PT-2025-21771 · Unknown · Audio Comments Plugin

Name of the Vulnerable Software and Affected Versions: Audio Comments Plugin versions up to, and including, 1.0.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'audio-comments/audior-settings.php' page. This allows...

PT-2025-21772 · WordPress · Alt Monitoring

Name of the Vulnerable Software and Affected Versions: AlT Monitoring plugin for WordPress versions up to, and including, 1.0.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'ALT Monitoring edit' page. This allows unauthenticat...

CVE-2025-4337

The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the ahapluginpage function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged...

CVE-2025-4337

The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the ahapluginpage function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged...

CVE-2025-4337

Affected product: WordPress AHAthat Plugin, versions up to 1.6. The vulnerability is a Cross-Site Request Forgery due to missing/incorrect nonce validation in aha_plugin_page(), enabling unauthenticated attackers to delete AHA pages by tricking an administrator. Impact: potential deletion of page...

CVE-2025-4337 AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion

The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the ahapluginpage function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged...

CVE-2025-4337 AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion

The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the ahapluginpage function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged...

PT-2025-19835 · WordPress · Ahathat Plugin

Name of the Vulnerable Software and Affected Versions: AHAthat Plugin for WordPress versions up to and including 1.6 Description: The issue is related to Cross-Site Request Forgery, caused by missing or incorrect nonce validation in the aha plugin page function. This allows unauthenticated...

CVE-2025-4198

The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the 'alink-tap' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

CVE-2025-4188

The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'reorder-simple-image-text-slider-setting' page. This makes it possible for unauthenticate...

CVE-2025-4199

The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or incorrect nonce validation on the 'abundatrade' page. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-2168

The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect non...

CVE-2025-4199

The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or incorrect nonce validation on the 'abundatrade' page. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-4188

The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'reorder-simple-image-text-slider-setting' page. This makes it possible for unauthenticate...

CVE-2025-4198

The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the 'alink-tap' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

CVE-2025-4199 Abundatrade Plugin <= 1.8.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or incorrect nonce validation on the 'abundatrade' page. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-4199

CVE-2025-4199 covers the WordPress plugin Abundatrade Plugin (versions

CVE-2025-4198 Alink Tap <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the 'alink-tap' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

CVE-2025-4198

CVE-2025-4198 – Alink Tap (WordPress) CSRF to Stored XSS . Affected: Alink Tap plugin for WordPress versions up to and including 1.3.1. Root cause: missing/incorrect nonce validation on the alink-tap page enables Cross-Site Request Forgery. Impact (per sources): unauthenticated attackers can upda...

CVE-2025-4198 Alink Tap <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the 'alink-tap' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...