CVE-2025-10302

The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesaveoptions function. This makes it possible for unauthenticated attackers to update the plugin's settings...

CVE-2025-10309

The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the form creation and management functions. This makes it possible for unauthenticated attackers to create new PayPal forms and...

CVE-2025-10302

CVE-2025-10302 affects the WordPress plugin Ultimate Viral Quiz (versions ≤ 1.0). The vulnerability is a Cross-Site Request Forgery due to missing/incorrect nonce validation in the save_options() function, allowing unauthenticated attackers to update plugin settings if a site administrator is tri...

CVE-2025-10302 Ultimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Update

The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesaveoptions function. This makes it possible for unauthenticated attackers to update the plugin's settings...

CVE-2025-9897

CVE-2025-9897 : The WordPress AP Background plugin (versions up to 3.8.2) is affected by a Cross-Site Request Forgery due to missing/incorrect nonce validation in advParallaxBackAdminSaveSlider. Exploitation requires user interaction (social engineering via an admin action), and it can enable una...

CVE-2025-9897 AP Background <= 3.8.2 - Cross-Site Request Forgery

The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function. This makes it possible for unauthenticated attackers to create or...

CVE-2025-9897 AP Background <= 3.8.2 - Cross-Site Request Forgery

The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function. This makes it possible for unauthenticated attackers to create or...

EUVD-2025-32246

The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function. This makes it possible for unauthenticated attackers to create or...

CVE-2025-9895

CVE-2025-9895 : The WordPress plugin Notification Bar (versions

CVE-2025-9895 Notification Bar <= 2.2 - Cross-Site Request Forgery

The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the 'subscriber-list-empty.php' file. This makes it possible for unauthenticated attackers to empty the subscrib...

CVE-2025-9895 Notification Bar <= 2.2 - Cross-Site Request Forgery

The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the 'subscriber-list-empty.php' file. This makes it possible for unauthenticated attackers to empty the subscrib...

CVE-2025-9630 WP SinoType <= 1.0 - Cross-Site Request Forgery

The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the sinotypeconfig function. This makes it possible for unauthenticated attackers to modify typography settings via a...

CVE-2025-9889 ContentMX Content Publisher <= 1.0.6 - Cross-Site Request Forgery

The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the cmxactivateconnection function. This makes it possible for unauthenticated attackers to bind...

CVE-2025-9630

The CVE concerns WP SinoType (WordPress) plugin vulnerable to Cross-Site Forgery (CSRF) in versions ≤ 1.0 due to missing/incorrect nonce validation in sinotype_config, enabling unauthenticated attackers to modify typography settings if a site admin is tricked. Public details confirm affected soft...

CVE-2025-9630 WP SinoType <= 1.0 - Cross-Site Request Forgery

The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the sinotypeconfig function. This makes it possible for unauthenticated attackers to modify typography settings via a...

CVE-2025-9889 ContentMX Content Publisher <= 1.0.6 - Cross-Site Request Forgery

The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the cmxactivateconnection function. This makes it possible for unauthenticated attackers to bind...

CVE-2025-9889

CVE-2025-9889 : WordPress ContentMX Content Publisher plugin

CVE-2025-8669 Customify <= 0.4.11 - Cross-Site Request Forgery

The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the resetcustomizesection function. This makes it possible for unauthenticated attackers to reset theme customization settings via a forged...

CVE-2025-8669

CVE-2025-8669 affects the WordPress Customify theme up to version 0.4.11. The issue is a Cross-Site Request Forgery (CSRF) in the reset_customize_section function caused by missing/incorrect nonce validation, allowing unauthenticated attackers to reset theme customization settings via forged requ...

CVE-2025-9892 Restrict User Registration <= 1.0.1 - Cross-Site Request Forgery to Settings Update

The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the update function. This makes it possible for unauthenticated attackers to update the plugin's...