Total
7945 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-39311 | 1 Avada | 1 Fusion Builder | 2025-05-13 | 7.1 High |
| Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1. | ||||
| CVE-2024-23510 | 1 Martynchamberlin | 1 Dont Muck My Markup | 2025-05-13 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Martyn Chamberlin Don't Muck My Markup.This issue affects Don't Muck My Markup: from n/a through 1.8. | ||||
| CVE-2024-26469 | 1 Prestalife | 1 Product Designer | 2025-05-13 | 8.1 High |
| Server-Side Request Forgery (SSRF) vulnerability in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to cause a denial of service (DoS) and escalate privileges via the url parameter in the postProcess() method. | ||||
| CVE-2023-52555 | 1 Mongo-express Project | 1 Mongo-express | 2025-05-13 | 6.1 Medium |
| In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection. | ||||
| CVE-2024-3965 | 1 Projectcaruso | 1 Pray For Me | 2025-05-13 | 5.4 Medium |
| The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-3993 | 1 Wp-master | 1 Azan | 2025-05-13 | 4.6 Medium |
| The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack | ||||
| CVE-2024-4480 | 1 Goprayer | 1 Prayer | 2025-05-13 | 6.1 Medium |
| The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-2262 | 1 Themify | 1 Woocommerce Product Filter | 2025-05-13 | 4.7 Medium |
| Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs | ||||
| CVE-2025-47546 | 1 Wpcompress | 1 Wp Compress | 2025-05-12 | 7.1 High |
| Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress allows Cross Site Request Forgery. This issue affects WP Compress: from n/a through 6.30.30. | ||||
| CVE-2022-43340 | 1 Dzzoffice | 1 Dzzoffice | 2025-05-12 | 8.8 High |
| A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users. | ||||
| CVE-2025-47624 | 1 Apasionados | 1 Dofollow Case By Case | 2025-05-12 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case allows Cross Site Request Forgery. This issue affects DoFollow Case by Case: from n/a through 3.5.1. | ||||
| CVE-2025-47633 | 1 Awin | 1 Awin - Advertiser Tracking For Woocommerce | 2025-05-12 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Awin Awin – Advertiser Tracking for WooCommerce allows Cross Site Request Forgery. This issue affects Awin – Advertiser Tracking for WooCommerce: from n/a through 2.0.0. | ||||
| CVE-2025-2168 | 1 Bdthemes | 1 Ultimate Store Kit | 2025-05-12 | 4.3 Medium |
| The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2025-3959 | 1 Withstars | 1 Books-management-system | 2025-05-12 | 4.3 Medium |
| A vulnerability was found in withstars Books-Management-System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /reader_delete.html. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2025-3964 | 1 Withstars | 1 Books-management-system | 2025-05-12 | 4.3 Medium |
| A vulnerability, which was classified as problematic, was found in withstars Books-Management-System 1.0. Affected is an unknown function of the file /api/article/del of the component Article Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2025-3979 | 1 Lecms | 1 Lecms | 2025-05-12 | 4.3 Medium |
| A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-password-ajax-1 of the component Password Change Handler. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-4375 | 2025-05-12 | N/A | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Cloud Server Configuration password. This issue affects Pro Cloud Server: earlier than 6.0.165. | ||||
| CVE-2025-46743 | 2025-05-12 | 6.3 Medium | ||
| An authenticated user's token could be used by another source after the user had logged out prior to the token expiring. | ||||
| CVE-2021-24870 | 1 Wpfastestcache | 1 Wp Fastest Cache | 2025-05-12 | 6.1 Medium |
| The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitise and escape some the options available via the action, which could allow attackers to make logged in high privilege users call it and set a Cross-Site Scripting payload | ||||
| CVE-2023-5534 | 1 Quantumcloud | 1 Wpbot | 2025-05-12 | 4.3 Medium |
| The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||