Cross-Site Request Forgery

CWE-352

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

We track 2,014 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 6 have been exploited in real attacks.

How this weakness is prevented

Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, use anti-CSRF packages such as the OWASP CSRFGuard. Another example is the ESAPI Session Management control, which includes a component for CSRF.
Implementation: Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and Design: Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).
Architecture and Design: Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Architecture and Design: Do not use the GET method for any request that triggers a state change.

Latest Cross-Site Request Forgery vulnerabilities

8.8 High severity
WooCommerce Social Login: Cross-Site Request Forgery
CVE-2025-39472Apr 16, 2025WPWeb
Cross-Site Request Forgery (CSRF) vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a through < 2.8.3.
9.6 Critical severity
Custom CSS, JS & PHP: Cross-Site Request Forgery
CVE-2025-39601Apr 16, 2025WPFactory
Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP custom-css allows Remote Code Inclusion.This issue affects Custom CSS, JS & PHP: from n/a through <= 2.4.1.
7.1 High severity
Right Click Disable OR Ban: Cross-Site Request Forgery
CVE-2025-39548Apr 16, 2025A WP Life
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Right Click Disable OR Ban right-click-disable-or-ban allows Stored XSS.This issue affects Right Click Disable OR Ban: from n/a through <= 1.1.17.
7.1 High severity
Internal Link Optimiser: Cross-Site Request Forgery
CVE-2025-39547Apr 16, 2025Toast Plugins
Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Internal Link Optimiser internal-link-finder allows Stored XSS.This issue affects Internal Link Optimiser: from n/a through <= 5.1.3.
7.4 High severity
WP Tools: Cross-Site Request Forgery
CVE-2025-39544Apr 16, 2025Sminozzi
Cross-Site Request Forgery (CSRF) vulnerability in sminozzi WP Tools wptools allows Path Traversal.This issue affects WP Tools: from n/a through <= 5.18.
7.1 High severity
Site Search 360: Cross-Site Request Forgery
CVE-2025-39530Apr 16, 2025Dsky
Cross-Site Request Forgery (CSRF) vulnerability in dsky Site Search 360 site-search-360 allows Stored XSS.This issue affects Site Search 360: from n/a through <= 2.1.8.
9.6 Critical severity
WPJobBoard: Cross-Site Request Forgery
CVE-2025-30967Apr 15, 2025NotFound
Cross-Site Request Forgery (CSRF) vulnerability in NotFound WPJobBoard allows Upload a Web Shell to a Web Server. This issue affects WPJobBoard: from n/a through n/a.
8.1 High severity
Arkhe: Cross-Site Request Forgery
CVE-2025-26748Apr 15, 2025Looswebstudio
Cross-Site Request Forgery (CSRF) vulnerability in looswebstudio Arkhe arkhe allows PHP Local File Inclusion.This issue affects Arkhe: from n/a through <= 3.12.0.
7.1 High severity
My auctions allegro: Cross-Site Request Forgery
CVE-2025-27009Apr 14, 2025Wphocus
Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.33.
8.8 High severity
Brizy Pro: Cross-Site Request Forgery
CVE-2025-26902Apr 9, 2025Brizy
Cross-Site Request Forgery (CSRF) vulnerability in Brizy Brizy Pro allows Cross Site Request Forgery.This issue affects Brizy Pro: from n/a through 2.6.1.
7.1 High severity
Epeken All Kurir: Cross-Site Request Forgery
CVE-2025-32673Apr 9, 2025Epeken
Cross-Site Request Forgery (CSRF) vulnerability in epeken Epeken All Kurir epeken-all-kurir allows Stored XSS.This issue affects Epeken All Kurir: from n/a through <= 2.0.6.
7.1 High severity
Mergado Pack: Cross-Site Request Forgery
CVE-2025-32669Apr 9, 2025MERGADO
Cross-Site Request Forgery (CSRF) vulnerability in MERGADO Mergado Pack mergado-marketing-pack allows Stored XSS.This issue affects Mergado Pack: from n/a through <= 4.2.1.
7.1 High severity
Doppler Forms: Cross-Site Request Forgery
CVE-2025-32667Apr 9, 2025Fromdoppler
Cross-Site Request Forgery (CSRF) vulnerability in fromdoppler Doppler Forms doppler-form allows Stored XSS.This issue affects Doppler Forms: from n/a through <= 2.5.1.
7.1 High severity
Nepali Date Utilities: Cross-Site Request Forgery
CVE-2025-32664Apr 9, 2025Ashokbasnet
Cross-Site Request Forgery (CSRF) vulnerability in ashokbasnet Nepali Date Utilities nepali-date-utilities allows Stored XSS.This issue affects Nepali Date Utilities: from n/a through <= 1.0.15.
7.1 High severity
Interactive US Map: Cross-Site Request Forgery
CVE-2025-32661Apr 9, 2025WP Map Plugins
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive US Map interactive-us-map allows Stored XSS.This issue affects Interactive US Map: from n/a through <= 2.7.
7.1 High severity
FraudLabs Pro for WooCommerce: Cross-Site Request Forgery
CVE-2025-32659Apr 9, 2025Fraudlabspro
Cross-Site Request Forgery (CSRF) vulnerability in fraudlabspro FraudLabs Pro for WooCommerce fraudlabs-pro-for-woocommerce allows Stored XSS.This issue affects FraudLabs Pro for WooCommerce: from n/a through <= 2.22.8.
7.1 High severity
Custom Posts Order: Cross-Site Request Forgery
CVE-2025-32645Apr 9, 2025Hiren Patel
Cross-Site Request Forgery (CSRF) vulnerability in Hiren Patel Custom Posts Order custom-posts-order allows Stored XSS.This issue affects Custom Posts Order: from n/a through <= 4.4.
7.1 High severity
IP2Location World Clock: Cross-Site Request Forgery
CVE-2025-32644Apr 9, 2025IP2Location
Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location World Clock ip2location-world-clock allows Stored XSS.This issue affects IP2Location World Clock: from n/a through <= 1.1.9.
10.0 Critical severity
Vite Coupon: Cross-Site Request Forgery
CVE-2025-32642Apr 9, 2025Appsbd
Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through <= 1.0.9.
9.6 Critical severity
Anant Addons for Elementor: Cross-Site Request Forgery
CVE-2025-32641Apr 9, 2025Anantaddons
Cross-Site Request Forgery (CSRF) vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-elementor allows Cross Site Request Forgery.This issue affects Anant Addons for Elementor: from n/a through <= 1.1.8.
7.1 High severity
PlainInventory: Cross-Site Request Forgery
CVE-2025-32623Apr 9, 2025Plainware
Cross-Site Request Forgery (CSRF) vulnerability in plainware PlainInventory z-inventory-manager allows Stored XSS.This issue affects PlainInventory: from n/a through <= 3.1.9.
7.1 High severity
WP Map Route Planner: Cross-Site Request Forgery
CVE-2025-32621Apr 9, 2025Vsourz Digital
Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital WP Map Route Planner wp-map-route-planner allows Cross Site Request Forgery.This issue affects WP Map Route Planner: from n/a through <= 1.0.0.
7.1 High severity
KeyCAPTCHA: Cross-Site Request Forgery
CVE-2025-32619Apr 9, 2025KeyCAPTCHA
Cross-Site Request Forgery (CSRF) vulnerability in KeyCAPTCHA KeyCAPTCHA keycaptcha allows Stored XSS.This issue affects KeyCAPTCHA: from n/a through <= 2.5.1.
7.1 High severity
Multiple Location Google Map: Cross-Site Request Forgery
CVE-2025-32617Apr 9, 2025Ydesignservices
Cross-Site Request Forgery (CSRF) vulnerability in Ydesignservices Multiple Location Google Map multiple-location-google-map allows Stored XSS.This issue affects Multiple Location Google Map: from n/a through <= 1.1.
7.1 High severity
Nimbata Call Tracking: Cross-Site Request Forgery
CVE-2025-32616Apr 9, 2025Nimbata
Cross-Site Request Forgery (CSRF) vulnerability in nimbata Nimbata Call Tracking nimbata-call-tracking allows Stored XSS.This issue affects Nimbata Call Tracking: from n/a through <= 1.7.4.
7.1 High severity
User Session Synchronizer: Cross-Site Request Forgery
CVE-2025-32612Apr 9, 2025Rafasashi
Cross-Site Request Forgery (CSRF) vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through <= 1.4.0.
7.1 High severity
Foliopress WYSIWYG: Cross-Site Request Forgery
CVE-2025-32610Apr 9, 2025FolioVision
Cross-Site Request Forgery (CSRF) vulnerability in FolioVision Foliopress WYSIWYG foliopress-wysiwyg allows Cross Site Request Forgery.This issue affects Foliopress WYSIWYG: from n/a through <= 2.6.18.
7.1 High severity
WordPress Events Calendar Plugin – connectDaily: Cross-Site Request Forgery
CVE-2025-32597Apr 9, 2025George Sexton
Cross-Site Request Forgery (CSRF) vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily connect-daily-web-calendar allows Cross-Site Scripting (XSS).This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through <
7.1 High severity
WP Abstracts: Cross-Site Request Forgery
CVE-2025-32591Apr 9, 2025Kevon Adonis
Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Cross Site Request Forgery.This issue affects WP Abstracts: from n/a through <= 2.7.5.
7.1 High severity
Chat2: Cross-Site Request Forgery
CVE-2025-32584Apr 9, 2025Chat2
Cross-Site Request Forgery (CSRF) vulnerability in Chat2 Chat2 chat2 allows Cross Site Request Forgery.This issue affects Chat2: from n/a through <= 4.0.
9.6 Critical severity
WP shop: Cross-Site Request Forgery
CVE-2025-32576Apr 9, 2025Agence web Eoxia - Montpellier
Cross-Site Request Forgery (CSRF) vulnerability in Agence web Eoxia - Montpellier WP shop wpshop allows Upload a Web Shell to a Web Server.This issue affects WP shop: from n/a through <= 2.6.1.
7.1 High severity
WP w3all phpBB: Cross-Site Request Forgery
CVE-2025-32575Apr 9, 2025Axew3
Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Reflected XSS.This issue affects WP w3all phpBB: from n/a through <= 2.9.9.
7.1 High severity
WP Calais Auto Tagger: Cross-Site Request Forgery
CVE-2025-32563Apr 9, 2025Dangrossman
Cross-Site Request Forgery (CSRF) vulnerability in dangrossman WP Calais Auto Tagger calais-auto-tagger allows Cross Site Request Forgery.This issue affects WP Calais Auto Tagger: from n/a through <= 2.0.
7.1 High severity
REVE Chat: Cross-Site Request Forgery
CVE-2025-32559Apr 9, 2025REVE Chat
Cross-Site Request Forgery (CSRF) vulnerability in REVE Chat REVE Chat revechat allows Stored XSS.This issue affects REVE Chat: from n/a through <= 6.4.4.
7.1 High severity
Simple Post Meta Manager: Cross-Site Request Forgery
CVE-2025-32556Apr 9, 2025Sandor Kovacs
Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Simple Post Meta Manager simple-post-meta-manager allows Reflected XSS.This issue affects Simple Post Meta Manager: from n/a through <= 1.0.9.
7.1 High severity
SEO, Nutrition and Print for Recipes by Edamam: Cross-Site Request Forgery
CVE-2025-32555Apr 9, 2025Edamam
Cross-Site Request Forgery (CSRF) vulnerability in Edamam SEO, Nutrition and Print for Recipes by Edamam seo-nutrition-and-print-for-recipes-by-edamam allows Stored XSS.This issue affects SEO, Nutrition and Print for Recipes by Edamam: from n/a through <= 3.3.
8.2 High severity
All push notification for WP: Cross-Site Request Forgery
CVE-2025-32547Apr 9, 2025Gtlwpdev
Cross-Site Request Forgery (CSRF) vulnerability in gtlwpdev All push notification for WP all-push-notification allows Blind SQL Injection.This issue affects All push notification for WP: from n/a through <= 1.5.3.
7.1 High severity
ALD Login Page: Cross-Site Request Forgery
CVE-2025-32518Apr 9, 2025Hossainawlad
Cross-Site Request Forgery (CSRF) vulnerability in hossainawlad ALD Login Page ald-login-page allows Stored XSS.This issue affects ALD Login Page: from n/a through <= 1.1.
7.1 High severity
MultiMailer: Cross-Site Request Forgery
CVE-2025-32505Apr 9, 2025SCAND
Cross-Site Request Forgery (CSRF) vulnerability in SCAND MultiMailer scand-multi-mailer allows Stored XSS.This issue affects MultiMailer: from n/a through <= 1.0.3.
7.1 High severity
ePaper Lister for Yumpu: Cross-Site Request Forgery
CVE-2025-32502Apr 9, 2025Lemmentwickler
Cross-Site Request Forgery (CSRF) vulnerability in lemmentwickler ePaper Lister for Yumpu magazine-lister-for-yumpu allows Stored XSS.This issue affects ePaper Lister for Yumpu: from n/a through <= 1.4.0.