10562 matches found
CVE-2025-46241 WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability
Cross-Site Request Forgery CSRF vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through = 1.3.92...
CVE-2025-46241
CVE-2025-46241 refers to a CSRF to SQL Injection vulnerability in the WordPress plugin “Appointment Booking Calendar” by codepeople, affecting versions up to 1.3.92. The issue enables CSRF to potentially trigger SQL injection on vulnerable endpoints, with high impact as per CVSS metrics (high con...
PT-2025-17510 · Unknown · Cm Ad Changer
Name of the Vulnerable Software and Affected Versions: CM Ad Changer versions n/a through 2.0.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions n/a through 2.0.5, update to a version later than 2.0.5...
PT-2025-17911
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A security issue was discovered that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery CSRF attacks...
📄 Blood Bank and Donor Management System 2.4 Cross Site Request Forgery
Blood Bank and Donor Management System version 2.4 suffers from a cross site request forgery vulnerability. Exploit Title: Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation Google Dork: N/A Date: 2024-12-26 Exploit Author: Kwangyun Keum Vendor Homepage:...
CVE-2025-29722
A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints...
CVE-2025-39455
Cross-Site Request Forgery CSRF vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location Variables: from n/a through = 2.9.5...
CVE-2025-39421
Cross-Site Request Forgery CSRF vulnerability in Mustafa KUCUK WP Sticky Side Buttons wp-sticky-side-buttons allows Stored XSS.This issue affects WP Sticky Side Buttons: from n/a through = 2.1...
CVE-2025-39414
Cross-Site Request Forgery CSRF vulnerability in Mike spam-stopper spam-stopper allows Stored XSS.This issue affects spam-stopper: from n/a through = 3.1.3...
CVE-2025-32606
Cross-Site Request Forgery CSRF vulnerability in Deepak Khokhar Listings for Buildium listings-for-buildium allows Stored XSS.This issue affects Listings for Buildium: from n/a through = 0.1.5...
CVE-2025-27337
CVE-2025-27337 is a WordPress Fontsampler plugin vulnerability: CSRF-enabled, leading to a reflected Cross-Site Scripting (XSS) in Fontsampler versions up to and including 0.4.14. The issue arises from improper input neutralization during web page generation, enabling an attacker to trigger XSS w...
CVE-2025-32545 WordPress WooCommerce Products without featured images Plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery CSRF vulnerability in SOFTAGON WooCommerce Products without featured images woocommerce-products-without-featured-images allows Reflected XSS.This issue affects WooCommerce Products without featured images: from n/a through = 0.1...
CVE-2025-32546 WordPress All push notification for WP Plugin <= 1.5.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through = 1.5.3...
CVE-2025-32606 WordPress Listings for Buildium plugin <= 0.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Deepak Khokhar Listings for Buildium listings-for-buildium allows Stored XSS.This issue affects Listings for Buildium: from n/a through = 0.1.5...
CVE-2025-32655 WordPress Restrict User Registration plugin <= 1.0.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in DevriX Restrict User Registration allows Stored XSS. This issue affects Restrict User Registration: from n/a through 1.0.1...
CVE-2025-32655 WordPress Restrict User Registration plugin <= 1.0.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in DevriX Restrict User Registration restrict-user-registration allows Stored XSS.This issue affects Restrict User Registration: from n/a through = 1.0.1...
CVE-2025-39415 WordPress Social Media Links plugin <= 1.0.3 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Jayesh Parejiya Social Media Links social-media-links allows Stored XSS.This issue affects Social Media Links: from n/a through = 1.0.3...
CVE-2025-39414
CVE-2025-39414 concerns the WordPress spam-stopper plugin (versions n/a–3.1.3) with a CSRF leading to Stored XSS. The vulnerability is confirmed in connected sources (Patchstack/Red Hat/CVE listings) and Wordfence references; CVSSv3.1 base score 7.1 (HIGH) with network access, user interaction re...
CVE-2025-39415
Summary of CVE-2025-39415 (Social Media Links) A CSRF flaw in the WordPress plugin Social Media Links (by Jayesh Parejiya) enables Stored XSS in versions up to 1.0.3 (affected: 0.0 through 1.0.3). Public sources consistently describe the issue as a CSRF that permits injection of stored scripts, w...