EUVD-2025-211252

vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrfcheck in include/utils/VteCsrf.php skips csrftoken validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read fro...

CVE-2025-71454

The software vtenext versions prior to 25.02.2 is vulnerable to a CSRF protection bypass caused by HTTP method tampering . The root cause resides in include/utils/VteCsrf.php, where the csrf_check() function fails to validate the __csrf_token for non-POST requests. An attacker can trick a logged-...

Modal Survey < 2.0.1.8.2 - Unauthenticated Arbitrary Survey Update, Deletion and Creation

The plugin AJAX calls including unauthenticated ones did not have capabilities and CSRF checks, allowing unauthenticated users to update, delete or create arbitrary surveys. PoC curl --url https://exmple.com/wp-admin/admin-ajax.php --data "action=ajaxsurvey=deleteid=110251535" curl --url...