PT-2025-50862

The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is due to missing nonce validation on the plugin's settings page. This makes it possible for unauthenticated attackers to modify the plugin's...

WordPress Resource Library for Logged In Users plugin <= 1.4 - Cross-Site Request Forgery to Multiple Administrative Actions vulnerability

Cross-Site Request Forgery to Multiple Administrative Actions vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Resource Library for Logged In Users versions = 1.4...

WordPress Simple Theme Changer plugin <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update vulnerability

Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Simple Theme Changer versions = 1.0...

WordPress IMAQ Core plugin <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update vulnerability

Cross-Site Request Forgery to URL Structure Update vulnerability discovered by dayea song - Ahnlab in WordPress Plugin IMAQ CORE versions = 1.2.1...

WordPress Purchase and Expense Manager plugin <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Purchase Record Deletion vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Purchase and Expense Manager versions = 1.1.2...

WordPress Kirim.Email WooCommerce Integration plugin <= 1.2.9 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Kirim.Email WooCommerce Integration versions = 1.2.9...

WordPress Upcoming for Calendly plugin <= 1.2.4 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Upcoming for Calendly versions = 1.2.4...

WordPress BMLT WordPress Plugin plugin <= 3.11.4 - Cross-Site Request Forgery to Settings Creation and Deletion vulnerability

Cross-Site Request Forgery to Settings Creation and Deletion vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin BMLT WordPress Plugin versions = 3.11.4...

WordPress Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection vulnerability

Cross-Site Request Forgery to Google OAuth Connection vulnerability discovered by D01EXPLOIT OFFICIAL in WordPress Plugin Foxtool All-in-One versions = 2.5.2...

CVE-2025-34429

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery CSRF vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a...

WordPress Freshchat plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Freshchat versions = 2.3.4...

CVE-2025-65472

A Cross-Site Request Forgery CSRF in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malicious web page...

WordPress RTL Tester plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin RTL Tester versions = 1.2...

CVE-2025-67646

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the...

PT-2025-50634

Name of the Vulnerable Software and Affected Versions EasyImages versions 2.8.6 and below Description A Cross-Site Request Forgery CSRF exists in the /admin/admin.inc.php component. This allows attackers to escalate privileges to Administrator by tricking a user into interacting with a malicious...

EasyImages 安全漏洞

EasyImages is a thin wrapper on PIL by Jakub Cieslik individual developer. It is used for exploring, visualizing and sharing images. A security vulnerability exists in EasyImages 2.0 2.8.6 and earlier versions, which stems from cross-site request forgery and could lead to elevation of privilege...

CVE-2025-65472

Summary: CVE-2025-65472 describes a CSRF flaw in EasyImages 2.0 up to v2.8.6, specifically in the /admin/admin.inc.php component, enabling privilege escalation to Administrator when a user interacts with a crafted page. Affected software: EasyImages 2.0 and all builds

PT-2025-51121

CVE-2025-67689 - Cisco WebEx Meeting Center Cross-Site Request Forgery CVE ID : CVE-2025-67689 Published : Dec. 11, 2025, 4:15 a.m. | 1 hour, 3 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline...

PT-2025-51126

CVE-2025-67694 - Apache HTTP Server Cross-Site Request Forgery CVE ID : CVE-2025-67694 Published : Dec. 11, 2025, 4:15 a.m. | 1 hour, 3 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and...

PT-2025-51124

CVE-2025-67692 - Apache HTTP Server Cross-Site Request Forgery CVE ID : CVE-2025-67692 Published : Dec. 11, 2025, 4:15 a.m. | 1 hour, 3 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and...