EUVD-2025-201385

The ContentStudio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.7. This is due to missing or insufficient nonce validation on the addcstusettings function. This makes it possible for unauthenticated attackers to modify plugin settings v...

CVE-2025-13362

CVE-2025-13362 describes a CSRF vulnerability in the Norby AI WordPress plugin (versions up to and including 1.0.3) caused by missing nonce validation on the settings update function. This could allow unauthenticated attackers to trigger admin actions and inject malicious scripts via forged reque...

EUVD-2025-201341

The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject...

CVE-2025-13362 Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update

The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject...

CVE-2025-13684: Cross-Site Request Forgery (CSRF)

The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19. This is due to missing or incorrect nonce validation on the arkrpoptionspage function. This makes it possible for unauthenticated attackers to modify the plugin's configuration settings via a...

CVE-2025-12130: Cross-Site Request Forgery (CSRF)

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendordashboard/product/delete/ endpoint...

CVE-2025-12373: Cross-Site Request Forgery (CSRF)

The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the savesettings function. This makes it possible for...

CVE-2025-13360: Cross-Site Request Forgery (CSRF)

The Quantic Social Image Hover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2025-12189: Cross-Site Request Forgery (CSRF)

The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce validation on the uploadImage function...

PT-2025-49232

The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19. This is due to missing or incorrect nonce validation on the ark rp options page function. This makes it possible for unauthenticated attackers to modify the plugin's configuration settings via ...

CVE-2025-13144: Cross-Site Request Forgery (CSRF)

The ContentStudio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.7. This is due to missing or insufficient nonce validation on the addcstusettings function. This makes it possible for unauthenticated attackers to modify plugin settings v...

CVE-2025-10055: Cross-Site Request Forgery (CSRF)

The Time Sheets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on several endpoints. This makes it possible for unauthenticated attackers to perform a variety of actions via a forge...

CVE-2025-13362: Cross-Site Request Forgery (CSRF)

The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject...

PT-2025-49207

Name of the Vulnerable Software and Affected Versions Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress versions prior to 7.10.1322 Description The software is susceptible to a Cross-Site Request Forgery issue. This is due to...

PT-2025-49212

Name of the Vulnerable Software and Affected Versions ContentStudio plugin for WordPress versions up to and including 1.3.7 Description The software is susceptible to Cross-Site Request Forgery, allowing unauthenticated attackers to modify plugin settings via a forged request if they can trick a...

PT-2025-49193

Name of the Vulnerable Software and Affected Versions Norby AI plugin for WordPress versions up to and including 1.0.3 Description The software is susceptible to Cross-Site Request Forgery due to the absence of nonce validation on the settings update functionality. This allows unauthenticated...

PT-2025-49208

Name of the Vulnerable Software and Affected Versions The Image Optimizer by wps.sk versions prior to 1.2.1 Description The Image Optimizer plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by insufficient nonce validation within the imagopby ajax optimize gallery...

PT-2025-49213

Name of the Vulnerable Software and Affected Versions Quantic Social Image Hover plugin for WordPress versions through 1.0.8 Description The plugin is susceptible to Cross-Site Request Forgery CSRF due to the absence of nonce validation on the settings update functionality. This allows...

PT-2025-49216

Name of the Vulnerable Software and Affected Versions dream gallery plugin for WordPress versions prior to 1.0 Description The dream gallery plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of inadequate or missing nonce validation on the dreampluginsmain AJAX...

PT-2025-49198

Name of the Vulnerable Software and Affected Versions Time Sheets plugin for WordPress versions through 2.1.3 Description The Time Sheets plugin for WordPress is susceptible to Cross-Site Request Forgery CSRF. This is caused by a lack of, or incorrect, nonce validation on several endpoints. An...