-2025-28862 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Comment Date and Gravatar remover remove-date-and-gravatar-under-comment allows Cross Site Request… |
CVE-2025-28861 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker wpjqp-datepicker allows Stored XSS.This issue affects WP jQuery Persian D… |
CVE-2025-28860 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator google-news-editors-picks-news-feeds allows Stored XSS… |
CVE-2025-28859 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in CodeVibrant Maintenance Notice maintenance-notice allows Cross Site Request Forgery.This issue affects Maint… |
CVE-2025-28857 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration rankchecker-io-integration allows Stored XSS.This issue affects Rankc… |
CVE-2025-28856 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.Thi… |
CVE-2025-25928 | High | 8.0 | 2025-03-11 | A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via… |
CVE-2025-25927 | Medium | 6.8 | 2025-03-11 | A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request. |
CVE-2025-25748 | High | 7.3 | 2025-03-11 | A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords)… |
CVE-2023-48790 | High | 7.5 | 2025-03-11 | A cross site request forgery vulnerability [CWE-352] in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow… |
CVE-2025-27912 | High | 8.8 | 2025-03-11 | An issue was discovered in Datalust Seq before 2024.3.13545. Missing Content-Type validation can lead to CSRF when (1) Entra ID or OpenID Connect authenticatio… |
CVE-2024-13580 | Medium | 4.3 | 2025-03-11 | The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2024-13436 | Medium | 6.1 | 2025-03-11 | The Appsero Helper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or inco… |
CVE-2025-27910 | High | 8.0 | 2025-03-10 | tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status. This vulnerability allows attackers to execu… |
CVE-2025-25907 | High | 8.8 | 2025-03-10 | tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arb… |
CVE-2025-26910 | High | 7.1 | 2025-03-10 | Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit wpbookit allows Stored XSS.This issue affects WPBookit: from n/a through <= 1.0.1. |
CVE-2025-24387 | Medium | 4.8 | 2025-03-10 | A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an… |
CVE-2025-1926 | Medium | 4.3 | 2025-03-10 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2025-1382 | Medium | 6.1 | 2025-03-09 | The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could… |
CVE-2025-1362 | Medium | 4.3 | 2025-03-09 | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could… |
CVE-2024-11640 | High | 8.8 | 2025-03-08 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This… |
CVE-2024-13826 | Medium | 5.4 | 2025-03-08 | The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2024-13774 | Medium | 6.1 | 2025-03-08 | The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin… |
CVE-2024-12634 | Medium | 6.1 | 2025-03-07 | The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Cross-Site Request Forg… |
CVE-2025-0748 | Medium | 4.3 | 2025-03-07 | The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce va… |
CVE-2025-2042 | Medium | 4.3 | 2025-03-06 | A vulnerability has been found in huang-yk student-manage 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to… |
CVE-2025-1383 | Medium | 4.3 | 2025-03-06 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. This is due to miss… |
CVE-2025-27624 | Medium | 5.4 | 2025-03-05 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/e… |
CVE-2024-51144 | High | 8.8 | 2025-03-05 | Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user&a… |
CVE-2025-1463 | Medium | 4.3 | 2025-03-05 | The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to improp… |
CVE-2025-1435 | Medium | 6.3 | 2025-03-05 | The bbPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.11. This is due to missing or incorrect… |
CVE-2025-0990 | Medium | 4.3 | 2025-03-05 | The I Am Gloria plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.4. This is due to missing or incorre… |
CVE-2025-27664 | High | 8.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient CSRF Protection OVE-20230524-0008. |
CVE-2025-27402 | Medium | 4.6 | 2025-03-04 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administr… |
CVE-2024-50705 | High | 7.1 | 2025-03-04 | Unauthenticated reflected cross-site scripting (XSS) vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary scripts vi… |
CVE-2024-13682 | Medium | 4.3 | 2025-03-04 | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Requ… |
CVE-2025-1306 | High | 8.8 | 2025-03-04 | The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect… |
CVE-2025-1891 | Medium | 4.3 | 2025-03-04 | A vulnerability was found in shishuocms 1.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site req… |
CVE-2025-26206 | Critical | 9.0 | 2025-03-03 | Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component |
CVE-2025-25967 | High | 8.8 | 2025-03-03 | Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthori… |
CVE-2024-30154 | Medium | 5.3 | 2025-03-03 | HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a… |
CVE-2025-25137 | Medium | 6.5 | 2025-03-03 | Cross-Site Request Forgery (CSRF) vulnerability in kareemsultan Social Links social-links allows Cross Site Request Forgery. This issue affects Social Links… |
CVE-2025-25121 | High | 7.1 | 2025-03-03 | Cross-Site Request Forgery (CSRF) vulnerability in shyammakwana Theme Options Z theme-options-z allows Cross Site Request Forgery.This issue affects Theme Opti… |
CVE-2025-23502 | High | 7.1 | 2025-03-03 | Cross-Site Request Forgery (CSRF) vulnerability in Ned Curated Search curated-search allows Stored XSS.This issue affects Curated Search: from n/a through <= 1… |
CVE-2025-23446 | High | 7.1 | 2025-03-03 | Cross-Site Request Forgery (CSRF) vulnerability in KokoenDE WP SpaceContent wp-spacecontent allows Stored XSS.This issue affects WP SpaceContent: from n/a thro… |
CVE-2025-27579 | Medium | 5.4 | 2025-03-03 | In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bitaxe Bitcoin miner… |
CVE-2025-1813 | Medium | 4.3 | 2025-03-02 | A vulnerability classified as problematic was found in zj1983 zz up to 2024-08. Affected by this vulnerability is an unknown functionality. The manipulation le… |
CVE-2024-13518 | Medium | 4.3 | 2025-03-01 | The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.12. This is due to missing o… |
CVE-2025-25379 | Critical | 9.6 | 2025-02-28 | Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component. |
CVE-2025-1506 | Medium | 4.3 | 2025-02-28 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.0. T… |
CVE-2025-0801 | Medium | 4.3 | 2025-02-28 | The RateMyAgent Official plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing o… |
CVE-2025-1687 | High | 8.8 | 2025-02-28 | The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation… |
CVE-2025-1745 | Medium | 4.3 | 2025-02-27 | A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. This vulnerability affects unknown code of the component Logout. The ma… |
CVE-2024-0392 | Medium | 5.4 | 2025-02-27 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validat… |
CVE-2024-13647 | Medium | 4.3 | 2025-02-27 | The School Management System – SakolaWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is d… |
CVE-2025-26925 | Medium | 4.3 | 2025-02-26 | Cross-Site Request Forgery (CSRF) vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This issue affects Admin Menu Manager: from n/… |
CVE-2024-13560 | Medium | 4.3 | 2025-02-26 | The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This i… |
CVE-2025-26963 | Medium | 5.4 | 2025-02-25 | Cross-Site Request Forgery (CSRF) vulnerability in ClickWhale ClickWhale clickwhale allows Cross Site Request Forgery.This issue affects ClickWhale: from n/a t… |
CVE-2025-26931 | High | 7.1 | 2025-02-25 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Tribulant Gallery Voting gallery-voting allows Stored XSS.This issue affects Tribulant Ga… |
CVE-2025-26926 | Medium | 4.3 | 2025-02-25 | Cross-Site Request Forgery (CSRF) vulnerability in fs-code Booknetic booknetic.This issue affects Booknetic: from n/a through <= 4.0.9. |
CVE-2024-13494 | Medium | 4.3 | 2025-02-25 | The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing… |