CVE-2025-52790

CVE-2025-52790 : Cross-Site Request Forgery (CSRF) vulnerability in the WP-DownloadCounter WordPress plugin allows Stored XSS for WP-DownloadCounter versions <= 1.01. The NVD entry lists CVSS 3.1 with base score 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation status is not provided in ...

CVE-2025-52792

CVE-2025-52792 relates to a CSRF-induced Stored XSS in the WordPress plugin WP User Stylesheet Switcher. Affected versions are up to v2.2.0 (inclusive); the vulnerability is unpatched in the provided sources. Exploitation is not confirmed in the documents; CVSS details show a base score of 7.1 (H...

CVE-2025-52793 WordPress Esselink.nu Settings plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Esselink.nu Esselink.nu Settings esselinknu-settings allows Reflected XSS.This issue affects Esselink.nu Settings: from n/a through = 4.5...

CVE-2025-52792 WordPress WP User Stylesheet Switcher plugin <= v2.2.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in vgstef WP User Stylesheet Switcher wp-user-stylesheet-switcher allows Stored XSS.This issue affects WP User Stylesheet Switcher: from n/a through = v2.2.0...

CVE-2025-52793 WordPress Esselink.nu Settings plugin <= 2.94 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Esselink.nu Esselink.nu Settings allows Reflected XSS. This issue affects Esselink.nu Settings: from n/a through 2.94...

CVE-2025-52794 WordPress Creative Contact Form plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through = 1.0.0...

CVE-2025-52795 WordPress WP Front User Submit / Front Editor plugin <= 5.0.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Cross Site Request Forgery.This issue affects WP Front User Submit / Front Editor: from n/a through = 5.0.6...

CVE-2025-52795

CVE-2025-52795 : CSRF in WordPress plugin “WP Front User Submit / Front Editor” affects versions up to 4.9.4. Root cause is CSRF that can trigger actions without proper authorization. CVSS v3.1 base score 7.1 (HIGH): network vector, low attack complexity, user interaction required, no confidentia...

CVE-2025-52825

CVE-2025-52825 stems from a CSRF in WordPress Real Estate Manager plugin (versions n/a–7.3) that enables privilege escalation. The vulnerability is documented across multiple sources (NVD/Red Hat/CIRCL/VulnEnrichment) with a CVSSv3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Public...

CVE-2025-52711 WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Cross Site Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through = 1.27.8...

PT-2025-26336 · Oganro · Oganro Xml Travel Portal Widget

Name of the Vulnerable Software and Affected Versions: Oganro XML Travel Portal Widget versions n/a through 2.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. Recommendations: For Oganro XML Travel Portal Widget versions n/a throu...

PT-2025-26416 · Unknown · Bluff Post

Name of the Vulnerable Software and Affected Versions: Bluff Post versions 1.1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web application,...

PT-2025-26413 · Unknown · Beee Tinynav

Name of the Vulnerable Software and Affected Versions: Beee TinyNav versions n/a through 1.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For Beee TinyNav versions n/a through 1.4, update to a version that fixes this issue. At...

PT-2025-26417 · Unknown · Lewe Chordpress

Name of the Vulnerable Software and Affected Versions: Lewe ChordPress versions 3.9.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

WordPress WP Inventory Manager plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Skalucy in WordPress Plugin WP Inventory Manager versions = 2.3.4...

WordPress WP User Stylesheet Switcher plugin <= v2.2.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WP User Stylesheet Switcher versions = v2.2.0...

CVE-2025-49865

Cross-Site Request Forgery CSRF vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanced Settings: from n/a through = 3.0.1...

CVE-2025-48111 WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0...

CVE-2025-49856 WordPress Responsive Plus plugin <= 3.2.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Cross Site Request Forgery.This issue affects Responsive Plus: from n/a through = 3.2.2...

CVE-2025-49865 WordPress Advanced Settings plugin <= 3.0.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanced Settings: from n/a through = 3.0.1...