Cross-site request forgery in the Product Catalog Simple WordPress plugin (versions ≤1.8.4) allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, potentially modifying catalog settings. The vulnerability has an extremely low EPSS exploitation probability (0.01%) and no known public exploit or active exploitation (not listed in CISA KEV).
Cross-site request forgery in the WordPress UPC/EAN/GTIN Barcode Generator plugin (versions through 2.0.2) allows unauthenticated remote attackers to trick authenticated administrators into performing unauthorized actions, such as altering plugin settings or barcode output, with low integrity impact. No active exploitation or public exploit code has been identified, and the EPSS score is extremely low, indicating minimal real-world risk.
Cross-Site Request Forgery (CSRF) in the Evergreen Content Poster WordPress plugin through version 1.4.5 allows unauthenticated remote attackers to perform unauthorized actions on behalf of an authenticated administrator. An attacker can trick a logged-in admin into clicking a crafted link, leading to CSRF exploitation that modifies plugin settings or content with low integrity impact. No active exploitation or public exploit code has been reported; EPSS probability is negligible.