CVE-2025-9885 MPWizard – Create Mercado Pago Payment Links <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion

The MPWizard – Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation in the '/includes/admin/class-mpwizard-table.php' file. This makes it possible for...

CVE-2025-10311

CVE-2025-10311 affects the WordPress plugin Comment Info Detector (versions

CVE-2025-10311 Comment Info Detector <= 1.0.5 - Cross-Site Request Forgery to Settings Update

The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing nonce validation on the options.php file when handling form submissions. This makes it possible for unauthenticated attackers to modify...

CVE-2025-9213

CVE-2025-9213 – TextBuilder (WordPress) CSRF to Privilege Escalation . TextBuilder plugin versions 1.0.0–1.1.1 are vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation in the handleToken function. An unauthenticated attacker could trick a site administrator into perf...

PT-2025-40510

Name of the Vulnerable Software and Affected Versions Optimize More! – CSS plugin for WordPress versions up to and including 1.0.3 Description The software is susceptible to a Cross-Site Request Forgery issue. This is caused by a lack of, or incorrect, nonce validation within the reset plugin...

PT-2025-40505

Name of the Vulnerable Software and Affected Versions MPWizard – Create Mercado Pago Payment Links plugin for WordPress versions prior to 1.2.2 Description The software is susceptible to Cross-Site Request Forgery, allowing unauthenticated attackers to delete arbitrary posts. This is possible due...

WordPress plugin Notification Bar 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

PT-2025-40470

Name of the Vulnerable Software and Affected Versions The Ultimate Viral Quiz plugin for WordPress versions prior to 1.0 Description The Ultimate Viral Quiz plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation within the save options function. This...

PT-2025-40506

Name of the Vulnerable Software and Affected Versions ContentMX Content Publisher plugin for WordPress versions up to and including 1.0.6 Description The software is susceptible to a Cross-Site Request Forgery CSRF issue. This is caused by a lack of, or incorrect, nonce validation in the cmx...

PT-2025-40492

Name of the Vulnerable Software and Affected Versions WordPress TextBuilder plugin versions 1.0.0 through 1.1.1 Description The software is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation. An unauthenticated attacker can update a user's authorization token b...

PT-2025-40509

Name of the Vulnerable Software and Affected Versions AP Background plugin for WordPress versions up to and including 3.8.2 Description The software is susceptible to Cross-Site Request Forgery CSRF. This is due to missing or incorrect nonce validation within the advParallaxBackAdminSaveSlider...

PT-2025-40473

The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing nonce validation on the options.php file when handling form submissions. This makes it possible for unauthenticated attackers to modify...

PT-2025-40508

Name of the Vulnerable Software and Affected Versions Notification Bar plugin for WordPress versions prior to 2.3 Description The Notification Bar plugin for WordPress is susceptible to Cross-Site Request Forgery CSRF. This is caused by insufficient or incorrect nonce validation within the...

PT-2025-40498

Name of the Vulnerable Software and Affected Versions WP SinoType plugin for WordPress versions prior to 1.1 Description The WP SinoType plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by a lack of or incorrect nonce validation in the sinotype config function. An...

PT-2025-40478

Name of the Vulnerable Software and Affected Versions Customify theme for WordPress version 0.4.11 Description The software is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation in the reset customize section function. This allows unauthenticated attackers to...

PT-2025-40504

Name of the Vulnerable Software and Affected Versions Mobile Site Redirect versions up to and including 1.2.1 Description The Mobile Site Redirect plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This allows...

PT-2025-40472

Name of the Vulnerable Software and Affected Versions PayPal Forms plugin for WordPress versions up to and including 1.0.3 Description The PayPal Forms plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of a lack of nonce validation during form creation and...

PT-2025-40507

Name of the Vulnerable Software and Affected Versions Restrict User Registration plugin for WordPress versions prior to 1.0.2 Description The Restrict User Registration plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by a lack of proper nonce validation within th...

CVE-2025-7052

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.94. This is due to missing nonce validation on the changepassword function of its customercabinetchangepassword AJAX route. The plugin hooks this endpoint via wpajax and...

CVE-2025-9948

The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a...