CVE-2025-23113

An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once...

CVE-2024-13304 Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2024-13293 POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059

Cross-Site Request Forgery CSRF vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2...

CVE-2024-13260

Cross-Site Request Forgery CSRF vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1...

CVE-2024-13284 Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

Cross-Site Request Forgery CSRF vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5...

CVE-2024-13250 Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014

Cross-Site Request Forgery CSRF vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6...

CVE-2025-22814

Cross-Site Request Forgery CSRF vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through = 1.4.1...

CVE-2025-22814

CVE-2025-22814 is a Cross-Site Request Forgery to Stored Cross‑Site Scripting vulnerability in Zephyr Admin Theme. Affected: Zephyr Admin Theme versions from n/a up to 1.4.1. The provided documents do not include explicit exploitation details or a confirmed fix/patch.

PT-2025-1829 · WordPress · Action Network

Name of the Vulnerable Software and Affected Versions: Action Network plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This allows unauthenticated attackers to inje...

CVE-2025-22563

Cross-Site Request Forgery CSRF vulnerability in faaiq Pretty Url pretty-url allows Cross Site Request Forgery.This issue affects Pretty Url: from n/a through = 1.5.5...

CVE-2025-22552

Cross-Site Request Forgery CSRF vulnerability in bnielsen Affiliate Disclosure Statement affiliate-disclosure-statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through = 0.3...

CVE-2025-22520

CVE-2025-22520 – Tock Widget CSRF (Cross-Site Request Forgery) Connected sources confirm a CSRF vulnerability affecting the Tock Widget (Tock Widget,

CVE-2025-22522

CVE-2025-22522 affects the WordPress SingSong plugin. The vulnerability is a Stored XSS caused by improper input handling during web page generation (stored cross-site scripting). Affected range is SingSong: from n/a through 1.2, per the CVE description. The connected Red Hat/Wordfence entries co...

CVE-2025-22538 WordPress Virtual Bot Plugin <= 1.0.0 - CSRF Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Ofek Nakar Virtual Bot virtual-bot allows Stored XSS.This issue affects Virtual Bot: from n/a through = 1.0.0...

CVE-2025-22547 WordPress JK Html To Pdf plugin <= 1.0.0 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jay Krishnan G JK Html To Pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through 1.0.0...

CVE-2025-22548 WordPress ldap_login_password_and_role_manager plugin <= 1.0.12 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in frankkoenen ldaploginpasswordandrolemanager ldap-login-password-and-role-manager allows Stored XSS.This issue affects ldaploginpasswordandrolemanager: from n/a through = 1.0.12...

CVE-2025-22548

CVE-2025-22548 is a Stored XSS in the ldap_login_password_and_role_manager WordPress plugin. Affected component/issue: improper neutralization during web page generation; vulnerable from n/a to version 1.0.12. Impact per available data: Stored Cross‑Site Scripting risk. Connected documents contai...

CVE-2025-22548 WordPress ldap_login_password_and_role_manager plugin <= 1.0.12 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Frank Koenen ldaploginpasswordandrolemanager allows Stored XSS.This issue affects ldaploginpasswordandrolemanager: from n/a through 1.0.12...

CVE-2025-22552 WordPress Affiliate Disclosure Statement plugin <= 0.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jason Keeley, Bryan Nielsen Affiliate Disclosure Statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through 0.3...

CVE-2025-22552 WordPress Affiliate Disclosure Statement plugin <= 0.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in bnielsen Affiliate Disclosure Statement affiliate-disclosure-statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through = 0.3...