CSRF
Monthly
Stored XSS via cross-site request forgery in the re.place WordPress plugin allows an attacker to store malicious scripts by tricking a logged-in administrator into clicking a crafted link. The vulnerability affects versions up to 0.2.1, and no active exploitation or public exploit code has been identified at the time of analysis.
Stored Cross-Site Scripting (XSS) in the RSS Digest WordPress plugin (versions up to 1.5) can be exploited via Cross-Site Request Forgery (CSRF), allowing unauthenticated attackers to trick site administrators into performing actions that inject malicious scripts. The injected payload persists and executes in the browsers of other users, leading to content manipulation, session theft, or site defacement. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability.
Cross-site request forgery in the Społecznościowa 6 PL 2013 WordPress plugin (versions <= 2.0.6) allows unauthenticated attackers to trick an administrator into executing unintended actions, leading to stored cross-site scripting. This enables injection of malicious scripts that execute in the browsers of other users, potentially stealing session cookies, defacing the site, or redirecting visitors. No active exploitation is confirmed, and the EPSS score is very low (0.02%).
Cross-site request forgery in the Aioseo Multibyte Descriptions WordPress plugin (versions up to 0.0.6) allows unauthenticated attackers to perform state-changing actions on behalf of a logged-in administrator, such as altering plugin settings, by tricking them into clicking a malicious link. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported; EPSS indicates a very low exploitation probability (0.02%).
Stored Cross-Site
Stored cross-site scripting (XSS) via cross-site request forgery (CSRF) in the Relocate Upload WordPress plugin up to version 0.24.1 allows an unauthenticated attacker to inject malicious scripts into the administrative interface. The attack requires an authenticated administrator to be tricked into clicking a crafted link, after which the injected script executes in the context of the admin user. No active exploitation or public exploit code has been identified, and EPSS data indicates a very low exploitation probability (0.02%).
SQL injection via Cross-Site Request Forgery in the sh1zen WP Optimizer WordPress plugin (all versions through 2.3.6) lets a remote attacker who lures a logged-in privileged user into visiting a malicious page forge a state-changing request that reaches an unsanitized SQL query. Rated CVSS 9.6 with a scope change, it can compromise the WordPress database, but exploitation hinges on user interaction and there is no public exploit and a negligible EPSS of 0.03%.
Stored cross-site scripting (XSS) in the WordPress Twitch TV Embed Suite plugin allows attackers to inject malicious scripts. The vulnerability is reachable via a cross-site request forgery (CSRF) attack against authenticated administrators, affecting all plugin versions up to and including 2.1.0. No active exploitation or public exploit code has been confirmed, and the EPSS score is very low.
Stored cross-site scripting via cross-site request forgery in the OnionBuzz WordPress plugin (<=1.0.7) allows remote attackers to inject malicious scripts that execute in an administrator's browser when they are tricked into clicking a crafted link. The attack requires no authentication from the attacker, but does depend on user interaction. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Cross-site request forgery in the Navayan Subscribe WordPress plugin allows unauthenticated attackers to inject persistent cross-site scripting payloads via crafted requests. Exploitation requires an authenticated administrator to click a malicious link, whereupon arbitrary JavaScript executes in the administrator’s browser, potentially leading to session theft, data manipulation, or further compromise. No active exploitation or public exploit code has been identified; EPSS indicates a low probability of broad exploitation.
Reflected XSS vulnerability in WordPress
Cross-site request forgery (CSRF) in the Image Slider With Description WordPress plugin up to version 9.2 enables stored cross-site scripting (XSS) attacks. An unauthenticated attacker can trick a site administrator into submitting a malicious request, leading to the injection of arbitrary web scripts that execute when a victim visits the affected page. The low EPSS score (0.02%) and absence from CISA KEV suggest no active exploitation, but the issue can compromise site integrity and user data.
Cross-site request forgery in the WP Forum Server WordPress plugin (up to 1.8.2) enables unauthenticated attackers to inject stored cross-site scripting (XSS) by tricking logged-in administrators into clicking a malicious link. Successful exploitation can lead to session hijacking or full
Object Injection via Cross-Site Request Forgery (CSRF) in Infigo Software IS-theme-companion WordPress plugin allows attackers to execute arbitrary code on affected websites when an authenticated administrator is tricked into clicking a malicious link. The vulnerability exists in versions up to and including 1.57 and can lead to full site compromise. No public exploit or active exploitation has been confirmed, and the EPSS probability of exploitation is very low (0.03%).
Stored Cross-Site Scripting (XSS) can be achieved through Cross-Site Request Forgery (CSRF) in the WP Permalink Translator plugin for WordPress, affecting versions up to 1.7.6. An attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent script injection that executes in the browsers of other site visitors. EPSS predicts a very low exploitation probability (0.02%) and no active exploitation is confirmed.
Cross-site request forgery in the Slickstream WordPress plugin up to version 2.0.3 allows an unauthenticated attacker to trick an authenticated administrator into performing unintended actions, such as altering plugin settings. The vulnerability requires user interaction and has a low integrity impact. No active exploitation or public exploit code has been reported, and EPSS indicates a very low chance of real-world exploitation.
Cross-Site Request Forgery (CSRF) in the opicron Image Cleanup WordPress plugin (versions up to 1.9.2) allows unauthenticated attackers to trick authenticated administrators into performing unauthorized actions on the affected site. The vulnerability carries a CVSS base score of 4.3 (Medium) with low integrity impact only, and no public exploit or active exploitation has been observed.
Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) in the Additional Order Filters for WooCommerce WordPress plugin up to version 1.22 allows unauthenticated attackers to inject malicious scripts that execute in the context of an admin user. Exploitation requires tricking a logged-in administrator into clicking a crafted link, resulting in script storage that can compromise other admins' sessions and site data. The vulnerability has a CVSS base score of 7.1 but an extremely low EPSS exploitation probability (0.02%), and no active exploitation or public exploit code has been identified.
Cross-Site Request Forgery in the Blend Media WordPress CTA plugin up to version 1.6.9 allows unauthenticated attackers to deceive logged-in administrators into executing unwanted actions, such as modifying plugin settings, through specially crafted requests. The vulnerability has a medium CVSS base score of 4.3 due to required user interaction and low integrity impact, with no confidentiality or availability loss. No active exploitation or public exploit code has been identified.
Cross-Site Request Forgery (CSRF) in the My Wp Brand WordPress plugin allows attackers to trick authenticated administrators into performing unintended actions on the plugin’s settings. Affected versions up to 1.1.3 lack proper request origin verification, enabling state-changing operations with only low integrity impact. No active exploitation or public exploit code is known, and EPSS rates exploitation probability as very low (0.02%).
Cross-site request forgery in the WordPress plugin Import external attachments (≤1.5.12) allows an unauthenticated attacker to trick an administrator into performing unintended actions, such as modifying settings or triggering imports, by enticing them to click a malicious link while logged in. The vulnerability has low integrity impact and requires user interaction, with no confidentiality or availability impact. No active exploitation or public exploit code has been identified, and with the affected plugin’s niche deployment, the real-world risk is minimal.
Cross-Site Request Forgery in the Hide Admin Bar From Front End WordPress plugin (≤1.0.0) allows unauthenticated attackers to trick site administrators into performing unintended actions, such as modifying plugin settings that control admin bar visibility. No active exploitation or public exploit code is known, and the EPSS exploitation probability is very low (0.02%).
Unauthenticated cross-site request forgery in the Virusdie WordPress plugin through version 1.1.3 allows remote attackers to trick authenticated administrators into performing unintended actions, such as modifying plugin settings or triggering scans. Exploitation requires user interaction and no public exploit or active exploitation has been identified; EPSS indicates a very low exploitation probability.
Cross-site request forgery (CSRF) in the ONet Regenerate Thumbnails plugin for WordPress allows remote attackers to trick administrators into triggering unauthorized thumbnail regeneration. Affected versions include n/a through 1.5. The vulnerability has a CVSS 4.3 score, requires user interaction, and there is no evidence of active exploitation or public exploit code.
Cross-site request forgery (CSRF) vulnerability in the Address Autocomplete via Google for Gravity Forms WordPress plugin allows attackers to perform unauthorized actions on behalf of logged-in administrators, such as modifying plugin settings. The flaw affects plugin versions through 1.3.4 and requires user interaction (admin clicking a link). No public exploit or active exploitation has been identified; EPSS score is low (0.02%).
Cross-site request forgery in the Writesonic WordPress plugin through version 1.0.4 enables attackers to trick administrators into unknowingly triggering actions such as modifying plugin settings or disrupting service. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.02% probability of exploitation.
A Cross-Site Request Forgery vulnerability in the WP YouTube Live WordPress plugin up to version 1.10.0 allows unauthenticated attackers to trick an authenticated administrator into unknowingly performing actions, such as modifying plugin configuration. This can lead to limited integrity impact with no confidentiality or availability loss. No active exploitation or public exploit code has been observed, and the EPSS probability of exploitation is very low (0.02%).
Cyrlitera WordPress plugin versions through 1.2.0 contain a cross-site request forgery (CSRF) vulnerability allowing remote attackers to craft requests that, when submitted by an authenticated administrator, can modify plugin settings. There is no evidence of active exploitation, and EPSS predicts a very low exploitation probability (0.02%).
Cross-site request forgery in PDF Invoice Builder plugin versions up to 1.2.148 enables remote unauthenticated attackers to trick authenticated administrators into performing actions that modify invoice data, leading to limited integrity impact (CVSS 4.3). No exploit code or active exploitation is publicly reported; the EPSS exploitation probability is extremely low at 0.02%.
Unauthorized modification of cookie consent settings in the Cookiebot WordPress plugin up to version 4.5.8 allows unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) attacks. An attacker can trick a logged-in administrator into clicking a malicious link, leading to changes in cookie consent configuration. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.02%).
Cross-Site Request Forgery in the Burst Statistics WordPress plugin (≤2.0.6) could allow an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings, by submitting a crafted request. Exploitation requires user interaction and no public exploit code or active exploitation is known. The very low EPSS score (0.02%) further indicates minimal real-world risk.
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.
Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL while being logged in to the affected product, arbitrary learning histories may be registered.
Cross-Site Request Forgery in Homerunner for WordPress allows unauthenticated attackers to update plugin settings if they can trick a site administrator into performing an action like clicking a link. The vulnerability stems from missing nonce validation in the main_settings() function, affecting all versions up to 1.0.29. Exploitation requires user interaction and no public exploit or active exploitation is currently known.
Cross-site request forgery in Patient Record Management System 1.0 allows remote attackers to perform unauthorized actions by tricking an authenticated user into clicking a malicious link. A publicly available proof-of-concept exists, but no active exploitation has been confirmed. The EPSS score of 0.07% indicates a very low probability of widespread exploitation.
Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1749830289 and Tuleap Enterprise Edition 16.9-1 contain a patch for the issue.
Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1748845907, Tuleap Enterprise Edition 16.8-3, and Tuleap Enterprise Edition 16.7-5 contain a fix for the vulnerability.
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.
Cross-site request forgery in CodeAstro Expense Management System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is triggered via a crafted request, requiring user interaction. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Cross-site request forgery in SourceCodester Gym Management System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated admin. A publicly available exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.08%), indicating low exploitation likelihood.
CVE-2024-4994 is a Cross-Site Request Forgery (CSRF) vulnerability in GitLab's GraphQL API that allows unauthenticated attackers to execute arbitrary GraphQL mutations through a malicious website visited by authenticated GitLab users. This affects GitLab CE/EE versions 16.1.0-16.11.4, 17.0.0-17.0.2, and 17.1.0, with a CVSS score of 8.1 indicating high severity. The vulnerability requires user interaction (clicking a malicious link) but can result in unauthorized data manipulation or system compromise depending on the mutations executed.
A privilege escalation vulnerability in Rameez Iqbal Real Estate Manager allows Privilege Escalation (CVSS 8.8). High severity vulnerability requiring prompt remediation.
CVE-2025-52795 is a Cross-Site Request Forgery (CSRF) vulnerability in the aharonyan WP Front User Submit / Front Editor WordPress plugin (versions up to 4.9.4) that allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability has a CVSS score of 7.1 with high availability impact, enabling attackers to modify or delete user-submitted content through malicious web requests without user consent.
CVE-2025-52794 is a Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form (versions up to 1.0.0) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads through contact form submissions, affecting any user who views the contaminated form data. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low attack complexity, making it readily exploitable in typical web deployments.
CVE-2025-52793 is a Cross-Site Request Forgery (CSRF) vulnerability in Esselink.nu Settings that enables reflected Cross-Site Scripting (XSS) attacks. The vulnerability affects Esselink.nu Settings versions up to and including 2.94, allowing unauthenticated remote attackers to perform actions on behalf of users and inject malicious scripts with minimal user interaction. With a CVSS score of 7.1 and network-based attack vector, this vulnerability poses a moderate-to-significant risk to affected installations, particularly if actively exploited or if public proof-of-concept code becomes available.
CVE-2025-52792 is a Cross-Site Request Forgery (CSRF) vulnerability in the vgstef WP User Stylesheet Switcher WordPress plugin (versions up to v2.2.0) that enables Stored XSS attacks. An unauthenticated attacker can exploit this via a simple network request with user interaction to inject malicious scripts that execute in victims' browsers, potentially compromising user sessions and data. The vulnerability has not been confirmed as actively exploited in the wild, though the high CVSS score (7.1) and network-accessible attack vector indicate practical exploitability.
CVE-2025-52791 is a CSRF vulnerability in devfelixmoira Knowledge Base Maker (versions up to 1.1.8) that enables Stored XSS attacks, allowing unauthenticated remote attackers to inject malicious scripts that persist and execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can affect multiple users through stored payloads, with a CVSS score of 7.1 indicating medium-high severity. No KEV listing or confirmed EPSS data is available in public sources, and patch availability status requires verification with the vendor.
CVE-2025-52790 is a CSRF vulnerability in the r-win WP-DownloadCounter WordPress plugin (versions through 1.01) that enables Stored XSS attacks. An attacker can craft malicious requests that, when clicked by an administrator, inject persistent JavaScript into the plugin's data storage, affecting all site visitors. The CVSS 7.1 score reflects moderate severity with network-based attack delivery and user interaction requirements, though the actual exploitability and active exploitation status require verification against KEV and EPSS data.
A cross-site scripting vulnerability in George Lewe Lewe ChordPress allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CVE-2025-52784 is a Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post that enables Stored XSS attacks, affecting versions through 1.1.1. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in victims' browsers when they view affected content, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world risk.
A remote code execution vulnerability in themelocation Change Cart button Colors WooCommerce allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CVE-2025-52781 is a Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav versions up to 1.4 that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads into the application, which are then executed in the browsers of other users who interact with the compromised content. With a CVSS score of 7.1 and network-based attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected deployments, particularly if actively exploited in the wild or publicly disclosed with proof-of-concept code.
CVE-2025-52780 is a CSRF vulnerability in Mohammad Parsa Logo Manager For Samandehi (versions through 0.5) that enables Stored XSS attacks, allowing unauthenticated attackers to perform unauthorized actions and inject malicious scripts affecting other users. The vulnerability has a CVSS score of 7.1 (High) and exploits weak CSRF protections in an admin/management plugin, with the attack requiring user interaction (UI:R) but affecting multiple users via stored payload persistence.
CVE-2025-52772 is a CSRF vulnerability in Adnan Haque's Virtual Moderator plugin (versions through 1.4) that enables Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can exploit this via a malicious webpage to perform unauthorized actions and inject malicious scripts, potentially compromising user sessions and data. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected installations, though exploitation requires social engineering to trick users into visiting attacker-controlled sites.
Cross-Site Request Forgery (CSRF) in BoldGrid Post and Page Builder for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or content, without their consent. The vulnerability affects versions up to 1.27.8 and requires user interaction via a crafted link. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery (CSRF) in Real Estate Manager WordPress plugin up to version 7.3 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or deleting data, without their consent. The vulnerability has a CVSS score of 6.5 (Medium) with low EPSS probability (0.02%), and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the WordPress plugin Mailing Group Listserv up to version 3.0.5 allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying mailing list settings or deleting subscribers, by luring them to a malicious page. The vulnerability has a CVSS score of 6.5 (Medium) with a network attack vector and low complexity, but requires user interaction. No public exploit or active exploitation has been identified, and the EPSS score is very low (0.02%).
Cross-site request forgery in WP Inventory Manager allows remote attackers to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a crafted link. The vulnerability has a low EPSS score and no evidence of active exploitation, limiting real-world risk despite the network-accessible attack vector.
Cross-Site Request Forgery (CSRF) in JobWP WordPress plugin up to version 2.4.0 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or creating unauthorized job listings. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the TM Replace Howdy WordPress plugin up to version 1.4.2 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings, by crafting a malicious link. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the XML Travel Portal Widget plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. The vulnerability affects all versions up to and including 2.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery (CSRF) in Live Sports Streamthunder WordPress plugin up to version 2.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing plugin settings or initiating unauthorized operations. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings or making unauthorized API requests. The vulnerability affects all versions up to and including 1.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery in PixelBeds Channel Manager and Hotel Booking Engine plugin for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or making unauthorized bookings. The vulnerability affects all versions up to and including 1.0, with no public exploit or active exploitation identified at this time.
Cross-Site Request Forgery (CSRF) in ClipLink WordPress plugin up to version 1.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-site request forgery in code-projects School Fees Payment System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. A publicly available exploit exists, but no active exploitation has been reported. The EPSS score is low (0.09%), indicating low exploitation likelihood.
Cross-site request forgery in PHPGurukul Car Rental Portal 3.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. A publicly available exploit exists, but exploitation requires user interaction and no active exploitation has been confirmed.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Unauthorized settings changes in the Advanced Settings WordPress plugin through version 3.0.1 via Cross-Site Request Forgery allow attackers to perform state-altering actions on behalf of a logged-in administrator. The flaw stems from missing CSRF token validation on privileged requests, requiring user interaction to exploit. With a CVSS score of 4.3, a very low EPSS (0.03%) and no known active exploitation or public exploit, the immediate risk is low.
Cross-Site Request Forgery (CSRF) in Responsive Plus WordPress plugin up to version 3.2.2 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing plugin settings. The vulnerability has a low EPSS score (0.03%) and no evidence of active exploitation or public exploit code.
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.
Cross-site request forgery in WuKongOpenSource WukongCRM 9.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability exists in the AdminRoleController.java file and can be triggered remotely with user interaction. A public exploit is available, but no active exploitation has been reported.
Cross-site request forgery in jfinal_cms 5.0.1 allows an attacker to trigger a logout action without user consent. The vulnerability is publicly exploited but has low real-world risk due to limited impact and low EPSS score.
The WP URL Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the 'url_shortener_settings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The XiSearch bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6. This is due to missing or incorrect nonce validation on the 'xisearch-key-config' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Zen Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing or incorrect nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'ef_settings_submenu' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The AI Image Lab - Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the import_templates() function. This makes it possible for unauthenticated attackers to trigger an import via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Cross-Site Request Forgery in WP2HTML plugin for WordPress allows unauthenticated attackers to update plugin settings by tricking a site administrator into clicking a malicious link. Affects all versions up to 1.0.2. No public exploit or active exploitation identified.
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorrect nonce validation on the link_shield_menu_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Cross-Site Request Forgery (CSRF) vulnerability in VirtueMart's product image upload function that allows attackers to bypass CSRF token protection and perform unrestricted file uploads to the media manager. This high-severity vulnerability (CVSS 8.3) requires user interaction but poses significant risk to e-commerce platforms using affected VirtueMart versions, potentially enabling remote code execution through malicious file uploads. The vulnerability is network-accessible, requires no special privileges, and impacts confidentiality, integrity, and availability of affected systems.
Mojolicious::Plugin::CSRF version 1.03 generates CSRF tokens using weak entropy sources (process ID, current time, and a single rand() call hashed with MD5), allowing attackers to predict or brute-force valid CSRF tokens and bypass CSRF protections. This affects Perl web applications using this specific plugin version. The vulnerability is not currently listed in CISA KEV, but the weak randomness makes token prediction feasible without requiring user interaction or high attack complexity.
Critical CSRF vulnerability affecting network devices that allows unauthenticated remote attackers to execute arbitrary commands with root privileges by exploiting missing CSRF protections. The vulnerability requires minimal user interaction and presents an exceptionally high real-world risk due to its network-accessible attack vector, root-level command execution capability, and lack of authentication requirements. Active exploitation status and proof-of-concept availability should be confirmed through CISA KEV and exploit databases, as this combination of factors (no auth + remote + root RCE) typically indicates urgent patch deployment.
Dell Wyse Management Suite, versions prior to WMS 5.2, contain a Cross-Site Request Forgery (CSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
Stored XSS via cross-site request forgery in the re.place WordPress plugin allows an attacker to store malicious scripts by tricking a logged-in administrator into clicking a crafted link. The vulnerability affects versions up to 0.2.1, and no active exploitation or public exploit code has been identified at the time of analysis.
Stored Cross-Site Scripting (XSS) in the RSS Digest WordPress plugin (versions up to 1.5) can be exploited via Cross-Site Request Forgery (CSRF), allowing unauthenticated attackers to trick site administrators into performing actions that inject malicious scripts. The injected payload persists and executes in the browsers of other users, leading to content manipulation, session theft, or site defacement. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability.
Cross-site request forgery in the Społecznościowa 6 PL 2013 WordPress plugin (versions <= 2.0.6) allows unauthenticated attackers to trick an administrator into executing unintended actions, leading to stored cross-site scripting. This enables injection of malicious scripts that execute in the browsers of other users, potentially stealing session cookies, defacing the site, or redirecting visitors. No active exploitation is confirmed, and the EPSS score is very low (0.02%).
Cross-site request forgery in the Aioseo Multibyte Descriptions WordPress plugin (versions up to 0.0.6) allows unauthenticated attackers to perform state-changing actions on behalf of a logged-in administrator, such as altering plugin settings, by tricking them into clicking a malicious link. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported; EPSS indicates a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) via cross-site request forgery (CSRF) in the Relocate Upload WordPress plugin up to version 0.24.1 allows an unauthenticated attacker to inject malicious scripts into the administrative interface. The attack requires an authenticated administrator to be tricked into clicking a crafted link, after which the injected script executes in the context of the admin user. No active exploitation or public exploit code has been identified, and EPSS data indicates a very low exploitation probability (0.02%).
SQL injection via Cross-Site Request Forgery in the sh1zen WP Optimizer WordPress plugin (all versions through 2.3.6) lets a remote attacker who lures a logged-in privileged user into visiting a malicious page forge a state-changing request that reaches an unsanitized SQL query. Rated CVSS 9.6 with a scope change, it can compromise the WordPress database, but exploitation hinges on user interaction and there is no public exploit and a negligible EPSS of 0.03%.
Stored cross-site scripting (XSS) in the WordPress Twitch TV Embed Suite plugin allows attackers to inject malicious scripts. The vulnerability is reachable via a cross-site request forgery (CSRF) attack against authenticated administrators, affecting all plugin versions up to and including 2.1.0. No active exploitation or public exploit code has been confirmed, and the EPSS score is very low.
Stored cross-site scripting via cross-site request forgery in the OnionBuzz WordPress plugin (<=1.0.7) allows remote attackers to inject malicious scripts that execute in an administrator's browser when they are tricked into clicking a crafted link. The attack requires no authentication from the attacker, but does depend on user interaction. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Cross-site request forgery in the Navayan Subscribe WordPress plugin allows unauthenticated attackers to inject persistent cross-site scripting payloads via crafted requests. Exploitation requires an authenticated administrator to click a malicious link, whereupon arbitrary JavaScript executes in the administrator’s browser, potentially leading to session theft, data manipulation, or further compromise. No active exploitation or public exploit code has been identified; EPSS indicates a low probability of broad exploitation.
Reflected XSS vulnerability in WordPress
Cross-site request forgery (CSRF) in the Image Slider With Description WordPress plugin up to version 9.2 enables stored cross-site scripting (XSS) attacks. An unauthenticated attacker can trick a site administrator into submitting a malicious request, leading to the injection of arbitrary web scripts that execute when a victim visits the affected page. The low EPSS score (0.02%) and absence from CISA KEV suggest no active exploitation, but the issue can compromise site integrity and user data.
Cross-site request forgery in the WP Forum Server WordPress plugin (up to 1.8.2) enables unauthenticated attackers to inject stored cross-site scripting (XSS) by tricking logged-in administrators into clicking a malicious link. Successful exploitation can lead to session hijacking or full
Object Injection via Cross-Site Request Forgery (CSRF) in Infigo Software IS-theme-companion WordPress plugin allows attackers to execute arbitrary code on affected websites when an authenticated administrator is tricked into clicking a malicious link. The vulnerability exists in versions up to and including 1.57 and can lead to full site compromise. No public exploit or active exploitation has been confirmed, and the EPSS probability of exploitation is very low (0.03%).
Stored Cross-Site Scripting (XSS) can be achieved through Cross-Site Request Forgery (CSRF) in the WP Permalink Translator plugin for WordPress, affecting versions up to 1.7.6. An attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent script injection that executes in the browsers of other site visitors. EPSS predicts a very low exploitation probability (0.02%) and no active exploitation is confirmed.
Cross-site request forgery in the Slickstream WordPress plugin up to version 2.0.3 allows an unauthenticated attacker to trick an authenticated administrator into performing unintended actions, such as altering plugin settings. The vulnerability requires user interaction and has a low integrity impact. No active exploitation or public exploit code has been reported, and EPSS indicates a very low chance of real-world exploitation.
Cross-Site Request Forgery (CSRF) in the opicron Image Cleanup WordPress plugin (versions up to 1.9.2) allows unauthenticated attackers to trick authenticated administrators into performing unauthorized actions on the affected site. The vulnerability carries a CVSS base score of 4.3 (Medium) with low integrity impact only, and no public exploit or active exploitation has been observed.
Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) in the Additional Order Filters for WooCommerce WordPress plugin up to version 1.22 allows unauthenticated attackers to inject malicious scripts that execute in the context of an admin user. Exploitation requires tricking a logged-in administrator into clicking a crafted link, resulting in script storage that can compromise other admins' sessions and site data. The vulnerability has a CVSS base score of 7.1 but an extremely low EPSS exploitation probability (0.02%), and no active exploitation or public exploit code has been identified.
Cross-Site Request Forgery in the Blend Media WordPress CTA plugin up to version 1.6.9 allows unauthenticated attackers to deceive logged-in administrators into executing unwanted actions, such as modifying plugin settings, through specially crafted requests. The vulnerability has a medium CVSS base score of 4.3 due to required user interaction and low integrity impact, with no confidentiality or availability loss. No active exploitation or public exploit code has been identified.
Cross-Site Request Forgery (CSRF) in the My Wp Brand WordPress plugin allows attackers to trick authenticated administrators into performing unintended actions on the plugin’s settings. Affected versions up to 1.1.3 lack proper request origin verification, enabling state-changing operations with only low integrity impact. No active exploitation or public exploit code is known, and EPSS rates exploitation probability as very low (0.02%).
Cross-site request forgery in the WordPress plugin Import external attachments (≤1.5.12) allows an unauthenticated attacker to trick an administrator into performing unintended actions, such as modifying settings or triggering imports, by enticing them to click a malicious link while logged in. The vulnerability has low integrity impact and requires user interaction, with no confidentiality or availability impact. No active exploitation or public exploit code has been identified, and with the affected plugin’s niche deployment, the real-world risk is minimal.
Cross-Site Request Forgery in the Hide Admin Bar From Front End WordPress plugin (≤1.0.0) allows unauthenticated attackers to trick site administrators into performing unintended actions, such as modifying plugin settings that control admin bar visibility. No active exploitation or public exploit code is known, and the EPSS exploitation probability is very low (0.02%).
Unauthenticated cross-site request forgery in the Virusdie WordPress plugin through version 1.1.3 allows remote attackers to trick authenticated administrators into performing unintended actions, such as modifying plugin settings or triggering scans. Exploitation requires user interaction and no public exploit or active exploitation has been identified; EPSS indicates a very low exploitation probability.
Cross-site request forgery (CSRF) in the ONet Regenerate Thumbnails plugin for WordPress allows remote attackers to trick administrators into triggering unauthorized thumbnail regeneration. Affected versions include n/a through 1.5. The vulnerability has a CVSS 4.3 score, requires user interaction, and there is no evidence of active exploitation or public exploit code.
Cross-site request forgery (CSRF) vulnerability in the Address Autocomplete via Google for Gravity Forms WordPress plugin allows attackers to perform unauthorized actions on behalf of logged-in administrators, such as modifying plugin settings. The flaw affects plugin versions through 1.3.4 and requires user interaction (admin clicking a link). No public exploit or active exploitation has been identified; EPSS score is low (0.02%).
Cross-site request forgery in the Writesonic WordPress plugin through version 1.0.4 enables attackers to trick administrators into unknowingly triggering actions such as modifying plugin settings or disrupting service. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.02% probability of exploitation.
A Cross-Site Request Forgery vulnerability in the WP YouTube Live WordPress plugin up to version 1.10.0 allows unauthenticated attackers to trick an authenticated administrator into unknowingly performing actions, such as modifying plugin configuration. This can lead to limited integrity impact with no confidentiality or availability loss. No active exploitation or public exploit code has been observed, and the EPSS probability of exploitation is very low (0.02%).
Cyrlitera WordPress plugin versions through 1.2.0 contain a cross-site request forgery (CSRF) vulnerability allowing remote attackers to craft requests that, when submitted by an authenticated administrator, can modify plugin settings. There is no evidence of active exploitation, and EPSS predicts a very low exploitation probability (0.02%).
Cross-site request forgery in PDF Invoice Builder plugin versions up to 1.2.148 enables remote unauthenticated attackers to trick authenticated administrators into performing actions that modify invoice data, leading to limited integrity impact (CVSS 4.3). No exploit code or active exploitation is publicly reported; the EPSS exploitation probability is extremely low at 0.02%.
Unauthorized modification of cookie consent settings in the Cookiebot WordPress plugin up to version 4.5.8 allows unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) attacks. An attacker can trick a logged-in administrator into clicking a malicious link, leading to changes in cookie consent configuration. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.02%).
Cross-Site Request Forgery in the Burst Statistics WordPress plugin (≤2.0.6) could allow an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings, by submitting a crafted request. Exploitation requires user interaction and no public exploit code or active exploitation is known. The very low EPSS score (0.02%) further indicates minimal real-world risk.
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.
Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL while being logged in to the affected product, arbitrary learning histories may be registered.
Cross-Site Request Forgery in Homerunner for WordPress allows unauthenticated attackers to update plugin settings if they can trick a site administrator into performing an action like clicking a link. The vulnerability stems from missing nonce validation in the main_settings() function, affecting all versions up to 1.0.29. Exploitation requires user interaction and no public exploit or active exploitation is currently known.
Cross-site request forgery in Patient Record Management System 1.0 allows remote attackers to perform unauthorized actions by tricking an authenticated user into clicking a malicious link. A publicly available proof-of-concept exists, but no active exploitation has been confirmed. The EPSS score of 0.07% indicates a very low probability of widespread exploitation.
Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1749830289 and Tuleap Enterprise Edition 16.9-1 contain a patch for the issue.
Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1748845907, Tuleap Enterprise Edition 16.8-3, and Tuleap Enterprise Edition 16.7-5 contain a fix for the vulnerability.
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.
Cross-site request forgery in CodeAstro Expense Management System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is triggered via a crafted request, requiring user interaction. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Cross-site request forgery in SourceCodester Gym Management System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated admin. A publicly available exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.08%), indicating low exploitation likelihood.
CVE-2024-4994 is a Cross-Site Request Forgery (CSRF) vulnerability in GitLab's GraphQL API that allows unauthenticated attackers to execute arbitrary GraphQL mutations through a malicious website visited by authenticated GitLab users. This affects GitLab CE/EE versions 16.1.0-16.11.4, 17.0.0-17.0.2, and 17.1.0, with a CVSS score of 8.1 indicating high severity. The vulnerability requires user interaction (clicking a malicious link) but can result in unauthorized data manipulation or system compromise depending on the mutations executed.
A privilege escalation vulnerability in Rameez Iqbal Real Estate Manager allows Privilege Escalation (CVSS 8.8). High severity vulnerability requiring prompt remediation.
CVE-2025-52795 is a Cross-Site Request Forgery (CSRF) vulnerability in the aharonyan WP Front User Submit / Front Editor WordPress plugin (versions up to 4.9.4) that allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability has a CVSS score of 7.1 with high availability impact, enabling attackers to modify or delete user-submitted content through malicious web requests without user consent.
CVE-2025-52794 is a Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form (versions up to 1.0.0) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads through contact form submissions, affecting any user who views the contaminated form data. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low attack complexity, making it readily exploitable in typical web deployments.
CVE-2025-52793 is a Cross-Site Request Forgery (CSRF) vulnerability in Esselink.nu Settings that enables reflected Cross-Site Scripting (XSS) attacks. The vulnerability affects Esselink.nu Settings versions up to and including 2.94, allowing unauthenticated remote attackers to perform actions on behalf of users and inject malicious scripts with minimal user interaction. With a CVSS score of 7.1 and network-based attack vector, this vulnerability poses a moderate-to-significant risk to affected installations, particularly if actively exploited or if public proof-of-concept code becomes available.
CVE-2025-52792 is a Cross-Site Request Forgery (CSRF) vulnerability in the vgstef WP User Stylesheet Switcher WordPress plugin (versions up to v2.2.0) that enables Stored XSS attacks. An unauthenticated attacker can exploit this via a simple network request with user interaction to inject malicious scripts that execute in victims' browsers, potentially compromising user sessions and data. The vulnerability has not been confirmed as actively exploited in the wild, though the high CVSS score (7.1) and network-accessible attack vector indicate practical exploitability.
CVE-2025-52791 is a CSRF vulnerability in devfelixmoira Knowledge Base Maker (versions up to 1.1.8) that enables Stored XSS attacks, allowing unauthenticated remote attackers to inject malicious scripts that persist and execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can affect multiple users through stored payloads, with a CVSS score of 7.1 indicating medium-high severity. No KEV listing or confirmed EPSS data is available in public sources, and patch availability status requires verification with the vendor.
CVE-2025-52790 is a CSRF vulnerability in the r-win WP-DownloadCounter WordPress plugin (versions through 1.01) that enables Stored XSS attacks. An attacker can craft malicious requests that, when clicked by an administrator, inject persistent JavaScript into the plugin's data storage, affecting all site visitors. The CVSS 7.1 score reflects moderate severity with network-based attack delivery and user interaction requirements, though the actual exploitability and active exploitation status require verification against KEV and EPSS data.
A cross-site scripting vulnerability in George Lewe Lewe ChordPress allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CVE-2025-52784 is a Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post that enables Stored XSS attacks, affecting versions through 1.1.1. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in victims' browsers when they view affected content, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world risk.
A remote code execution vulnerability in themelocation Change Cart button Colors WooCommerce allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CVE-2025-52781 is a Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav versions up to 1.4 that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads into the application, which are then executed in the browsers of other users who interact with the compromised content. With a CVSS score of 7.1 and network-based attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected deployments, particularly if actively exploited in the wild or publicly disclosed with proof-of-concept code.
CVE-2025-52780 is a CSRF vulnerability in Mohammad Parsa Logo Manager For Samandehi (versions through 0.5) that enables Stored XSS attacks, allowing unauthenticated attackers to perform unauthorized actions and inject malicious scripts affecting other users. The vulnerability has a CVSS score of 7.1 (High) and exploits weak CSRF protections in an admin/management plugin, with the attack requiring user interaction (UI:R) but affecting multiple users via stored payload persistence.
CVE-2025-52772 is a CSRF vulnerability in Adnan Haque's Virtual Moderator plugin (versions through 1.4) that enables Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can exploit this via a malicious webpage to perform unauthorized actions and inject malicious scripts, potentially compromising user sessions and data. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected installations, though exploitation requires social engineering to trick users into visiting attacker-controlled sites.
Cross-Site Request Forgery (CSRF) in BoldGrid Post and Page Builder for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or content, without their consent. The vulnerability affects versions up to 1.27.8 and requires user interaction via a crafted link. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery (CSRF) in Real Estate Manager WordPress plugin up to version 7.3 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or deleting data, without their consent. The vulnerability has a CVSS score of 6.5 (Medium) with low EPSS probability (0.02%), and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the WordPress plugin Mailing Group Listserv up to version 3.0.5 allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying mailing list settings or deleting subscribers, by luring them to a malicious page. The vulnerability has a CVSS score of 6.5 (Medium) with a network attack vector and low complexity, but requires user interaction. No public exploit or active exploitation has been identified, and the EPSS score is very low (0.02%).
Cross-site request forgery in WP Inventory Manager allows remote attackers to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a crafted link. The vulnerability has a low EPSS score and no evidence of active exploitation, limiting real-world risk despite the network-accessible attack vector.
Cross-Site Request Forgery (CSRF) in JobWP WordPress plugin up to version 2.4.0 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or creating unauthorized job listings. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the TM Replace Howdy WordPress plugin up to version 1.4.2 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings, by crafting a malicious link. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the XML Travel Portal Widget plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. The vulnerability affects all versions up to and including 2.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery (CSRF) in Live Sports Streamthunder WordPress plugin up to version 2.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing plugin settings or initiating unauthorized operations. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings or making unauthorized API requests. The vulnerability affects all versions up to and including 1.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery in PixelBeds Channel Manager and Hotel Booking Engine plugin for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or making unauthorized bookings. The vulnerability affects all versions up to and including 1.0, with no public exploit or active exploitation identified at this time.
Cross-Site Request Forgery (CSRF) in ClipLink WordPress plugin up to version 1.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-site request forgery in code-projects School Fees Payment System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. A publicly available exploit exists, but no active exploitation has been reported. The EPSS score is low (0.09%), indicating low exploitation likelihood.
Cross-site request forgery in PHPGurukul Car Rental Portal 3.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. A publicly available exploit exists, but exploitation requires user interaction and no active exploitation has been confirmed.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Unauthorized settings changes in the Advanced Settings WordPress plugin through version 3.0.1 via Cross-Site Request Forgery allow attackers to perform state-altering actions on behalf of a logged-in administrator. The flaw stems from missing CSRF token validation on privileged requests, requiring user interaction to exploit. With a CVSS score of 4.3, a very low EPSS (0.03%) and no known active exploitation or public exploit, the immediate risk is low.
Cross-Site Request Forgery (CSRF) in Responsive Plus WordPress plugin up to version 3.2.2 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing plugin settings. The vulnerability has a low EPSS score (0.03%) and no evidence of active exploitation or public exploit code.
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.
Cross-site request forgery in WuKongOpenSource WukongCRM 9.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability exists in the AdminRoleController.java file and can be triggered remotely with user interaction. A public exploit is available, but no active exploitation has been reported.
Cross-site request forgery in jfinal_cms 5.0.1 allows an attacker to trigger a logout action without user consent. The vulnerability is publicly exploited but has low real-world risk due to limited impact and low EPSS score.
The WP URL Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the 'url_shortener_settings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The XiSearch bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6. This is due to missing or incorrect nonce validation on the 'xisearch-key-config' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Zen Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing or incorrect nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'ef_settings_submenu' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The AI Image Lab - Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the import_templates() function. This makes it possible for unauthenticated attackers to trigger an import via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Cross-Site Request Forgery in WP2HTML plugin for WordPress allows unauthenticated attackers to update plugin settings by tricking a site administrator into clicking a malicious link. Affects all versions up to 1.0.2. No public exploit or active exploitation identified.
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorrect nonce validation on the link_shield_menu_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Cross-Site Request Forgery (CSRF) vulnerability in VirtueMart's product image upload function that allows attackers to bypass CSRF token protection and perform unrestricted file uploads to the media manager. This high-severity vulnerability (CVSS 8.3) requires user interaction but poses significant risk to e-commerce platforms using affected VirtueMart versions, potentially enabling remote code execution through malicious file uploads. The vulnerability is network-accessible, requires no special privileges, and impacts confidentiality, integrity, and availability of affected systems.
Mojolicious::Plugin::CSRF version 1.03 generates CSRF tokens using weak entropy sources (process ID, current time, and a single rand() call hashed with MD5), allowing attackers to predict or brute-force valid CSRF tokens and bypass CSRF protections. This affects Perl web applications using this specific plugin version. The vulnerability is not currently listed in CISA KEV, but the weak randomness makes token prediction feasible without requiring user interaction or high attack complexity.
Critical CSRF vulnerability affecting network devices that allows unauthenticated remote attackers to execute arbitrary commands with root privileges by exploiting missing CSRF protections. The vulnerability requires minimal user interaction and presents an exceptionally high real-world risk due to its network-accessible attack vector, root-level command execution capability, and lack of authentication requirements. Active exploitation status and proof-of-concept availability should be confirmed through CISA KEV and exploit databases, as this combination of factors (no auth + remote + root RCE) typically indicates urgent patch deployment.
Dell Wyse Management Suite, versions prior to WMS 5.2, contain a Cross-Site Request Forgery (CSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.