CVE-2025-39544 WordPress WP Tools plugin <= 5.18 - CSRF to Arbitrary File Deletion vulnerability

Cross-Site Request Forgery CSRF vulnerability in Bill Minozzi WP Tools allows Path Traversal. This issue affects WP Tools: from n/a through 5.18...

CVE-2025-39544

CVE-2025-39544 describes a CSRF to Arbitrary File Deletion vulnerability in the WordPress plugin WP Tools (versions

CVE-2025-39546 WordPress ElementsReady Addons for Elementor plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows Cross Site Request Forgery.This issue affects ElementsReady Addons for Elementor: from n/a through = 6.6.2...

CVE-2025-39546

CVE-2025-39546 – A CSRF vulnerability in WordPress plugin ElementsReady Addons for Elementor affects versions up to and including 6.6.2. Descriptions from NVD, Red Hat, and Patchstack confirm the CSRF issue and the affected product/version range. Patchstack indicates the vulnerability has been pa...

CVE-2025-39547

CVE-2025-39547 is a CSRF-to-Stored-XSS vulnerability in the WordPress plugin Internal Link Optimiser (versions up to 5.1.3). The issue arises from cross-site requests that can inject stored XSS through the plugin’s handling of Internal Link Optimiser actions. Public documentation confirms the aff...

CVE-2025-39548 WordPress Right Click Disable OR Ban plugin <= 1.1.17 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in A WP Life Right Click Disable OR Ban right-click-disable-or-ban allows Stored XSS.This issue affects Right Click Disable OR Ban: from n/a through = 1.1.17...

CVE-2025-39563

CVE-2025-39563: A CSRF vulnerability in the WordPress plugin Conditional Payments for WooCommerce affects versions up to 3.3.0. The issue enables Cross-Site Request Forgery with attacker-controlled state changes by an authenticated user (UI: REQUIRED; PR: NONE; AV: NETWORK; C/I: NONE; A: HIGH). T...

CVE-2025-39564 WordPress Conditional Shipping for WooCommerce plugin <= 3.4.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Trio Conditional Shipping for WooCommerce conditional-shipping-for-woocommerce allows Cross Site Request Forgery.This issue affects Conditional Shipping for WooCommerce: from n/a through = 3.4.0...

CVE-2025-39600 WordPress Integration for WooCommerce and QuickBooks plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in CRM Perks Integration for WooCommerce and QuickBooks wp-woocommerce-quickbooks allows Cross Site Request Forgery.This issue affects Integration for WooCommerce and QuickBooks: from n/a through = 1.3.1...

CVE-2025-39600

CVE-2025-39600 is a CSRF vulnerability in the CRM Perks Integration for WooCommerce and QuickBooks. Affected: CRM Perks Integration plugin (WordPress) from versions up to and including 1.3.1. Root cause: Cross-Site Request Forgery without sufficient CSRF protection. Impact (per provided data): no...

CVE-2025-39601 WordPress Custom CSS, JS & PHP plugin <= 2.4.1 - CSRF to RCE vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPFactory Custom CSS, JS & PHP custom-css allows Remote Code Inclusion.This issue affects Custom CSS, JS & PHP: from n/a through = 2.4.1...

SUSE CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

PT-2025-16805 · Unknown · Woocommerce - Social Login

Name of the Vulnerable Software and Affected Versions: WooCommerce Social Login versions 2.8.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This issue may be exploited to perform actions...

PT-2025-16616 · Unknown · Ever Accounting

Name of the Vulnerable Software and Affected Versions: Ever Accounting versions n/a through 2.1.5 Description: A Cross-Site Request Forgery CSRF issue affects Ever Accounting, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions n/a through 2.1.5, updat...

CVE-2025-30967

Cross-Site Request Forgery CSRF vulnerability in NotFound WPJobBoard allows Upload a Web Shell to a Web Server. This issue affects WPJobBoard: from n/a through n/a...

CVE-2025-30967 WordPress WPJobBoard plugin < 5.11.1 - CSRF to Remote Code Execution (RCE) vulnerability

Cross-Site Request Forgery CSRF vulnerability in NotFound WPJobBoard allows Upload a Web Shell to a Web Server. This issue affects WPJobBoard: from n/a through n/a...

CVE-2025-30967

CVE-2025-30967 is a CSRF-to-Remote Code Execution flaw in WP Job Board (notFound) affecting WP Job Board versions prior to 5.11.1. The advisory lists a high severity (CVSS 3.1: 9.6, Confidentiality/Integrity/Availability all High). Mitigation: upgrade to WP Job Board 5.11.1 or later, which patche...

CVE-2025-26903 WordPress InPost Gallery plugin <= 2.1.4.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in RealMag777 InPost Gallery inpost-gallery allows Cross Site Request Forgery.This issue affects InPost Gallery: from n/a through = 2.1.4.3...

DEBIAN-CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

UBUNTU-CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...