CVE-2025-39421 WordPress WP Sticky Side Buttons plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Mustafa KUCUK WP Sticky Side Buttons wp-sticky-side-buttons allows Stored XSS.This issue affects WP Sticky Side Buttons: from n/a through = 2.1...

CVE-2025-39423 WordPress Add to Header plugin <= 1.0 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jenst Add to Header add-to-header allows Stored XSS.This issue affects Add to Header: from n/a through = 1.0...

CVE-2025-39423 WordPress Add to Header plugin <= 1.0 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jenst Add to Header add-to-header allows Stored XSS.This issue affects Add to Header: from n/a through = 1.0...

CVE-2025-39424 WordPress Simple Maps plugin <= 0.98 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in simplemaps Simple Maps interactive-maps allows Stored XSS.This issue affects Simple Maps: from n/a through = 0.98...

CVE-2025-39425 WordPress Style Manager plugin <= 2.2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in pixelgrade Style Manager style-manager allows Cross Site Request Forgery.This issue affects Style Manager: from n/a through = 2.2.7...

CVE-2025-39431

CVE-2025-39431 : Cross-Site Request Forgery (CSRF) leading to Stored XSS in the Amazon Showcase WordPress Plugin. Affected: Amazon Showcase WordPress Plugin versions n/a through 2.2. Root cause/impact are described in multiple sources (NVD, CVE records, Red Hat) as CSRF enabling XSS; exploitation...

CVE-2025-39431 WordPress Amazon Showcase WordPress Plugin plugin <= 2.2 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin amazon-showcase-wordpress-widget allows Stored XSS.This issue affects Amazon Showcase WordPress Plugin: from n/a through = 2.2...

CVE-2025-39432

CVE-2025-39432 is a CSRF-to-XSS vulnerability in the WordPress plugin “bbPress2 shortcode whitelist” (affected versions 2.2.1 and earlier). The issue enables stored XSS via improper input neutralization during web page generation. Public details confirm affected software and the vulnerability cla...

CVE-2025-39432 WordPress bbPress2 shortcode whitelist plugin <= 2.2.1 - CSRF to XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in antonchanning bbPress2 shortcode whitelist bbpress2-shortcode-whitelist allows Stored XSS.This issue affects bbPress2 shortcode whitelist: from n/a through = 2.2.1...

CVE-2025-39435

CVE-2025-39435 concerns the WordPress plugin My Marginalia (vulnerable

CVE-2025-39438

CVE-2025-39438 is a CSRF vulnerability affecting the WordPress plugin/theme “Theme Changer” (momen2009) up to version 1.3. Root cause: Cross-Site Request Forgery allowing unauthorized actions. Confirmed in multiple sources (NVD entry and Patchstack/CVEs). Impact per available data: minimal/limite...

CVE-2025-39440 WordPress Broken Links Remover plugin <= 1.2.2 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Rajesh Broken Links Remover broken-links-remover allows Stored XSS.This issue affects Broken Links Remover: from n/a through = 1.2.2...

CVE-2025-39443

CVE-2025-39443 describes a Cross-Site Request Forgery (CSRF) vulnerability in Verge3D by Soft8Soft. Public records indicate Verge3D versions up to and including 4.9.0 are affected (vendor guidance references updates to 4.9.0 or later as a fix). The issue is described as CSRF, implying an attacker...

CVE-2025-39443 WordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Soft8Soft LLC Verge3D allows Cross Site Request Forgery. This issue affects Verge3D: from n/a through 4.9.0...

CVE-2025-39443 WordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through = 4.9.0...

CVE-2025-39455 WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location Variables: from n/a through = 2.9.5...

CVE-2025-39455 WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ip2location IP2Location Variables allows Reflected XSS. This issue affects IP2Location Variables: from n/a through 2.9.5...

CVE-2025-39455

CVE-2025-39455 describes a Cross-Site Request Forgery (CSRF) that enables Reflected XSS in the WordPress IP2Location Variables plugin (versions up to and including 2.9.5). Public sources (Patchstack, Red Hat, CVE lists) confirm the affected software and the vulnerability class, with CVSS v3.1 bas...

WordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin Verge3D versions = 4.9.0...

CVE-2025-29722

CVE-2025-29722 is a CSRF vulnerability in Commercify v1.0 due to missing CSRF protection on sensitive endpoints. The root cause is lack of CSRF tokens with permissive cookies/CORS, enabling attackers to perform unauthorized actions on behalf of authenticated users (example: settings changes via e...