Cross-Site Request Forgery

Cross-Site Request Forgery in the WP Rentals WordPress theme (WpEstate) through version 3.13.1 allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking authenticated site users into visiting a crafted page. The CVSS vector (PR:N/UI:R) confirms the attacker needs no credentials themselves but must socially engineer a logged-in victim. With an EPSS of 0.01% (3rd percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is low at this time.

Cross-site request forgery in the Stockie Extra WordPress plugin (versions through 1.2.11) enables unauthenticated remote attackers to perform unauthorized state-changing actions by tricking a logged-in WordPress user into visiting attacker-controlled content. The CVSS vector (PR:N/UI:R/I:L) confirms exploitation requires no attacker authentication but mandates victim interaction, and impact is bounded to limited integrity modification - not full site compromise. No public exploit identified at time of analysis; EPSS of 0.01% at the 3rd percentile indicates negligible exploitation interest in the wild.

Cross-Site Request Forgery in the PowerPress Podcasting WordPress plugin (versions through 11.13.12) enables remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:L) confirms exploitation requires no attacker authentication but mandates a social-engineering step to lure a logged-in admin. No public exploit identified at time of analysis; EPSS at 0.01% (3rd percentile) reflects minimal observed exploitation interest.

Cross-Site Request Forgery in the Super Store Finder WordPress plugin (versions through 7.5) enables remote unauthenticated attackers to perform unauthorized state-changing actions by forging requests on behalf of authenticated users. The plugin fails to implement WordPress nonce validation on one or more sensitive endpoints, meaning a logged-in administrator tricked into visiting a malicious page can have plugin data or settings modified without consent. With an EPSS of 0.02% (4th percentile), no KEV listing, and no public exploit identified at time of analysis, this is a genuine but low-urgency finding appropriate for routine patch cycles.

Cross-site request forgery in Ays Pro Popup box WordPress plugin versions up to 5.5.4 allows attackers to perform unauthorized actions (such as modifying plugin settings or creating popups) on behalf of authenticated administrators without their knowledge or consent. The vulnerability requires victim interaction (clicking a malicious link while logged in) but carries low exploitation probability (EPSS 0.02%, percentile 4%), suggesting limited real-world attack pressure despite the theoretical risk.

Cross-Site Request Forgery in the Entrada WordPress theme (Waituk, versions through 5.7.7) enables a remote unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated user into visiting a crafted page. The missing or insufficient nonce validation on sensitive form or AJAX endpoints allows the victim's browser to unwittingly submit forged requests, resulting in limited integrity impact. With an EPSS score of 0.01% (3rd percentile), no CISA KEV listing, and no public exploit code identified at time of analysis, real-world risk is low despite the network-accessible vector.

Cross-site request forgery in the Raychat WordPress plugin (versions through 2.2.1) enables an unauthenticated attacker to induce unauthorized state-changing actions on behalf of an authenticated user without their knowledge. The attack is constrained by a mandatory user-interaction requirement - a victim with an active authenticated session must visit a malicious page. EPSS at 0.02% (5th percentile) confirms negligible exploitation probability, and no public exploit or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting via CSRF in the CloudSearch WordPress plugin (versions up to and including 3.0.0) by Andrea Landonio allows a remote attacker to trick an authenticated user into submitting a forged request that injects persistent malicious script. Because the injected payload is stored and served to other users, its execution crosses a security scope (S:C), amplifying impact beyond the tricked victim. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), indicating negligible near-term mass-exploitation pressure.

Cross-Site Request Forgery in the Simple Content Templates WordPress plugin ≤2.2.61 allows unauthenticated attackers to trick logged-in administrators into performing unauthorized actions with low integrity impact. Exploitation requires victim interaction via a crafted link and has no known active exploitation or public exploit, while EPSS indicates a very low (0.02%) probability of widespread exploitation.

A stored cross-site scripting (XSS) vulnerability can be exploited via cross-site request forgery (CSRF) in the NikanWP WooCommerce Reporting plugin for WordPress up to version 1.0.0. This allows remote attackers to trick an administrator into performing actions that inject malicious scripts into the plugin's reporting data, which then executes in the victim's browser when viewing the reports. No active exploitation or public exploit code is known, and the EPSS exploitation probability is extremely low (0.02%).

CSRF in Reloadly plugin for WordPress allows stored XSS via a crafted request lacking anti-CSRF tokens, enabling an attacker to inject persistent scripts by tricking an admin. The vulnerability affects all versions up to 2.0.1, with a CVSS base score of 7.1, but EPSS indicates only a 0.02% chance of exploitation, and no active exploitation or public exploit code is known.

Cross-Site Request Forgery (CSRF) in the Did Prestashop Display WordPress plugin (versions ≤1.0.30) allows unauthenticated attackers to inject persistent malicious scripts (stored XSS) by tricking an authenticated administrator into clicking a crafted link. The vulnerability carries a CVSS 3.1 base score of 7.1, but no active exploitation or public exploit code is known, and the EPSS exploitation probability is only 0.02%.

Cross-Site Request Forgery in the WP Business Hours WordPress plugin through version 1.4 allows attackers to inject arbitrary web scripts via stored XSS. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator, triggers a CSRF request to the vulnerable plugin, resulting in persistent script execution in the browsers of other site visitors. The vulnerability has a CVSS score of 7.1 (High) but a very low EPSS exploitation probability (0.02%), and no active exploitation or public proof-of-concept is known.

Stored cross-site scripting via cross-site request forgery in the Awesome Testimonials WordPress plugin up to version 2.2.1 allows unauthenticated attackers to inject malicious scripts that execute in the browsers of site visitors. Exploitation requires a logged-in administrator to be tricked into clicking a crafted link, but no other special configuration is necessary. No active exploitation or public proof-of-concept has been identified at this time.

Cross-Site Request Forgery (CSRF) in the Multilang Contact Form WordPress plugin (≤ 1.5) allows an attacker to inject stored cross-site scripting (XSS) payloads by tricking an authenticated administrator into clicking a malicious link. The stored XSS can then execute in the context of other users viewing the affected page, leading to cookie theft, session hijacking, or defacement. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.02%), indicating minimal current probability of large-scale attacks.

Cross-site request forgery in the Off-Canvas Sidebars plugin for WordPress (≤0.5.8.5) allows unauthenticated attackers to trick administrators into modifying sidebar settings via a crafted link. Successful exploitation requires user interaction and leads to limited integrity impact with no confidentiality or availability consequences. No evidence of active exploitation or public exploit code exists at this time.

Cross-site request forgery in the Premmerce Brands for WooCommerce plugin for WordPress up to version 1.2.13 allows unauthenticated attackers to trick authenticated administrators into executing unintended actions, such as modifying brand settings. The vulnerability has a low EPSS score (0.02%) and no active exploitation is reported. A successful attack results in a limited integrity impact with no confidentiality or availability loss.

Cross-site request forgery enables stored XSS injection in WordPress Pricing Table builder plugin versions up to 1.5.3. Remote unauthenticated attackers can trick authenticated WordPress administrators into executing malicious requests that inject persistent JavaScript payloads into pricing table configurations. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. The changed scope (S:C) in CVSS vector indicates potential for broader site compromise beyond the plugin's security context.

Cross-site request forgery (CSRF) in ajayrandhawa User-Management-PHP-MYSQL allows remote attackers to perform unauthorized actions via crafted requests, requiring user interaction (UI:P). Publicly available exploit code exists, but the extremely low EPSS score (0.04%, 11th percentile) and vendor non-responsiveness suggest limited real-world exploitation despite public POC availability. CVSS 2.1 reflects low integrity impact and user-interaction requirement.

Cross-Site Request Forgery in Advanced Database Cleaner plugin for WordPress (versions up to 3.1.6) allows unauthenticated attackers to modify the keep last setting through forged requests targeting the aDBc_prepare_elements_to_clean() function, provided a site administrator can be socially engineered into clicking a malicious link. The vulnerability stems from missing or incorrect nonce validation. While the CVSS score is moderate (4.3), exploitation requires user interaction (UI:R) and results in limited integrity impact (data modification rather than code execution or availability compromise). No public exploit code or active exploitation has been confirmed at time of analysis.

Cross-Site Request Forgery in WordPress IndieAuth plugin (all versions ≤4.5.4) enables unauthenticated attackers to force authenticated users to authorize malicious OAuth applications, leading to account takeover with full administrative privileges (create, update, delete scopes). Missing nonce validation on login_form_indieauth() and the /wp-login.php?action=indieauth authorization endpoint allows attackers to steal authorization codes and exchange them for access tokens. CVSS 8.8 (High) with network attack vector and low complexity. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis. Patch released in version 4.5.5.

Cross-site request forgery in KeeneticOS before version 4.3 allows remote attackers to take over Keenetic routers by forging authenticated requests to the /rci (Remote Configuration Interface) API endpoint, resulting in the creation of unauthorized full-permission admin accounts. The attack requires tricking a currently-authenticated router administrator into visiting a malicious page, giving attackers persistent full-device control without needing credentials of their own. No public exploitation confirmed in CISA KEV, but a public researcher writeup is available on GitHub; EPSS stands at 0.02% (7th percentile), suggesting exploitation remains limited at time of analysis.

Cross-site request forgery in the Product Catalog Simple WordPress plugin (versions ≤1.8.4) allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, potentially modifying catalog settings. The vulnerability has an extremely low EPSS exploitation probability (0.01%) and no known public exploit or active exploitation (not listed in CISA KEV).

Cross-site request forgery in the WordPress UPC/EAN/GTIN Barcode Generator plugin (versions through 2.0.2) allows unauthenticated remote attackers to trick authenticated administrators into performing unauthorized actions, such as altering plugin settings or barcode output, with low integrity impact. No active exploitation or public exploit code has been identified, and the EPSS score is extremely low, indicating minimal real-world risk.

Cross-Site Request Forgery in SUMO Memberships for WooCommerce plugin prior to version 7.8.0 allows remote attackers to trick authenticated administrators into performing unintended actions, such as modifying membership settings or user roles, with limited impact on confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.1 but a very low EPSS exploitation probability (0.02%). No active exploitation is reported, and no public exploit code is known.

Cross-Site Request Forgery in the WP Media Categories plugin for WordPress allows unauthenticated attackers to trick a logged-in administrator into making unauthorized requests, potentially altering media category settings. The vulnerability affects versions up to 2.1.0 and has a low integrity impact with no confidentiality or availability loss. No evidence of active exploitation or public exploit code exists, and the EPSS probability is extremely low (0.02%).

Stored Cross-Site Scripting (XSS) can be injected into WordPress sites running the Video Blogster Lite plugin up to version 1.2 via a Cross-Site Request Forgery (CSRF) attack. An unauthenticated attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent JavaScript execution in the browsers of site visitors. There is no evidence of active exploitation or public exploit code at this time, and the EPSS model predicts a very low probability of widespread use.

Cross-Site Request Forgery (CSRF) in the Evergreen Content Poster WordPress plugin through version 1.4.5 allows unauthenticated remote attackers to perform unauthorized actions on behalf of an authenticated administrator. An attacker can trick a logged-in admin into clicking a crafted link, leading to CSRF exploitation that modifies plugin settings or content with low integrity impact. No active exploitation or public exploit code has been reported; EPSS probability is negligible.

Cross-Site Request Forgery in Wallos v4.1.1 lets remote attackers trick an authenticated user's browser into submitting a crafted GET request to the /endpoints/currency/currency component, performing unwanted currency operations without the victim's consent. The flaw stems from missing anti-CSRF token validation on state-changing requests. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 6th percentile), indicating little observed exploitation interest.

OpnForm up to version 1.9.3 contains a cross-site request forgery vulnerability in an undisclosed API endpoint, though the practical exploitability is severely constrained by the vendor's mandatory use of JWT Bearer token authentication. The vulnerability requires an attacker to first obtain a valid JWT token through a separate XSS attack, which the vendor states has been mitigated in the product, making the CSRF itself a secondary concern rather than an independent attack vector. Publicly available exploit code exists, but real-world impact is minimal given the authentication and XSS mitigation barriers.

Cross-site request forgery in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets a remote attacker forge state-changing web requests that a logged-in operator's browser executes, chaining into arbitrary code execution, denial of service, privilege escalation, and disclosure of sensitive data on the appliance. Any organization relying on this GPS-disciplined NTP appliance for time synchronization is affected. No public exploit identified at time of analysis, though an independent research advisory (xdiv-sec) documenting the flaw has been published.

The Trinity Audio - Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.20.2. This is due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. This makes it possible for unauthenticated attackers to activate/deactivate posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Optimize More! - CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the reset_plugin function. This makes it possible for unauthenticated attackers to reset the plugin's optimization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function. This makes it possible for unauthenticated attackers to create or modify background sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the 'subscriber-list-empty.php' file. This makes it possible for unauthenticated attackers to empty the subscriber list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the update() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Cross-site request forgery in the ContentMX Content Publisher plugin for WordPress up to version 1.0.6 allows unauthenticated attackers to bind their own ContentMX connection by tricking an administrator into clicking a link. The vulnerability arises from missing nonce validation on the cmx_activate_connection function, enabling a low‑integrity integrity impact without compromising confidentiality or availability. No active exploitation or public exploit code has been identified, and the EPSS score is only 0.01 %.

The MPWizard - Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation in the '/includes/admin/class-mpwizard-table.php' file. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the sinotype_config function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The TextBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1.0.0 to 1.1.1. This is due to missing or incorrect nonce validation on the 'handleToken' function. This makes it possible for unauthenticated attackers to update a user's authorization token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Once the token is updated, an attacker can update the user's password and email address.

Cross-Site Request Forgery in the Customify WordPress theme version 0.4.11 allows unauthenticated remote attackers to reset a site's theme customization settings by tricking an authenticated administrator into clicking a malicious link. The flaw is rooted in missing nonce validation on the `reset_customize_section` function in `inc/customizer/class-customizer.php`. No active exploitation has been reported (not in CISA KEV), and an EPSS score of 0.01% (1st percentile) confirms negligible real-world exploitation probability, making this a low-urgency but patchable integrity issue.

The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing nonce validation on the options.php file when handling form submissions. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the form creation and management functions. This makes it possible for unauthenticated attackers to create new PayPal forms and modify PayPal payment settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesave_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim’s authenticated session. This issue is fixed in version 3.5.0.

Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.

The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The LockerPress - WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.94. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The cForms - Light speed fast Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Sync Feedly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.

IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A weakness has been identified in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Cross-Site Request Forgery in GST for WooCommerce WordPress plugin versions ≤2.0 enables attackers to execute stored XSS attacks by tricking authenticated administrators into performing malicious actions. The vulnerability allows remote attackers to bypass authorization controls and inject persistent malicious scripts without authentication, though successful exploitation requires user interaction. EPSS score of 0.01% (3rd percentile) indicates very low observed exploitation probability in the wild, with no CISA KEV listing or confirmed active exploitation at time of analysis.

CSRF vulnerability in Flytedesk Digital WordPress plugin through version 20181101 enables stored cross-site scripting (XSS) attacks. Remote attackers can trick authenticated administrators into executing malicious requests that inject persistent JavaScript into the application, affecting site visitors. EPSS score of 0.01% indicates minimal observed exploitation activity, and no public exploit code or active exploitation has been identified at time of analysis.

Stored XSS in Conditional Cart Messages for WooCommerce (YourPlugins) through version 1.2.10 is exploitable via CSRF, allowing remote attackers to inject malicious scripts that execute in administrator contexts when victims are tricked into visiting crafted pages. The vulnerability chain requires user interaction but no authentication, enabling scope change (C) impacts across confidentiality, integrity, and availability. EPSS score of 0.01% (3rd percentile) indicates minimal observed exploitation activity, and no public exploit code or CISA KEV listing exists at time of analysis.

CSRF vulnerability in HTACCESS IP Blocker WordPress plugin enables stored XSS attacks against site administrators. Attackers can trick authenticated WordPress administrators into executing malicious actions that inject persistent JavaScript payloads through unprotected plugin endpoints. Affects all versions through 1.0. EPSS score of 0.01% (3rd percentile) suggests minimal observed exploitation attempts, though the attack requires only user interaction (UI:R) with no authentication barrier for the attacker. No active exploitation confirmed via CISA KEV at time of analysis.

Stored cross-site scripting can be injected into W3SCloud Contact Form 7 to Zoho CRM plugin for WordPress (versions through 3.0) via CSRF attack, allowing unauthenticated remote attackers to execute malicious JavaScript in administrator sessions when admins are tricked into visiting attacker-controlled pages. The vulnerability chains CSRF (CWE-352) with stored XSS, enabling privilege escalation from no access to stored administrative malicious code. EPSS score of 0.01% (3rd percentile) indicates minimal observed exploitation activity. No CISA KEV listing or public exploit code identified at time of analysis.

Cross-Site Request Forgery (CSRF) in NewsmanApp WordPress plugin versions up to 2.7.7 enables stored Cross-Site Scripting (XSS) attacks through unauthorized administrative actions. Attackers can trick authenticated administrators into executing malicious requests that inject persistent JavaScript payloads, leading to session hijacking, privilege escalation, or further compromise of WordPress sites. EPSS score of 0.01% (3rd percentile) indicates very low observed exploitation probability. No active exploitation confirmed in CISA KEV. Patchstack vulnerability database is the primary authoritative source for this disclosure.

Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress allows Upload a Web Shell to a Web Server.98. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in yonifre Lenix scss compiler allows Cross Site Request Forgery.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in Joovii Sendle Shipping allows Cross Site Request Forgery.02. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Post Featured Video allows Cross Site Request Forgery.7. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core allows Cross Site Request Forgery.0.100. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in instapagedev Instapage Plugin allows Cross Site Request Forgery.5.12. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in grooni Groovy Menu allows Cross Site Request Forgery.4.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CSRF vulnerability in Javo Core WordPress plugin (versions up to 3.0.0.266) enables attackers to bypass authentication controls and execute high-impact unauthorized actions. Despite an 8.8 CVSS score indicating critical severity across confidentiality, integrity, and availability, the 2% EPSS score (6th percentile) suggests minimal real-world exploitation activity. No active exploitation confirmed (not listed in CISA KEV). The vulnerability requires user interaction - attackers must trick authenticated administrators into visiting a malicious site or clicking a crafted link while logged into WordPress.

Cross-Site Request Forgery (CSRF) vulnerability in Shahjada Download Manager allows Cross Site Request Forgery.3.24. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in Di Themes Di Themes Demo Site Importer allows Cross Site Request Forgery.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The OAuth Single Sign On - SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Flag Forge is a Capture The Flag (CTF) platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Horilla is a free and open source Human Resource Management System (HRMS). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

In Shenzhen C-Data Technology Co. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core allows Cross Site Request Forgery. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in Zoho Flow Zoho Flow allows Cross Site Request Forgery.14.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System allows Stored XSS. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in ptibogxiv Doliconnect allows Stored XSS.5.7. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cross-Site Request Forgery (CSRF) vulnerability in Casengo Casengo Live Chat Support allows Stored XSS.1.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.