10562 matches found
CVE-2025-39438
CVE-2025-39438 is a CSRF vulnerability affecting the WordPress plugin/theme “Theme Changer” (momen2009) up to version 1.3. Root cause: Cross-Site Request Forgery allowing unauthorized actions. Confirmed in multiple sources (NVD entry and Patchstack/CVEs). Impact per available data: minimal/limite...
CVE-2025-39440 WordPress Broken Links Remover plugin <= 1.2.2 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Rajesh Broken Links Remover broken-links-remover allows Stored XSS.This issue affects Broken Links Remover: from n/a through = 1.2.2...
CVE-2025-39443 WordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Soft8Soft LLC Verge3D allows Cross Site Request Forgery. This issue affects Verge3D: from n/a through 4.9.0...
CVE-2025-39443
CVE-2025-39443 describes a Cross-Site Request Forgery (CSRF) vulnerability in Verge3D by Soft8Soft. Public records indicate Verge3D versions up to and including 4.9.0 are affected (vendor guidance references updates to 4.9.0 or later as a fix). The issue is described as CSRF, implying an attacker...
CVE-2025-39443 WordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through = 4.9.0...
CVE-2025-39455 WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery CSRF vulnerability in ip2location IP2Location Variables allows Reflected XSS. This issue affects IP2Location Variables: from n/a through 2.9.5...
CVE-2025-39455
CVE-2025-39455 describes a Cross-Site Request Forgery (CSRF) that enables Reflected XSS in the WordPress IP2Location Variables plugin (versions up to and including 2.9.5). Public sources (Patchstack, Red Hat, CVE lists) confirm the affected software and the vulnerability class, with CVSS v3.1 bas...
CVE-2025-39455 WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery CSRF vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location Variables: from n/a through = 2.9.5...
WordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin Verge3D versions = 4.9.0...
PT-2025-16983 · Unknown · Ichi Translit It!
Name of the Vulnerable Software and Affected Versions: Ichi translit it! versions n/a through 1.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions n/a through 1.6, update to a version that includes a fix for this issue...
PT-2025-17109 · Softagon · Softagon Woocommerce Products
Name of the Vulnerable Software and Affected Versions: SOFTAGON WooCommerce Products versions n/a through 0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS in SOFTAGON WooCommerce Products without featured images. Recommendations: For versions...
PT-2025-17010 · Verge3D · Verge3D
Name of the Vulnerable Software and Affected Versions: Verge3D versions prior to 4.9.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions prior to 4.9.0, update to version 4.9.0 or later to resolve the...
CVE-2025-29722
A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints...
CVE-2025-29722
The open-source e-commerce platform Commercify v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) due to missing CSRF protection on sensitive endpoints, such as /update_settings. Attackers can construct malicious requests from other domains to modify user data, potentially ...
CVE-2025-29722
A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints...
Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation
Exploit Title: Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation Google Dork: N/A Date: 2024-12-26 Exploit Author: Kwangyun Keum Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/blood-bank-donor-management-system/ Version: 2.4 Tested on: Windo...
CVE-2025-39472
Cross-Site Request Forgery CSRF vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a through 2.8.3...
CVE-2025-39472 WordPress WooCommerce Social Login plugin < 2.8.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a through 2.8.3...
CVE-2025-39472
CVE-2025-39472 corresponds to a CSRF vulnerability in the WPWooCommerce Social Login plugin (WooCommerce Social Login). Affected versions are 2.8.2 and earlier; the issue arises from Cross-Site Request Forgery that could allow unauthorized actions on behalf of a user. The fix is to upgrade to ver...
