Total
7225 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-5926 | 2025-06-13 | N/A | 6.1 MEDIUM | ||
| The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorrect nonce validation on the link_shield_menu_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |||||
| CVE-2025-4327 | 1 Mrcms | 1 Mrcms | 2025-06-12 | N/A | N/A |
| A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected. | |||||
| CVE-2024-8085 | 1 Solidcode | 1 Peoplepond | 2025-06-12 | N/A | N/A |
| The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | |||||
| CVE-2024-8082 | 1 Justintadlock | 1 Widgets Reset | 2025-06-12 | N/A | N/A |
| The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2024-8050 | 1 Jfarthing | 1 Custom Author Base | 2025-06-12 | N/A | N/A |
| The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2024-8032 | 1 Ulfbenjaminsson | 1 Smooth Gallery Replacement | 2025-06-12 | N/A | N/A |
| The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | |||||
| CVE-2022-4363 | 1 Cedcommerce | 2 Wholesale Market, Wholesale Market For Woocommerce | 2025-06-12 | N/A | N/A |
| The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check when updating their settings, which could allow attackers to make a logged in admin update them via a CSRF attack | |||||
| CVE-2025-1288 | 1 Bulktheme | 1 Wooexim | 2025-06-12 | N/A | N/A |
| The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack. | |||||
| CVE-2024-8398 | 1 Philipwalton | 1 Simple Nav Archives | 2025-06-12 | N/A | N/A |
| The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2024-8286 | 1 Webtoffee | 1 Gdpr Cookie Consent | 2025-06-12 | N/A | N/A |
| The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks | |||||
| CVE-2024-8245 | 1 Gamipress | 1 Gamipress - Reset User | 2025-06-12 | N/A | N/A |
| The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2024-25417 | 1 Flusity | 1 Flusity | 2025-06-12 | N/A | 8.8 HIGH |
| flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_translation.php. | |||||
| CVE-2024-10677 | 1 Bluetrait | 1 Blue Trait Event Viewer | 2025-06-12 | N/A | N/A |
| The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2023-7174 | 1 Abitgone | 1 Abitgone Commentsafe | 2025-06-11 | N/A | N/A |
| The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | |||||
| CVE-2023-7195 | 1 Ani2life | 1 Wp-reply Notify | 2025-06-11 | N/A | N/A |
| The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. | |||||
| CVE-2023-7196 | 1 Jonkemp | 1 Ultimate Noindex Nofollow Tool | 2025-06-11 | N/A | N/A |
| The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2023-7197 | 1 Corbyboy | 1 Marketing Twitter Bot | 2025-06-11 | N/A | N/A |
| The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack | |||||
| CVE-2023-2334 | 2 Gsheetconnector, Westerndeal | 2 Edd Gsheetconnector, Easy Digital Downloads Google Sheet Connector | 2025-06-11 | N/A | 5.4 MEDIUM |
| The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack | |||||
| CVE-2022-1617 | 1 Usabilitydynamics | 1 Wp-invoice | 2025-06-11 | N/A | 6.1 MEDIUM |
| The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them | |||||
| CVE-2023-6946 | 1 Unalignedcode | 1 Autotitle | 2025-06-11 | N/A | 8.8 HIGH |
| The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. | |||||