PT-2025-25479 · WordPress · Yougler Blogger Profile Page

Name of the Vulnerable Software and Affected Versions: Yougler Blogger Profile Page plugin for WordPress versions up to, and including, v1.01 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This allows...

PT-2025-25473 · WordPress · The Ai Image Lab – Free Ai Image Generator

Name of the Vulnerable Software and Affected Versions: The AI Image Lab – Free AI Image Generator plugin for WordPress versions 1.0.0 through 1.0.6 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This allows...

WordPress plugin XiSearch has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

PT-2025-25456 · WordPress · Seraphinite Accelerator

Name of the Vulnerable Software and Affected Versions: Seraphinite Accelerator plugin for WordPress versions up to, and including, 2.27.21 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the OnAdminApi CacheOpBegin function. This...

PT-2025-25476 · WordPress · Easy Flashcards

Name of the Vulnerable Software and Affected Versions: Easy Flashcards plugin for WordPress version 0.1 and earlier Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'ef settings submenu' page. This allows unauthenticated attackers...

CVE-2025-6040: Improper Neutralization of Input During Web Page Generation

The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'efsettingssubmenu' page. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-5938

The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the importtemplates function. This makes it possible for...

CVE-2025-5938

The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the importtemplates function. This makes it possible for...

CVE-2025-5928

The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wpslidingpaneluseroptions function. This makes it possible for unauthenticated attackers t...

CVE-2025-5930

The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request...

CVE-2025-5926

The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorrect nonce validation on the linkshieldmenuoptions function. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-5928

CVE-2025-5928 : The WP Sliding Login/Dashboard Panel plugin for WordPress (versions ≤ 2.1.1) is reported vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation in the wp_sliding_panel_user_options() function. This enables unauthenticated attackers to update plugin s...

CVE-2025-5928 WP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Update

The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wpslidingpaneluseroptions function. This makes it possible for unauthenticated attackers t...

CVE-2025-5928 WP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Update

The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wpslidingpaneluseroptions function. This makes it possible for unauthenticated attackers t...

CVE-2025-5938 Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Import

The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the importtemplates function. This makes it possible for...

CVE-2025-5938

CVE-2025-5938 relates to the WordPress plugin “Digital Marketing and Agency Templates Addons for Elementor.” The issue is a Cross-Site Request Forgery caused by missing or incorrect nonce validation in the import_templates() function, affecting all versions up to and including 1.1.1. This enables...

CVE-2025-5938 Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Import

The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the importtemplates function. This makes it possible for...

CVE-2025-5930

CVE-2025-5930 covers the WP2HTML WordPress plugin (versions &lt;= 1.0.2). It is a CSRF vulnerability caused by missing/incorrect nonce validation in the save() function, allowing unauthenticated attackers to update plugin settings via forged requests that a site admin might perform (e.g., by clic...

CVE-2025-5930 WP2HTML <= 1.0.2 - Cross-Site Request Forgery to Settings Update

The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request...

CVE-2025-5926 Link Shield <= 0.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorrect nonce validation on the linkshieldmenuoptions function. This makes it possible for unauthenticated attackers to update settings and...