Cross-Site Request Forgery

Stored XSS vulnerability in Zoho ZeptoMail transmail WordPress plugin through version 3.3.1 can be triggered via Cross-Site Request Forgery (CSRF), allowing unauthenticated attackers to inject malicious scripts that persist in the application and execute in the browsers of all users who access affected pages. The vulnerability affects the transmail plugin for Zoho Mail integration and carries low exploitation probability (EPSS 0.02%) despite the high-impact nature of stored XSS.

Cross-site request forgery (CSRF) vulnerability in the WordPress Custom Post Status plugin up to version 1.1.0 enables attackers to perform unauthorized actions on behalf of authenticated administrators, potentially leading to stored cross-site scripting (XSS) attacks. The CSRF protection bypass allows unauthenticated attackers to craft malicious requests that, when clicked by an admin, result in persistent JavaScript injection into the WordPress database. This is a chained vulnerability where CSRF-enabled request forgery leads to XSS payload storage.

Stored XSS vulnerability in the Recent Posts From Each Category WordPress plugin through version 1.4 exploitable via Cross-Site Request Forgery (CSRF), allowing unauthenticated attackers to inject malicious scripts that execute in the context of site administrators and visitors. The vulnerability combines a CSRF flaw with inadequate input sanitization, enabling persistent payload storage that affects all users viewing affected plugin output.

Cross-site request forgery (CSRF) in the Marcin Kijak Noindex by Path WordPress plugin through version 1.0 allows unauthenticated attackers to perform unauthorized administrative actions such as modifying plugin settings via crafted HTML or JavaScript on attacker-controlled sites. The vulnerability chaining with stored XSS enables attackers to inject malicious scripts that persist in the plugin's data, affecting all users who access the compromised settings. No public exploit code has been identified, and real-world exploitation risk is minimal (EPSS 0.02%), indicating this is primarily a theoretical risk in low-traffic or neglected WordPress installations.

WP-EasyArchives WordPress plugin versions 3.1.2 and earlier contains a cross-site request forgery (CSRF) vulnerability that enables stored cross-site scripting (XSS) attacks. An unauthenticated attacker can craft a malicious request to trick authenticated administrators into performing unintended actions, potentially injecting persistent JavaScript payloads that execute in the browsers of all site visitors. With an EPSS score of 0.02% (5th percentile), this vulnerability represents minimal real-world exploitation probability despite the attack chain complexity.

Cross-site request forgery (CSRF) vulnerability in reneade SensitiveTagCloud WordPress plugin through version 1.4.1 allows attackers to perform unauthorized actions on behalf of authenticated administrators, potentially combined with stored XSS to inject malicious content. The vulnerability affects all versions up to and including 1.4.1, with no CVSS vector provided, but EPSS data suggests low real-world exploitation probability (0.02% percentile).

Cross-site request forgery (CSRF) vulnerability in the Social Profilr WordPress plugin version 1.0 and earlier allows attackers to perform unauthorized actions on behalf of authenticated administrators, potentially leading to stored cross-site scripting (XSS) attacks. The vulnerability affects the social-profilr-display-social-network-profile plugin and carries a low exploitation probability (EPSS 0.02%), with no public exploit code or confirmed active exploitation identified at the time of analysis.

Cross-Site Request Forgery (CSRF) in the Custom Style WordPress plugin up to version 1.0 enables attackers to perform unauthorized administrative actions, potentially leading to stored cross-site scripting (XSS) injection. The vulnerability affects all versions from initial release through 1.0, with no CVSS score published but an EPSS score of 0.02% indicating minimal observed exploitation probability. No active KEV status or public exploit code has been identified.

Stored XSS via CSRF in eleopard Behance Portfolio Manager WordPress plugin versions up to 1.7.5 allows authenticated attackers to inject malicious scripts through cross-site request forgery mechanisms, potentially compromising site administrators and visitors. The EPSS score of 0.02% indicates low exploitation probability, though the vulnerability type suggests a chainable attack vector when combined with social engineering. No CVSS score was assigned, limiting quantification of attack complexity and privilege requirements.

Cross-site request forgery (CSRF) vulnerability in Simple Archive Generator WordPress plugin through version 5.2 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated administrators, potentially leading to stored XSS injection. The vulnerability requires tricking an administrator into visiting a malicious page but carries low exploitation probability (EPSS 0.02%) despite being simple to execute, suggesting limited real-world weaponization.

WP-CalDav2ICS WordPress plugin through version 1.3.4 contains a Cross-Site Request Forgery (CSRF) vulnerability that enables Stored XSS attacks. The vulnerability allows unauthenticated attackers to craft malicious requests that, when executed by a logged-in administrator or user, inject persistent malicious scripts into the plugin's stored data. This combined CSRF+XSS chain can lead to persistent compromise of the WordPress site through script injection.

Cross-site request forgery (CSRF) vulnerability in the Easy Property Listings XML/CSV Import plugin for WordPress (versions <= 2.2.1) allows attackers to perform unauthorized actions on behalf of authenticated administrators without their knowledge or consent. The vulnerability affects the import functionality and carries minimal real-world exploitation risk based on EPSS scoring (0.02%, 5th percentile), indicating low likelihood of automated exploitation despite the CSRF vector requiring no special privileges or authentication from the attacker's perspective.

CSRF vulnerability in WING WordPress Migrator plugin through version 1.2.0 permits unauthenticated attackers to upload web shells to affected WordPress sites by tricking site administrators into visiting a malicious webpage. The vulnerability exploits missing nonce verification in file upload functionality, enabling arbitrary code execution with web server privileges. No public exploit code or active exploitation confirmed at time of analysis.

Cross-site request forgery in Ays Pro Popup Box plugin for WordPress up to version 6.0.7 allows an unauthenticated attacker to trick an authenticated administrator into performing unintended actions, such as modifying popup settings, leading to limited integrity and availability impact. EPSS indicates extremely low exploitation probability (0.02%), and no active exploitation or public proof-of-concept is currently identified.

Cross-site request forgery in Heateor Social Login WordPress plugin up to 1.1.39 allows unauthenticated attackers to perform unauthorized actions on authenticated administrators' behalf via crafted links. Exploitation can result in low-impact integrity and availability changes, such as modifying plugin settings. No known public exploit or active exploitation reported.

Cross-Site Request Forgery (CSRF) in Five Star Restaurant Reservations WordPress plugin versions ≤2.7.8 enables unauthenticated attackers to perform unauthorized administrative actions through social engineering. With CVSS 8.8 (High), the vulnerability requires no privileges and low attack complexity, though user interaction is necessary. EPSS probability is minimal (0.02%, 6th percentile), indicating low observed exploitation likelihood despite the high CVSS score. No confirmed active exploitation (not in CISA KEV) or public exploit code identified at time of analysis.

Cross-Site Request Forgery (CSRF) in the Vimeotheque plugin for WordPress (version 2.3.5.2 and earlier) allows unauthenticated attackers to trick authenticated users into performing state-changing actions, resulting in low integrity impact. The flaw carries a CVSS v3.1 score of 4.3 (Medium) but has an EPSS exploitation probability of only 0.02%, indicating very low real-world risk. No active exploitation or public exploit code has been identified at the time of analysis.

Cross-Site Request Forgery in the Fast User Switching WordPress plugin (versions ≤1.4.10) allows tricking an administrator into performing unintended user-switching actions. The flaw poses a medium risk (CVSS 4.3) but requires user interaction and is not currently known to be actively exploited nor publicly weaponized.

Cross-site request forgery in Advanced Classifieds & Directory Pro for WordPress up to version 3.2.9 allows unauthenticated attackers to perform unauthorized actions, such as modifying plugin settings, by tricking an authenticated administrator into clicking a crafted link. No public exploit or active exploitation is known, and EPSS gives a 0.02% probability of exploitation, indicating very low real-world risk.

Cross-site request forgery in Simple Keyword to Link WordPress plugin version 1.5 and below allows unauthenticated attackers to trick authenticated administrators into modifying keyword-to-link associations through crafted requests. No active exploitation or public exploit code has been identified, and the low EPSS score suggests a low probability of widespread attacks.

Cross-Site Request Forgery in WordPress plugin My Auctions Allegro (versions ≤3.6.33) allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through social engineering. CVSS 8.8 severity stems from potential high confidentiality, integrity, and availability impact if victims are tricked into clicking malicious links while authenticated. EPSS score of 0.02% (6th percentile) indicates very low probability of exploitation in the wild. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis, suggesting this remains a theoretical high-severity issue requiring user interaction.

Unauthorized setting modification in the WP Email Capture WordPress plugin through version 3.12.5 allows an unauthenticated attacker to trick a logged-in administrator into performing actions such as altering email capture settings. The vulnerability requires user interaction and has very low exploitation probability (EPSS 0.02%); no active exploitation or public exploit code is known.

Cross-Site Request Forgery in the Trade Runner WordPress plugin (versions ≤ 3.14) allows a remote attacker to trick a logged-in administrator into submitting a forged request, resulting in unauthorized low-impact data modification. The vulnerability is not listed in CISA KEV and has no known public exploit, with EPSS score indicating very low exploitation likelihood.

Cross-Site Request Forgery in the WordPress Evergreen Post Tweeter plugin (<=1.8.9) allows stored XSS when a logged-in administrator is tricked into clicking a malicious link. Attackers can exploit this to inject persistent scripts that execute in the browsers of other site visitors, potentially leading to session hijacking or site defacement. No active exploitation or public exploit code has been identified, and the EPSS score is very low (0.02%).

Cross-Site Request Forgery in Premium Addons for Elementor plugin versions up to 4.11.53 allows unauthenticated remote attackers to create arbitrary Elementor templates by exploiting missing nonce validation in the 'insert_inner_template' function. An attacker must trick a site administrator or user with edit_posts capability into clicking a malicious link, but no public exploit code has been identified. The EPSS score of 0.02% indicates this vulnerability has very low exploitation probability in practice despite the CVSS 4.3 rating.

Cross-site request forgery (CSRF) in Kunal Custom 404 Pro WordPress plugin through version 3.12.0 allows attackers to perform unauthorized actions on behalf of authenticated administrators without their knowledge or consent. The vulnerability affects all versions up to and including 3.12.0, with no CVSS score assigned at the time of analysis. No public exploit code has been identified, and the EPSS score of 0.02% indicates minimal likelihood of active exploitation despite the moderate technical severity of CSRF flaws.

Cross-site request forgery (CSRF) vulnerability in PluginOps Feather Login Page WordPress plugin versions up to 1.1.7 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users without their knowledge or consent. The vulnerability stems from missing CSRF token validation on plugin functionality, enabling attackers to craft malicious requests that execute when users visit attacker-controlled pages while logged into sites using the vulnerable plugin. No public exploit code or active exploitation has been identified at time of analysis; however, the low EPSS score (0.02%) and lack of CVSS data suggest this may represent a lower-severity implementation gap rather than a critical attack vector in typical WordPress deployments.

Authenticated attackers can perform unauthorized state-changing operations in Restajet Online Food Delivery System (all versions through December 19, 2025) by exploiting missing CSRF protections. The vulnerability, disclosed by Turkey's USOM (National Cyber Incident Response Center), carries a CVSS score of 7.1 with high integrity impact, though EPSS modeling indicates only 0.02% exploitation probability (5th percentile). No public exploit identified at time of analysis, and vendor did not respond to disclosure attempts.

Account linkage via Cross-Site Request Forgery (CSRF) in fastapi-sso before 0.19.0 allows attackers to trick a victim into visiting a malicious callback URL that links the attacker's OAuth provider account to the victim's internal application account, granting the attacker unauthorized access. The vulnerability stems from missing state parameter validation during OAuth callback processing. A public proof-of-concept exists, but no active exploitation has been confirmed.

Cross-site request forgery in the Meks Quick Plugin Disabler WordPress plugin (≤1.0) allows an attacker to trick a logged-in administrator into disabling plugins, leading to potential service disruption. No active exploitation or public exploit code is known; EPSS probability is 0.03%.

Cross-Site Request Forgery in the Semrush Content Toolkit WordPress plugin allows attackers to trick authenticated users into performing unauthorized actions. All versions up to 1.1.32 are vulnerable. No active exploitation or public exploit code has been reported, and EPSS score indicates very low likelihood of widespread exploitation.

Cross-site request forgery in the RTL Tester WordPress plugin through version 1.2 allows unauthenticated attackers to trick administrative users into toggling the RTL test mode, causing temporary site layout changes. This low-severity issue (CVSS 4.3) has a very low exploitation probability (EPSS 0.03%) and no known active exploitation or public exploit code.

Cross-site request forgery in the Quick Interest Slider WordPress plugin (versions up to 3.1.5) allows unauthenticated attackers to deceive authenticated administrators into executing unauthorized actions, such as modifying plugin settings. No public exploit code or active exploitation has been identified, and EPSS predicts a very low exploitation probability.

Cross-Site Request Forgery in Resource Library for Logged In Users WordPress plugin (all versions up to 1.5) allows unauthenticated attackers to perform unauthorized administrative actions including creating, editing, and deleting resources and categories by tricking a site administrator into clicking a malicious link. The vulnerability stems from missing nonce validation on multiple administrative functions. With an EPSS score of 0.02% and low real-world exploitation probability despite the CVSS 4.3 score, this represents a lower-priority vulnerability requiring user interaction and administrative privileges on the target site.

Cross-site request forgery in 1Panel versions 1.10.33 through 2.0.15 allows a remote attacker to change an authenticated user's panel name by luring them to a malicious webpage. The panel name management endpoint omits both anti-CSRF tokens and Origin/Referer header validation, so the victim's browser automatically includes valid session cookies when the forged request fires. No public exploit code and no CISA KEV listing exist at time of analysis; real-world impact is limited to low-integrity panel configuration tampering.

Cross-site request forgery in 1Panel (versions 1.10.33 through 2.0.15) lets a remote attacker change the TCP port the web management service listens on by luring an authenticated administrator to a malicious webpage. Because the port-change endpoint has no anti-CSRF token or Origin/Referer checks, the victim's browser silently replays valid session cookies, moving the panel off its expected port and causing loss of access, denial of service, or unintended exposure on an attacker-chosen port. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is trivially craftable given the described missing defenses.

Account lockout denial-of-service in 1Panel (versions 1.10.33 through 2.0.15) allows a remote attacker to forcibly change an authenticated victim's username via a cross-site request forgery flaw in the Change Username endpoint at /settings/panel. Because the endpoint lacks anti-CSRF tokens and Origin/Referer validation, a victim who visits a malicious page while logged in unknowingly submits a username change with valid session cookies, after which they are logged out and locked out of their account. No public exploit identified at time of analysis; disclosed via a VulnCheck advisory with no CISA KEV listing and no EPSS data supplied.

Cross-Site Request Forgery in PSM Plugins SupportCandy allows remote attackers to perform unintended actions in the WordPress plugin by tricking a logged-in administrator into visiting a malicious link. This vulnerability affects SupportCandy versions up to and including 3.4.1. No exploitation or public proof-of-concept is known, and the EPSS probability is extremely low at 0.03%.

Cross-Site Request Forgery in Strategy11 Team Business Directory plugin allows attackers to perform unauthorized actions on behalf of authenticated administrators. Affecting installations up to version 6.4.19, this flaw can be triggered when a logged-in user visits a malicious website. No active exploitation or public exploit code is known, and EPSS indicates a very low likelihood of widespread attacks.

Cross-Site Request Forgery in the Quiz Maker WordPress plugin by Ays Pro up to version 6.7.0.82 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated site administrators. No active exploitation or public exploit code has been identified, and a vendor patch is available via a later version.

Cross-Site Request Forgery (CSRF) in the UsersWP WordPress plugin up to 1.2.48 allows unauthenticated attackers to perform low-integrity actions by tricking an authenticated user into clicking a crafted link. Only the integrity of the targeted user’s data is affected, with no risk to confidentiality or availability. No active exploitation or public exploit code has been identified.

Cross-site request forgery (CSRF) in the JNews Paywall WordPress plugin (versions < 12.0.1) allows remote attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings, by inducing them to click a malicious link. The vulnerability carries a CVSS base score of 4.3 (Medium) and an EPSS probability of 0.03%, indicating very low anticipated exploitation rates. No public exploit or active exploitation is currently reported.

Cross-site request forgery in the Ultimate FAQ WordPress plugin through version 2.4.3 allows unauthenticated attackers to trick authenticated administrators into performing unintended actions, such as modifying FAQ content. The vulnerability carries a CVSS 4.3 (medium) and a very low EPSS exploitation probability (0.03%), with no evidence of active exploitation or public proof-of-concept at time of analysis.

We are tasked with synthesizing data about CVE-2025-67534 into a comprehensive JSON analysis. We must use ALL provided data: references, EPSS, KEV status (not mentioned, assume false), patch availability, CPE strings (none provided), and tags (CSRF, XSS). First, parse the description: "Cross-Site Request Forgery (CSRF) vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS. This issue affects Rencontre: from n/a through <= 3.13.7." CVSS: 7.1, vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. CWE-352. EPSS: 0.03% (low). No KEV mentioned, so not actively exploited. No POC data. Patch? Reference is a Patchstack database entry for a WordPress plugin. We need to infer patch availability. The reference URL likely describes the vulnerability and might say if a patch exists. Since no explicit fix version is mentioned beyond "<= 3.13.7", it's probable that the next version after 3.13.7 is a fix, but not confirmed. I'll say "Patch availability not confirmed; likely fix in version >3.13.7" but careful: rule says "If patch data says NOT available: 'No vendor-released patch identified at time of analysis'". We don't have explicit patch data. I'll note: "Upstream fix not independently confirmed; likely version after 3.13.7 addresses the issue" but avoid inventing version numbers. For remediation, I can say "Upgrade to Rencontre version 3.13.8 or higher if available, or apply vendor-provided patch" but careful: we only know <= 3.13.7 affected, so fix version would be 3.13.8. Patchstack might indicate the fix version. Since the reference is a Patchstack URL, they usually show the fixed version. So I'll assume the fix is in a later version. I'll state: "Vendor patch likely available in version 3.13.8 or later" but the rule says to cite exact fix versions from input data. The input data doesn't mention a specific fix version, only "through <= 3.13.7". I'll check: "Patch available per vendor advisory" would fit if the advisory says patch available. The reference URL is

A cross-site request forgery vulnerability in the CWW Companion WordPress plugin up to version 1.3.2 allows unauthenticated attackers to trick admin users into performing unintended actions, such as modifying plugin

Cross-site request forgery in vcita Online Booking & Scheduling Calendar plugin for WordPress versions <=4.5.5 enables an unauthenticated attacker to trick a logged-in administrator into performing unintended actions, such as modifying calendar settings, due to missing CSRF token validation. No known active exploitation or public exploit code exists; EPSS predicts very low exploitation likelihood (0.03%).

Cross-Site Request Forgery in the Quick Contact Form WordPress plugin through version 8.2.5 allows unauthenticated attackers to trick authenticated administrators into performing unintended actions, such as modifying form settings. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of real-world exploitation.

Cross-site request forgery (CSRF) in the kubiq PDF Thumbnail Generator WordPress plugin (versions through 1.4) allows remote attackers to perform unauthorized actions on behalf of authenticated administrators via crafted requests. Successful exploitation requires user interaction, such as tricking an admin to click a link, and could result in limited integrity impact, like altering plugin settings. No public exploit code or active exploitation has been reported; EPSS indicates a very low exploitation probability.

Cross-site request forgery in GiveWP plugin through version 4.13.1 allows remote attackers to trick authenticated administrators into performing unauthorized actions, such as tampering with donation settings. The vulnerability requires user interaction and has a medium CVSS score of 5.4, with no active exploitation or public proof-of-concept identified. EPSS probability is very low at 0.02%.

Cross-site request forgery (CSRF) vulnerability in the Simple Link Directory WordPress plugin allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying or deleting link directory entries. Affects versions up to and including 8.8.3. No active exploitation or public exploit has been reported, and the EPSS score is low (0.03%).

Cross-site request forgery in the Salon booking system plugin for WordPress (versions up to 10.30.3) allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as modifying settings or deleting bookings. Exploitation requires tricking a logged-in administrator into clicking a malicious link; no public exploit code or active exploitation has been identified at this time. EPSS score is 0.03%, indicating very low probability of widespread exploitation.

Cross-site request forgery in Ays Pro Chartify plugin for WordPress through version 3.6.3 allows an attacker to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a malicious link. No active exploitation or public exploit code has been identified at this time, and the exploitation probability is low (EPSS 0.03%). The vulnerability could lead to modification of chart builder settings but cannot compromise confidentiality or availability.

Cross-Site Request Forgery in PressTigers Simple Folio WordPress plugin up to version 1.1.0 allows an unauthenticated remote attacker to trick an administrator into performing unintended state-changing actions, such as modifying plugin settings, resulting in low integrity impact. User interaction is required to exploit this vulnerability; no confidentiality or availability impact occurs. At the time of analysis, no active exploitation or public exploit code has been identified, and the EPSS score is very low (0.03%), indicating low likelihood of widespread attacks.

Cross-site request forgery in KALLYAS WordPress theme versions before 4.25.0 allows authenticated attackers to perform unauthorized actions on behalf of legitimate users without their knowledge or consent. The vulnerability requires user interaction (UI:N indicates no additional user interaction beyond authentication) and affects only confidentiality with low impact. While CVSS scores 4.3 (medium severity), the EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation likelihood despite public awareness.

Cross-Site Request Forgery in WordPress New User Approve plugin (versions ≤3.2.3) enables unauthenticated remote attackers to trick authenticated administrators into executing unauthorized actions via crafted requests. With EPSS probability of 0.02% (5th percentile) and no evidence of active exploitation (not in CISA KEV), this represents a moderate real-world risk despite a CVSS 7.1 score. The vulnerability requires user interaction (UI:R) but no attacker privileges (PR:N), making it viable through social engineering tactics like phishing emails containing malicious links.

Cross-site request forgery in ThimPress WP Hotel Booking plugin version 2.2.8 and earlier allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through crafted requests. The vulnerability requires user interaction (clicking a malicious link) and results in limited information disclosure, with a CVSS score of 4.3. Exploitation probability is very low per EPSS (0.02% percentile 5%), suggesting this is a lower-priority vulnerability despite public researcher disclosure.

Cross-Site Request Forgery in the SMTP Mail WordPress plugin allows unauthenticated attackers to perform state-changing actions on behalf of authenticated administrators if they are tricked into clicking a malicious link. The vulnerability affects versions up to and including 1.3.51 and can lead to unauthorized modification of plugin settings. There is no evidence of active exploitation or publicly available exploit code, and the EPSS probability of exploitation is very low (0.03%).

A Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Add Custom Codes (versions through 4.80) allows unauthenticated attackers, with no privileges, to trick a site administrator into executing unintended requests. Successful exploitation leads to high integrity impact—attackers can modify plugin settings, potentially injecting malicious content. No evidence of active exploitation or public exploit code exists, and the EPSS probability is extremely low (0.03%).

Cross-site request forgery (CSRF) in WordPress Media Library Downloader plugin versions up to 1.4.0 allows unauthenticated attackers to perform unauthorized actions on behalf of logged-in site administrators or users via crafted web requests. The vulnerability requires user interaction (UI:R) and has limited scope-affecting only integrity (I:L) with no confidentiality or availability impact. EPSS exploitation probability is very low at 0.02% (5th percentile), indicating minimal real-world exploitation likelihood despite the public disclosure.

Cross-Site Request Forgery (CSRF) in the WordPress plugin 'Media Library File Download' (versions <= 1.4) allows an unauthenticated attacker to trick a logged-in administrator into performing actions such as modifying download settings, potentially leading to unauthorized file download access. The vulnerability has a CVSS 3.1 base score of 4.3 (Low) with low integrity impact, and an EPSS score of 0.03% indicating negligible exploitation probability.

Cross-site request forgery (CSRF) in Create Posts & Terms WordPress plugin through version 1.3.1 enables attackers to inject malicious scripts that persist in the application database. Exploitation requires tricking an authenticated administrator into visiting a malicious page while logged into WordPress. The vulnerability chains CSRF with stored XSS, allowing attackers to execute arbitrary JavaScript in victims' browsers across sessions with potential for privilege escalation, data theft, and site compromise. EPSS score and exploitation data not available, but Patchstack database listing indicates security researcher disclosure.

Cross-site request forgery in Panilux versions before 0.10.0 can be chained to command injection, allowing remote attackers to execute arbitrary operating system commands when an authenticated user is tricked into visiting a malicious page. The CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C) reflects scope change and full CIA impact, though exploitation requires user interaction and the affected vendor has denied ownership of the product, complicating disclosure. EPSS is very low at 0.04% (11th percentile) and no public exploit is identified at time of analysis.

Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763126988 and Tuleap Enterprise Edition prior to 17.0-3 and 16.13-8 have missing CSRF protections which allow attackers to create or remove tracker triggers. This issue is fixed in Tuleap Community Edition version 17.0.99.1763126988 and Tuleap Enterprise Edition versions 17.0-3 and 16.13-8.

Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. This issue is fixed in version Tuleap Community Edition version 17.0.99.1762444754 and Tuleap Enterprise Edition versions 17.0-2, 16.13-7 and 16.12-10.

phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an administrator has an active session.

Some endpoints in vulnerability-lookup that modified application state (e.g. changing database entries, user data, configurations, or other privileged actions) may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw leaves the application vulnerable to Cross-Site Request Forgery (CSRF) attacks: an attacker who tricks a logged-in user into visiting a malicious website could cause the user’s browser to issue GET requests that perform unintended state-changing operations in the context of their authenticated session. Because the server would treat these GET requests as valid (since no CSRF protection or POST method enforcement was in place), the attacker could exploit this to escalate privileges, change settings, or carry out other unauthorized actions without needing the user’s explicit consent or awareness.  The fix ensures that all state-changing endpoints now require HTTP POST requests and include a valid CSRF token. This enforces that state changes cannot be triggered by arbitrary cross-site GET requests. This issue affects Vulnerability-Lookup: before 2.18.0.

Cross-site request forgery in fit2cloud Halo 2.21.10 allows remote attackers to perform unauthorized actions on behalf of authenticated users. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed. The vendor was contacted but did not respond, leaving the vulnerability unpatched.

The WP Landing Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the 'wplp_api_update_text' function. This makes it possible for unauthenticated attackers to update arbitrary post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.

The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the "Import Using CSV File" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.

Configuration modification in ARK Related Posts plugin for WordPress 2.19 and earlier allows unauthenticated attackers to change plugin settings via a cross-site request forgery attack, requiring an administrator to click a malicious link. No active exploitation has been reported, and the EPSS exploitation probability is very low (0.02%).

The WC Vendors - WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendor_dashboard/product/delete/ endpoint. This makes it possible for unauthenticated attackers to delete vendor products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Cross-Site Request Forgery in the Torod plugin for WordPress up to version 1.9 can be exploited by unauthenticated attackers to modify plugin settings if they trick a site administrator into clicking a crafted link. The vulnerability carries a CVSS base score of 4.3, a very low EPSS exploitation probability (0.02%), and is not listed in CISA KEV, indicating minimal real-world risk currently.

The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'dreampluginsmain' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Quantic Social Image Hover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Cross-site request forgery in the ContentStudio WordPress plugin up to version 1.3.7 enables unauthenticated attackers to modify plugin settings by tricking a site administrator into clicking a crafted link. No active exploitation or public exploit code has been observed, and EPSS predicts a very low exploitation probability (0.02%). The vulnerability is of medium severity but low practical risk due to its reliance on social engineering.

The Image Optimizer by wps.sk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the imagopby_ajax_optimize_gallery() function. This makes it possible for unauthenticated attackers to trigger bulk optimization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.1321.

The Hide Categories Or Products On Shop Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7. This is due to missing or incorrect nonce validation on the save_data_hcps() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Time Sheets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on several endpoints. This makes it possible for unauthenticated attackers to perform a variety of actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Backup, Restore and Migrate your sites with XCloner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.2. This is due to missing or incorrect nonce validation on the Xcloner_Remote_Storage:save() function. This makes it possible for unauthenticated attackers to add or modify an FTP backup configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows an attacker to set an attacker-controlled FTP site for backup storage and exfiltrate potentially sensitive site data.

Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files. When these files are accessed the browser executes embedded JavaScript, leading to stored Cross-Site Scripting (XSS) which when combined with a CSRF misconfiguration they lead to achieve full administrative account takeover, creating a rogue admin account, escalating the attacker account role to admin, and much more. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "post_add_to_list" function as well as an incorrect permissions callback in the "Api/init" function. This makes it possible for unauthenticated attackers to add or remove products from a user's wishlist via a forged request granted they can trick a site's user into performing an action such as clicking on a link.

Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication.

The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing nonce verification on the bulk action functionality in the 'process_bulk_action()' function. This makes it possible for unauthenticated attackers to perform bulk operations (delete, publish, or unpublish galleries) via a forged request granted they can trick an administrator into performing an action such as clicking on a link.

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce validation on the SurveyJS_DeleteSurvey AJAX action. This makes it possible for unauthenticated attackers to delete surveys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.19. This is due to missing or incorrect nonce validation on the `parseData` function. This makes it possible for unauthenticated attackers to export sensitive information including user data, email addresses, password hashes, and WooCommerce data to an attacker-controlled file path on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.