51053 matches found
CVE-2025-32679
CVE-2025-32679 is a CSRF vulnerability in the WordPress plugin User Registration Using Contact Form 7 (affected through version 2.2, with n/a as starting version). The issue is documented as a Cross-Site Forgery vulnerability, and according to Wordfence Intelligence, the patch status is Unpatched...
WordPress KeyCAPTCHA plugin <= 2.5.1 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin KeyCAPTCHA versions = 2.5.1...
WordPress Anant Addons for Elementor plugin <= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerability
CSRF to Arbitrary Plugin Installation vulnerability discovered by stealthcopter in WordPress Plugin Anant Addons for Elementor versions = 1.1.8...
GHSA-5PM7-CP8F-P2C2 wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities
Impact wallabag versions prior to 2.6.11 were discovered to contain multiple Cross-Site Request Forgery CSRF vulnerabilities across several endpoints. An attacker could craft a malicious link or page that, if visited by a logged-in wallabag user, could trick the user's browser into performing...
CVE-2024-6860
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack...
CVE-2024-8243
The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
CVE-2024-6857
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...
CVE-2024-8243 Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF
The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
CVE-2024-8243 Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF
The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
CVE-2024-8243
CVE-2024-8243 affects WordPress and the WordPress Plugin Upgrade Time Out Plugin (
CVE-2024-6860 WP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack...
CVE-2024-6860 WP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack...
CVE-2024-6860
CVE-2024-6860 concerns the WordPress plugin WP MultiTasking (versions
CVE-2024-6857
CVE-2024-6857 concerns the WP MultiTasking WordPress plugin (versions <= 0.1.12) where updating Header/Footer/Body Script Settings lacks CSRF protection. Exploitation could allow an attacker to force logged-in admins to perform these updates via CSRF. Public sources in connected docs confirm t...
CVE-2024-6857 WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...
CVE-2024-6857 WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...
PT-2025-15733 · Unknown · Abozain Albanna Customize Login Page
Name of the Vulnerable Software and Affected Versions: AboZain Albanna Customize Login Page versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...
PT-2025-15802 · Nimbata · Nimbata Call Tracking
Name of the Vulnerable Software and Affected Versions: Nimbata Call Tracking versions 1.7.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that also allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...
PT-2025-15805 · WordPress · Vsourz Digital Wp Map Route Planner
Name of the Vulnerable Software and Affected Versions: Vsourz Digital WP Map Route Planner versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For Vsourz Digital WP Map Route Planner versio...
PT-2025-15751 · Icyleaf · Icyleaf Ws Audio Player
Name of the Vulnerable Software and Affected Versions: icyleaf WS Audio Player versions 1.1.8 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions 1.1.8 and earlier, update to a version that fixes th...