CSRF

CVE-2025-59892 Jan 28, 12:15 HIGH This Week

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. [CVSS 8.0 HIGH]

CVE-2025-59891 Jan 28, 12:15 HIGH This Week

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. [CVSS 8.0 HIGH]

CVE-2025-14616 Jan 28, 12:15 MEDIUM This Month

The Recooty - Job Widget (Old Dashboard) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing nonce validation on the recooty_save_maybe() function. [CVSS 4.3 MEDIUM]

CVE-2026-24408 Jan 26, 23:16 PyPI NONE PATCH Awaiting Data

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery.

CVE-2026-24432 Jan 26, 18:16 MEDIUM This Month

Tenda W30E V2 firmware through V16.01.0.19(5037) lacks CSRF protections on administrative functions, enabling attackers to hijack authenticated admin sessions and modify configuration settings or reset administrator credentials. An attacker can craft malicious requests that execute with the privileges of a logged-in administrator when visited in their browser. No patch is currently available for this vulnerability.

CVE-2026-1208 Jan 24, 09:15 MEDIUM This Month

Friendly Functions for Welcart (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2025-14907 Jan 24, 09:15 MEDIUM This Month

Moderate Selected Posts (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2025-14630 Jan 24, 09:15 MEDIUM This Month

The AdminQuickbar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.3. This is due to missing or incorrect nonce validation on the 'saveSettings' and 'renamePost' AJAX actions. [CVSS 4.3 MEDIUM]

CVE-2025-13205 Jan 24, 09:15 MEDIUM This Month

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. [CVSS 4.3 MEDIUM]

CVE-2025-13194 Jan 24, 09:15 MEDIUM This Month

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. [CVSS 4.3 MEDIUM]

CVE-2025-13139 Jan 24, 09:15 MEDIUM This Month

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce validation on the SurveyJS_AddSurvey AJAX action. [CVSS 4.3 MEDIUM]

CVE-2026-1088 Jan 24, 08:16 MEDIUM This Month

WordPress Login Page Editor plugin through version 1.2 lacks CSRF protections on its AJAX settings handler, allowing attackers to modify login page configuration by tricking administrators into visiting malicious links. An unauthenticated attacker can exploit this to alter plugin settings without direct authorization, potentially affecting site security or functionality. No patch is currently available.

CVE-2026-1081 Jan 24, 08:16 MEDIUM This Month

Set Bulk Post Categories (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2026-1076 Jan 24, 08:16 MEDIUM This Month

The Star Review Manager WordPress plugin through version 1.2.2 lacks CSRF protections on its settings page, allowing unauthenticated attackers to modify CSS settings by tricking administrators into clicking a malicious link. Site administrators are at risk of unwanted plugin configuration changes that could alter site appearance or functionality. No patch is currently available for this vulnerability.

CVE-2026-1075 Jan 24, 08:16 MEDIUM This Month

The ZT Captcha plugin for WordPress through version 1.0.4 contains a cross-site request forgery vulnerability due to insufficient nonce validation that can be bypassed with an empty token. An unauthenticated attacker can exploit this to modify plugin settings by tricking an administrator into clicking a malicious link. No patch is currently available.

CVE-2026-1070 Jan 24, 08:16 MEDIUM PATCH This Month

The Alex User Counter WordPress plugin through version 6.0 contains a cross-site request forgery vulnerability in its settings function due to missing nonce validation, allowing unauthenticated attackers to modify plugin configuration if they can socially engineer site administrators into clicking a malicious link. The vulnerability has a low barrier to exploitation since it requires only network access and user interaction, though it cannot directly compromise confidentiality or availability. No patch is currently available for this issue.

CVE-2025-14906 Jan 24, 08:16 MEDIUM This Month

WP Youtube Video Gallery (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2025-14903 Jan 24, 08:16 MEDIUM This Month

Simple Crypto Shortcodes (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2026-24596 Jan 23, 15:16 MEDIUM This Month

marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails is affected by cross-site request forgery (csrf) (CVSS 4.7).

CVE-2026-24549 Jan 23, 15:16 MEDIUM This Month

GeoDirectory versions before 2.8.150 are vulnerable to cross-site request forgery attacks that could allow an attacker to perform unauthorized actions on behalf of authenticated users. The vulnerability requires user interaction to exploit and can result in integrity violations, though no patch is currently available.

CVE-2026-24542 Jan 23, 15:16 MEDIUM This Month

John James Jacoby WP Term Order wp-term-order is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2026-24521 Jan 23, 15:16 MEDIUM This Month

Timur Kamaev Kama Thumbnail kama-thumbnail is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2026-24384 Jan 22, 17:16 MEDIUM This Month

The Merge + Minify + Refresh WordPress plugin through version 2.14 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users. An attacker can craft malicious requests to trick site administrators into executing unintended operations, potentially compromising website functionality or configuration. No patch is currently available for this vulnerability.

CVE-2026-24374 Jan 22, 17:16 MEDIUM This Month

Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager is affected by cross-site request forgery (csrf) (CVSS 5.4).

CVE-2026-24365 Jan 22, 17:16 MEDIUM This Month

storeapps Stock Manager for WooCommerce woocommerce-stock-manager is affected by cross-site request forgery (csrf) (CVSS 5.4).

CVE-2026-22483 Jan 22, 17:16 MEDIUM This Month

teachPress through version 9.0.12 is vulnerable to Cross-Site Request Forgery attacks that enable unauthenticated attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability requires user interaction and can result in data integrity compromise or service disruption, though confidentiality is not affected. No patch is currently available for this vulnerability.

CVE-2026-22462 Jan 22, 17:16 MEDIUM This Month

richardevcom Add Polylang support for Customizer add-polylang-support-for-customizer is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2026-22382 Jan 22, 17:16 MEDIUM This Month

Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends is affected by cross-site request forgery (csrf) (CVSS 5.4).

CVE-2026-22360 Jan 22, 17:16 MEDIUM This Month

SearchAzon versions 1.4 and earlier are vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthenticated attackers to perform unauthorized actions on behalf of users. The vulnerability requires user interaction and has limited impact, restricted to integrity violations without affecting confidentiality or availability. No patch is currently available for this issue.

CVE-2026-22359 Jan 22, 17:16 MEDIUM This Month

AA-Team Wordpress Movies Bulk Importer movies importer is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2025-70899 Jan 22, 17:16 MEDIUM POC This Month

Online Course Registration versions up to 3.1 is affected by cross-site request forgery (csrf) (CVSS 6.5).

CVE-2025-67626 Jan 22, 17:16 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in Angel Costa WP SEO Search wp-seo-search allows Cross Site Request Forgery.This issue affects WP SEO Search: from n/a through <= 1.1. [CVSS 4.3 MEDIUM]

CVE-2025-31413 Jan 22, 17:15 MEDIUM This Month

bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite is affected by cross-site request forgery (csrf) (CVSS 8.8).

CVE-2026-24037 Jan 22, 04:15 MEDIUM POC This Month

Horilla HRMS version 1.4.0 contains insufficient input validation in its XSS prevention function, allowing attackers to bypass protections through context-agnostic regex patterns. Public exploit code exists for this vulnerability, enabling attackers to redirect users to malicious sites, execute arbitrary JavaScript, and steal CSRF tokens for use in admin-targeted attacks. The vulnerability affects Horilla 1.4.0 and has been patched in version 1.5.0.

CVE-2021-47860 Jan 21, 18:16 MEDIUM POC This Month

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. [CVSS 5.3 MEDIUM]

CVE-2021-47830 Jan 21, 18:16 MEDIUM POC This Month

GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, can change SMTP configuration settings in the plugin. [CVSS 6.5 MEDIUM]

CVE-2025-36411 Jan 20, 16:16 LOW Monitor

IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. [CVSS 3.5 LOW]

CVE-2026-1051 Jan 20, 02:15 MEDIUM This Month

The Newsletter WordPress plugin through version 9.1.0 contains a cross-site request forgery vulnerability in the hook_newsletter_action() function due to insufficient nonce validation, allowing unauthenticated attackers to unsubscribe legitimate users if they can trick a logged-in administrator into clicking a malicious link. This attack requires user interaction but poses a direct integrity risk to newsletter subscriber lists. No patch is currently available.

CVE-2026-1169 Jan 19, 18:16 LOW POC Monitor

Cross-site request forgery (CSRF) in Birkir Prime through version 0.4.0.beta.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users through malicious web requests. Public exploit code is available for this vulnerability, increasing the risk of active exploitation. No patch has been released as of this advisory.

CVE-2026-1153 Jan 19, 13:16 LOW POC Monitor

Cross-site request forgery in Mpay up to version 1.2.4 allows unauthenticated remote attackers to perform unauthorized actions via a crafted request. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected systems exposed to attack.

CVE-2026-1148 Jan 19, 10:16 MEDIUM This Month

Patients Waiting Area Queue Management System versions up to 1.0 is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2026-1142 Jan 19, 07:16 LOW POC Monitor

PHPGurukul News Portal 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users through crafted requests. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. The flaw affects the integrity of user actions but does not compromise confidentiality or availability.

CVE-2026-23626 Jan 18, 23:15 PHP MEDIUM POC PATCH This Month

Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that allows authenticated users with export permissions to execute arbitrary method calls and extract sensitive data such as environment variables, password hashes, and session tokens. Public exploit code exists for this vulnerability. The issue is resolved in version 2.46.0 and later.

Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without user interaction. Attackers can craft a malicious webpage that automatically submits a form to change router remote access settings to port 8080 without the user's consent. [CVSS 5.3 MEDIUM]

CVE-2025-14853 Jan 16, 07:15 MEDIUM This Month

LEAV Last Email Address Validator (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

b2evolution 7.2.2 contains a cross-site request forgery vulnerability that allows attackers to modify admin account details without authentication. Attackers can craft a malicious HTML form to submit unauthorized changes to user profiles by tricking victims into loading a specially crafted webpage. [CVSS 5.3 MEDIUM]

CVE-2021-47754 Jan 15, 16:16 MEDIUM POC This Month

Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. [CVSS 6.5 MEDIUM]

CVE-2025-15376 Jan 14, 07:16 MEDIUM This Month

Stopwords for comments (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2025-14846 Jan 14, 07:16 MEDIUM This Month

SocialChamp with WordPress (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2025-15377 Jan 14, 06:15 MEDIUM This Month

The Sosh Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'admin_page_content' function. [CVSS 4.3 MEDIUM]

CVE-2025-14615 Jan 14, 06:15 HIGH This Week

The DASHBOARD BUILDER - WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.7. This is due to missing nonce validation on the settings handler in dashboardbuilder-admin.php. [CVSS 7.1 HIGH]

CVE-2025-14389 Jan 14, 06:15 MEDIUM This Month

The WPBlogSyn plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. [CVSS 4.3 MEDIUM]

CVE-2022-50925 Jan 13, 23:15 CRITICAL POC Act Now

Prowise Reflect 1.0.9 exposes a WebSocket on port 8082 that accepts unauthenticated keyboard injection commands. Malicious web pages can type keystrokes and open applications on the display device. PoC available.

CVE-2026-0493 Jan 13, 02:15 MEDIUM This Month

SAP Fiori App Intercompany Balance Reconciliation an attacker is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2026-22800 Jan 12, 23:15 LOW PATCH Monitor

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. [CVSS 2.4 LOW]

CVE-2021-41074 Jan 12, 21:15 MEDIUM This Month

A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document. [CVSS 5.4 MEDIUM]

CVE-2026-22033 Jan 12, 18:15 PyPI MEDIUM POC PATCH This Month

Stored XSS in Label Studio's custom_hotkeys feature allows authenticated attackers to inject malicious JavaScript that executes in other users' browsers, potentially enabling API token theft and account takeover due to insufficient CSRF protections. Public exploit code exists for this vulnerability affecting Label Studio 1.22.0 and earlier. An attacker could abuse this to gain unauthorized API access or perform actions on behalf of compromised users.

CVE-2025-14976 Jan 10, 09:15 MEDIUM This Month

The User Registration & Membership - Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.8. [CVSS 5.4 MEDIUM]

CVE-2026-22030 Jan 10, 03:15 npm MEDIUM PATCH This Month

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]

CVE-2025-13749 Jan 09, 06:16 MEDIUM This Month

The Clearfy Cache - WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.0. This is due to missing nonce validation on the "wbcr_upm_change_flag" function. [CVSS 4.3 MEDIUM]

CVE-2025-68158 Jan 08, 18:15 PyPI MEDIUM POC PATCH This Month

Authlib is a Python library which builds OAuth and OpenID Connect servers. [CVSS 5.7 MEDIUM]

CVE-2025-61547 Jan 08, 17:15 MEDIUM POC This Month

Print Shop Pro Webdesk versions up to 18.34 is affected by cross-site request forgery (csrf) (CVSS 6.8).

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. [CVSS 5.3 MEDIUM]

CVE-2025-31963 Jan 07, 12:17 LOW Monitor

Bigfix Insights For Vulnerability Remediation versions up to 4.2 is affected by missing authentication for critical function (CVSS 2.9).

CVE-2025-14999 Jan 07, 12:16 MEDIUM This Month

The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings update handler in admin-page.php. [CVSS 4.3 MEDIUM]

CVE-2025-14904 Jan 07, 12:16 MEDIUM This Month

Newsletter Email Subscribe (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2025-14845 Jan 07, 12:16 MEDIUM This Month

NS IE Compatibility Fixer (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2025-14468 Jan 07, 12:16 MEDIUM This Month

The AMP for WP - Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. [CVSS 4.3 MEDIUM]

CVE-2025-14465 Jan 07, 12:16 MEDIUM This Month

Sticky Action Buttons (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2025-14077 Jan 07, 12:16 MEDIUM This Month

The Simcast plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the settingsPage function. [CVSS 4.3 MEDIUM]

CVE-2025-13990 Jan 07, 12:16 MEDIUM This Month

The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments via a forged request granted they can trick a site administrator into performing an action such as cl...

CVE-2025-13657 Jan 07, 12:16 MEDIUM This Month

HelpDesk contact form (WordPress plugin) is affected by cross-site request forgery (csrf) (CVSS 4.3).

CVE-2025-13527 Jan 07, 12:16 MEDIUM This Month

The xShare plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce validation on the 'xshare_plugin_reset()' function. [CVSS 4.3 MEDIUM]

CVE-2025-13521 Jan 07, 12:16 MEDIUM This Month

The WP Status Notifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the settings update functionality. [CVSS 4.3 MEDIUM]

CVE-2025-13520 Jan 07, 12:16 MEDIUM This Month

The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing or incorrect nonce validation on the settings update functionality. [CVSS 4.3 MEDIUM]

CVE-2025-13519 Jan 07, 12:16 MEDIUM This Month

The SVG Map Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on multiple AJAX actions including 'save_data', 'delete_data', and 'add_popup'. [CVSS 6.1 MEDIUM]

iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. [CVSS 4.3 MEDIUM]

CVE-2020-36913 Jan 06, 16:15 MEDIUM This Month

All-Dynamics Software enlogic:show 2.0.2 contains a session fixation vulnerability that allows attackers to set a predefined PHP session identifier during the login process. [CVSS 5.3 MEDIUM]

CVE-2020-36908 Jan 06, 16:15 MEDIUM POC This Month

Snapgear Sg560 Firmware versions up to 3.1.5 is affected by cross-site request forgery (csrf) (CVSS 5.3).

P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. [CVSS 4.3 MEDIUM]

CVE-2025-53344 Jan 05, 17:15 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3. [CVSS 4.3 MEDIUM]

CVE-2023-52212 Jan 05, 14:15 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0. [CVSS 5.4 MEDIUM]

CVE-2025-12685 Jan 02, 06:15 MEDIUM This Month

WPBookit WordPre versions up to 1.0.7 contains a vulnerability that allows attackers to an unauthenticated attacker to delete any customer through a CSRF attack (CVSS 6.5).

CVE-2025-15405 Jan 01, 15:15 MEDIUM POC This Month

A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function. [CVSS 4.3 MEDIUM]

CVE-2025-31054 Dec 31, 20:15 HIGH This Week

Reflected cross-site scripting via CSRF in the Themefy Bloggie WordPress theme (all versions through 2.0.8) lets a remote attacker execute arbitrary script in a victim's browser session by tricking an authenticated user into clicking a crafted link or visiting a malicious page. Because the CSRF weakness lets the request be forged without a valid anti-CSRF token, no attacker authentication is required, though victim interaction is. There is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.02% (5th percentile).

CVE-2025-62123 Dec 31, 17:15 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in inkthemes WP Gmail SMTP plugin through version 1.0.7 allows attackers to perform unauthorized actions on behalf of authenticated administrators without their knowledge or consent. The vulnerability affects the WordPress plugin across all versions up to and including 1.0.7, enabling attackers to potentially modify email configuration settings or other administrative functions via crafted web requests. No public exploit code has been identified at the time of analysis, and the EPSS score of 0.01% indicates minimal real-world exploitation likelihood despite the theoretical attack surface.

CVE-2025-62113 Dec 31, 17:15 MEDIUM This Month

Cross-site request forgery (CSRF) in the Co-marquage service-public.fr WordPress plugin up to version 0.5.77 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users by crafting malicious requests. The vulnerability lacks a CVSS score and shows minimal exploitation probability (0.01% EPSS), with no public exploit code or active exploitation indicators identified.

CVE-2025-62101 Dec 31, 17:15 MEDIUM This Month

Cross-site request forgery (CSRF) in Pardakht Delkhah WordPress plugin through version 3.0.0 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users by tricking them into visiting malicious pages. The vulnerability affects all versions up to and including 3.0.0, though no CVSS score or public exploit code has been published. This represents a low-probability exploitation risk (EPSS 0.01%) despite the attack vector being network-accessible, likely due to the social engineering requirement inherent to CSRF attacks.

CVE-2025-63040 Dec 31, 16:15 MEDIUM This Month

Cross-site request forgery (CSRF) in the Post Snippets WordPress plugin through version 4.0.11 allows unauthenticated attackers to perform unauthorized administrative actions on vulnerable sites by tricking authenticated administrators into visiting malicious web pages. The vulnerability affects all versions up to and including 4.0.11, though no CVSS vector or EPSS exploitation probability above baseline has been assigned, suggesting limited real-world exploit infrastructure exists at this time.

CVE-2025-63014 Dec 31, 16:15 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in Gmedia Photo Gallery WordPress plugin through version 1.25.0 allows attackers to perform unauthorized actions on behalf of authenticated users without their knowledge or consent. An unauthenticated remote attacker can craft malicious web pages or emails that, when visited by a logged-in admin or user, execute unwanted operations such as modifying gallery settings, uploading images, or changing plugin configuration. The vulnerability has an extremely low exploitation probability (EPSS 0.02%, 5th percentile) but represents a class of attacks that can bypass user intent entirely when user awareness is low.