CVE-2025-13684: Cross-Site Request Forgery (CSRF)

The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19. This is due to missing or incorrect nonce validation on the arkrpoptionspage function. This makes it possible for unauthenticated attackers to modify the plugin's configuration settings via a...

CVE-2025-12130: Cross-Site Request Forgery (CSRF)

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendordashboard/product/delete/ endpoint...

CVE-2025-12373: Cross-Site Request Forgery (CSRF)

The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the savesettings function. This makes it possible for...

CVE-2025-13144: Cross-Site Request Forgery (CSRF)

The ContentStudio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.7. This is due to missing or insufficient nonce validation on the addcstusettings function. This makes it possible for unauthenticated attackers to modify plugin settings v...

CVE-2025-13360: Cross-Site Request Forgery (CSRF)

The Quantic Social Image Hover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's...

PT-2025-49232

The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19. This is due to missing or incorrect nonce validation on the ark rp options page function. This makes it possible for unauthenticated attackers to modify the plugin's configuration settings via ...

CVE-2025-12189: Cross-Site Request Forgery (CSRF)

The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce validation on the uploadImage function...

PT-2025-49235

Name of the Vulnerable Software and Affected Versions User Generator and Importer plugin for WordPress versions up to and including 1.2.2 Description The plugin is susceptible to Cross-Site Request Forgery due to missing nonce validation in the "Import Using CSV File" function. This allows...

PT-2025-49207

Name of the Vulnerable Software and Affected Versions Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress versions prior to 7.10.1322 Description The software is susceptible to a Cross-Site Request Forgery issue. This is due to...

PT-2025-49198

Name of the Vulnerable Software and Affected Versions Time Sheets plugin for WordPress versions through 2.1.3 Description The Time Sheets plugin for WordPress is susceptible to Cross-Site Request Forgery CSRF. This is caused by a lack of, or incorrect, nonce validation on several endpoints. An...

PT-2025-49208

Name of the Vulnerable Software and Affected Versions The Image Optimizer by wps.sk versions prior to 1.2.1 Description The Image Optimizer plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by insufficient nonce validation within the imagopby ajax optimize gallery...

PT-2025-49216

Name of the Vulnerable Software and Affected Versions dream gallery plugin for WordPress versions prior to 1.0 Description The dream gallery plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of inadequate or missing nonce validation on the dreampluginsmain AJAX...

PT-2025-49193

Name of the Vulnerable Software and Affected Versions Norby AI plugin for WordPress versions up to and including 1.0.3 Description The software is susceptible to Cross-Site Request Forgery due to the absence of nonce validation on the settings update functionality. This allows unauthenticated...

PT-2025-49213

Name of the Vulnerable Software and Affected Versions Quantic Social Image Hover plugin for WordPress versions through 1.0.8 Description The plugin is susceptible to Cross-Site Request Forgery CSRF due to the absence of nonce validation on the settings update functionality. This allows...

PT-2025-49212

Name of the Vulnerable Software and Affected Versions ContentStudio plugin for WordPress versions up to and including 1.3.7 Description The software is susceptible to Cross-Site Request Forgery, allowing unauthenticated attackers to modify plugin settings via a forged request if they can trick a...

CVE-2025-12358

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init"...

CVE-2025-12358

CVE-2025-12358 concerns ShopEngine Elementor WooCommerce Builder Addon for WordPress. Wordfence and related feeds describe a Cross-Site Request Forgery vulnerability in all versions up to 4.8.5, caused by missing nonce validation on the post_add_to_list function and an incorrect permissions callb...

EUVD-2025-200980

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init"...

CVE-2025-12358 ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init"...

CVE-2025-12358 ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init"...