CVE-2025-9948

The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a...

CVE-2025-9948 Chat by Chatwee <= 2.1.3 - Cross-Site Request Forgery to Settings Update

The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a...

PT-2025-39950

Name of the Vulnerable Software and Affected Versions Chat by Chatwee plugin for WordPress versions through 2.1.3 Description The Chat by Chatwee plugin for WordPress is susceptible to Cross-Site Request Forgery CSRF. This is a result of inadequate or missing nonce validation on the admin setting...

CVE-2025-59845

Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery CSRF vulnerability was identified. The vulnerability arises from missing orig...

IBM Storage TS4500 Library Cross-Site Request Forgery Vulnerability

IBM Storage TS4500 Library is a next-generation tape storage solution from IBM designed to help mid-sized and large enterprises meet the challenges of cloud storage, enabling high-density data storage and flexible scaling through LTO technology. The IBM Storage TS4500 Library suffers from a...

Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection...

CVE-2025-9944

The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the watchforcontactformsubmit function. This makes it possible for unauthenticated attackers to trigg...

CVE-2025-9944 Professional Contact Form <= 1.0.0 - Cross-Site Request Forgery to Test Email Sending

The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the watchforcontactformsubmit function. This makes it possible for unauthenticated attackers to trigg...

CVE-2025-9898 cForms – Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgery

The cForms – Light speed fast Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the cformsapi function. This makes it possible for unauthenticated attackers to modify...

CVE-2025-9896 HidePost <= 2.3.8 - Cross-Site Request Forgery

The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a...

CVE-2025-10499

CVE-2025-10499 : The WordPress plugin Ninja Forms – The Contact Form Builder That Grows With You (up to version 3.12.0) is vulnerable to a Cross‑Site Request Forgery (CSRF) due to missing/incorrect nonce validation in the maybe_opt_in() function. This allows unauthenticated attackers to trigger e...

PT-2025-39713

Name of the Vulnerable Software and Affected Versions VM Menu Reorder plugin for WordPress versions prior to 1.0.1 Description The software is susceptible to a Cross-Site Request Forgery CSRF issue. This is because of a lack of, or incorrect, nonce validation in the vm set to default function. An...

PT-2025-39715

Name of the Vulnerable Software and Affected Versions HidePost plugin for WordPress versions prior to 2.3.9 Description The software is susceptible to Cross-Site Request Forgery CSRF due to missing or incorrect nonce validation on the options.php settings page. This allows unauthenticated attacke...

CVE-2025-59845

Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery CSRF vulnerability was identified. The vulnerability arises from missing orig...

CVE-2025-10377

CVE-2025-10377 affects the WordPress System Dashboard plugin. It enables Cross-Site Request Forgery due to missing nonce validation in sd_toggle_logs(), allowing unauthenticated attackers to toggle Page Access Logs, Error Logs, and Email Delivery Logs by luring an admin to click a forged link. Af...

CVE-2025-10752 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery

The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter base64 encoded app name without any randomness in the OAuth flow. This makes it possible f...

CVE-2025-10752 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery

The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter base64 encoded app name without any randomness in the OAuth flow. This makes it possible f...

PT-2025-39475

Name of the Vulnerable Software and Affected Versions WordPress OAuth Single Sign On plugin versions prior to 6.26.12 Description The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of utilizing a predictable state...

VulnCheck KEV: CVE-2025-10035

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection...

PT-2025-39385

Name of the Vulnerable Software and Affected Versions Lobe Chat versions prior to 1.130.1 Description Lobe Chat, an open-source artificial intelligence chat framework, has an issue in its OIDC redirect handling logic. The logic builds the redirect URL’s host and protocol using the X-Forwarded-Hos...