Cross-Site Request Forgery

CWE-352

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

We track 2,014 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 6 have been exploited in real attacks.

How this weakness is prevented

Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, use anti-CSRF packages such as the OWASP CSRFGuard. Another example is the ESAPI Session Management control, which includes a component for CSRF.
Implementation: Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and Design: Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).
Architecture and Design: Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Architecture and Design: Do not use the GET method for any request that triggers a state change.

Latest Cross-Site Request Forgery vulnerabilities

7.1 High severity
Kapost: Cross-Site Request Forgery
CVE-2025-23712Jan 16, 2025Kapostintegrations
Cross-Site Request Forgery (CSRF) vulnerability in kapostintegrations Kapost kapost-byline allows Stored XSS.This issue affects Kapost: from n/a through <= 2.2.9.
7.1 High severity
Flying Twitter Birds: Cross-Site Request Forgery
CVE-2025-23710Jan 16, 2025Mayur Sojitra
Cross-Site Request Forgery (CSRF) vulnerability in Mayur Sojitra Flying Twitter Birds flying-twitter-birds allows Stored XSS.This issue affects Flying Twitter Birds: from n/a through <= 1.8.
7.1 High severity
DF Draggable: Cross-Site Request Forgery
CVE-2025-23708Jan 16, 2025Dominic Fallows
Cross-Site Request Forgery (CSRF) vulnerability in Dominic Fallows DF Draggable df-draggable allows Stored XSS.This issue affects DF Draggable: from n/a through <= 1.13.2.
7.1 High severity
Free MailClient FMC: Cross-Site Request Forgery
CVE-2025-23703Jan 16, 2025Cstoltenkamp
Cross-Site Request Forgery (CSRF) vulnerability in cstoltenkamp Free MailClient FMC mailclient allows Stored XSS.This issue affects Free MailClient FMC: from n/a through <= 1.0.
7.1 High severity
Anonymize Links: Cross-Site Request Forgery
CVE-2025-23702Jan 16, 2025Schalk Burger
Cross-Site Request Forgery (CSRF) vulnerability in Schalk Burger Anonymize Links anonymize-links allows Stored XSS.This issue affects Anonymize Links: from n/a through <= 1.1.
7.1 High severity
WP Custom Google Search: Cross-Site Request Forgery
CVE-2025-23698Jan 16, 2025Ivanra10
Cross-Site Request Forgery (CSRF) vulnerability in ivanra10 WP Custom Google Search wp-custom-google-search allows Stored XSS.This issue affects WP Custom Google Search: from n/a through <= 1.0.
7.1 High severity
Shabbos and Yom Tov: Cross-Site Request Forgery
CVE-2025-23694Jan 16, 2025Shabboscommerce
Cross-Site Request Forgery (CSRF) vulnerability in shabboscommerce Shabbos and Yom Tov shabbos-and-yom-tov allows Stored XSS.This issue affects Shabbos and Yom Tov: from n/a through <= 1.9.
7.1 High severity
Secure CAPTCHA: Cross-Site Request Forgery
CVE-2025-23693Jan 16, 2025Uosiu
Cross-Site Request Forgery (CSRF) vulnerability in uosiu Secure CAPTCHA secure-captcha allows Stored XSS.This issue affects Secure CAPTCHA: from n/a through <= 1.2.
7.1 High severity
Slider for Writers: Cross-Site Request Forgery
CVE-2025-23692Jan 16, 2025Artanik
Cross-Site Request Forgery (CSRF) vulnerability in artanik Slider for Writers slider-for-writers allows Stored XSS.This issue affects Slider for Writers: from n/a through <= 1.3.
7.1 High severity
Send to Twitter: Cross-Site Request Forgery
CVE-2025-23691Jan 16, 2025Braulio Aquino
Cross-Site Request Forgery (CSRF) vulnerability in Braulio Aquino Send to Twitter send-to-twitter allows Stored XSS.This issue affects Send to Twitter: from n/a through <= 1.7.2.
7.1 High severity
Book a Place: Cross-Site Request Forgery
CVE-2025-23690Jan 16, 2025ArtkanMedia
Cross-Site Request Forgery (CSRF) vulnerability in ArtkanMedia Book a Place book-a-place allows Stored XSS.This issue affects Book a Place: from n/a through <= 0.7.1.
7.1 High severity
HTTP to HTTPS link changer by Eyga.net: Cross-Site Request Forgery
CVE-2025-23677Jan 16, 2025DSmidge
Cross-Site Request Forgery (CSRF) vulnerability in DSmidge HTTP to HTTPS link changer by Eyga.net https-links-in-content allows Stored XSS.This issue affects HTTP to HTTPS link changer by Eyga.net: from n/a through <= 0.2.4.
7.1 High severity
Import Users to MailChimp: Cross-Site Request Forgery
CVE-2025-23675Jan 16, 2025Sana Ullah
Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah Import Users to MailChimp import-users-to-mailchimp allows Stored XSS.This issue affects Import Users to MailChimp: from n/a through <= 1.0.
7.1 High severity
Email on Publish: Cross-Site Request Forgery
CVE-2025-23673Jan 16, 2025Dkukral
Cross-Site Request Forgery (CSRF) vulnerability in dkukral Email on Publish email-on-publish allows Stored XSS.This issue affects Email on Publish: from n/a through <= 1.5.
7.1 High severity
RSV GMaps: Cross-Site Request Forgery
CVE-2025-23665Jan 16, 2025Ravi Kumar Vanukuru
Cross-Site Request Forgery (CSRF) vulnerability in Ravi Kumar Vanukuru RSV GMaps rsv-google-maps allows Stored XSS.This issue affects RSV GMaps: from n/a through <= 1.5.
7.1 High severity
Real Seguro Viagem: Cross-Site Request Forgery
CVE-2025-23664Jan 16, 2025Real Seguro Viagem
Cross-Site Request Forgery (CSRF) vulnerability in Real Seguro Viagem Real Seguro Viagem seguro-viagem allows Stored XSS.This issue affects Real Seguro Viagem: from n/a through <= 2.0.5.
7.1 High severity
WP Panoramio: Cross-Site Request Forgery
CVE-2025-23662Jan 16, 2025Ryscript
Cross-Site Request Forgery (CSRF) vulnerability in ryscript WP Panoramio wp-panoramio allows Stored XSS.This issue affects WP Panoramio: from n/a through <= 1.5.0.
7.1 High severity
NV Slider: Cross-Site Request Forgery
CVE-2025-23661Jan 16, 2025Ryscript
Cross-Site Request Forgery (CSRF) vulnerability in ryscript NV Slider nv-slider allows Stored XSS.This issue affects NV Slider: from n/a through <= 1.6.
7.1 High severity
MFPlugin: Cross-Site Request Forgery
CVE-2025-23660Jan 16, 2025Waltercerrudo
Cross-Site Request Forgery (CSRF) vulnerability in waltercerrudo MFPlugin mfplugin allows Stored XSS.This issue affects MFPlugin: from n/a through <= 1.3.
7.1 High severity
MercadoLibre Integration: Cross-Site Request Forgery
CVE-2025-23659Jan 16, 2025Hernanjh
Cross-Site Request Forgery (CSRF) vulnerability in hernanjh MercadoLibre Integration mercadolibre-integration allows Stored XSS.This issue affects MercadoLibre Integration: from n/a through <= 1.1.
7.1 High severity
Twitter Post: Cross-Site Request Forgery
CVE-2025-23654Jan 16, 2025Krolow
Cross-Site Request Forgery (CSRF) vulnerability in krolow Twitter Post twitterpost allows Stored XSS.This issue affects Twitter Post: from n/a through <= 0.1.
7.1 High severity
Auphonic Importer: Cross-Site Request Forgery
CVE-2025-23649Jan 16, 2025Kreg Steppe
Cross-Site Request Forgery (CSRF) vulnerability in Kreg Steppe Auphonic Importer auphonic-importer allows Stored XSS.This issue affects Auphonic Importer: from n/a through <= 1.5.1.
7.1 High severity
Rename Author Slug: Cross-Site Request Forgery
CVE-2025-23640Jan 16, 2025Nazmul Ahsan
Cross-Site Request Forgery (CSRF) vulnerability in Nazmul Ahsan Rename Author Slug rename-author-slug allows Stored XSS.This issue affects Rename Author Slug: from n/a through <= 1.2.0.
7.1 High severity
Comment-Emailer: Cross-Site Request Forgery
CVE-2025-23627Jan 16, 2025Frenchsquared
Cross-Site Request Forgery (CSRF) vulnerability in frenchsquared Comment-Emailer comment-emailer allows Stored XSS.This issue affects Comment-Emailer: from n/a through <= 1.0.5.
7.1 High severity
Twitter Shortcode: Cross-Site Request Forgery
CVE-2025-23618Jan 16, 2025Starise
Cross-Site Request Forgery (CSRF) vulnerability in starise Twitter Shortcode twitter-shortcode allows Stored XSS.This issue affects Twitter Shortcode: from n/a through <= 0.9.
7.1 High severity
Floatbox Plus: Cross-Site Request Forgery
CVE-2025-23617Jan 16, 2025Cybio
Cross-Site Request Forgery (CSRF) vulnerability in cybio Floatbox Plus floatbox-plus allows Stored XSS.This issue affects Floatbox Plus: from n/a through <= 1.4.4.
7.1 High severity
Word Freshener: Cross-Site Request Forgery
CVE-2025-23577Jan 16, 2025Sourov Amin
Cross-Site Request Forgery (CSRF) vulnerability in Sourov Amin Word Freshener word-freshener allows Stored XSS.This issue affects Word Freshener: from n/a through <= 1.3.
7.1 High severity
WP Background Tile: Cross-Site Request Forgery
CVE-2025-23573Jan 16, 2025Sammyb
Cross-Site Request Forgery (CSRF) vulnerability in sammyb WP Background Tile wp-background-tile allows Stored XSS.This issue affects WP Background Tile: from n/a through <= 1.0.
7.1 High severity
UpDownUpDown: Cross-Site Request Forgery
CVE-2025-23572Jan 16, 2025Dave Konopka
Cross-Site Request Forgery (CSRF) vulnerability in Dave Konopka UpDownUpDown updownupdown-postcomment-voting allows Stored XSS.This issue affects UpDownUpDown: from n/a through <= 1.1.
7.1 High severity
Shortcode in Comment: Cross-Site Request Forgery
CVE-2025-23569Jan 16, 2025Kelvin Ng
Cross-Site Request Forgery (CSRF) vulnerability in Kelvin Ng Shortcode in Comment shortcode-in-comment allows Stored XSS.This issue affects Shortcode in Comment: from n/a through <= 1.1.1.
7.1 High severity
GDReseller: Cross-Site Request Forgery
CVE-2025-23567Jan 16, 2025Tamer Ziady
Cross-Site Request Forgery (CSRF) vulnerability in Tamer Ziady GDReseller gdreseller allows Stored XSS.This issue affects GDReseller: from n/a through <= 1.6.
7.1 High severity
Custom Post: Cross-Site Request Forgery
CVE-2025-23566Jan 16, 2025Syedamirhussain91
Cross-Site Request Forgery (CSRF) vulnerability in syedamirhussain91 Custom Post custom-post-type-gui allows Stored XSS.This issue affects Custom Post: from n/a through <= 1.0.
7.1 High severity
Web Testimonials: Cross-Site Request Forgery
CVE-2025-23560Jan 16, 2025Plumwd
Cross-Site Request Forgery (CSRF) vulnerability in plumwd Web Testimonials web-testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through <= 1.2.
7.1 High severity
Geotagged Media: Cross-Site Request Forgery
CVE-2025-23558Jan 16, 2025Digitalfisherman
Cross-Site Request Forgery (CSRF) vulnerability in digitalfisherman Geotagged Media geotagged-media allows Stored XSS.This issue affects Geotagged Media: from n/a through <= 0.3.0.
7.1 High severity
Find Your Reps: Cross-Site Request Forgery
CVE-2025-23557Jan 16, 2025Kathleen Malone
Cross-Site Request Forgery (CSRF) vulnerability in Kathleen Malone Find Your Reps find-your-reps allows Stored XSS.This issue affects Find Your Reps: from n/a through <= 1.2.
7.1 High severity
WP Lyrics: Cross-Site Request Forgery
CVE-2025-23533Jan 16, 2025Zetxek
Cross-Site Request Forgery (CSRF) vulnerability in zetxek WP Lyrics wplyrics allows Stored XSS.This issue affects WP Lyrics: from n/a through <= 0.4.1.
8.8 High severity
MyAnime Widget: Cross-Site Request Forgery
CVE-2025-23532Jan 16, 2025Regios
Cross-Site Request Forgery (CSRF) vulnerability in Regios MyAnime Widget myanime-widget allows Privilege Escalation.This issue affects MyAnime Widget: from n/a through <= 1.0.
8.8 High severity
Custom Post Type Lockdown: Cross-Site Request Forgery
CVE-2025-23530Jan 16, 2025Yonisink
Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Lockdown custom-post-type-lockdown allows Privilege Escalation.This issue affects Custom Post Type Lockdown: from n/a through <= 1.11.
7.1 High severity
Bible Embed: Cross-Site Request Forgery
CVE-2025-23513Jan 16, 2025Jd7777
Cross-Site Request Forgery (CSRF) vulnerability in jd7777 Bible Embed bible-embed allows Stored XSS.This issue affects Bible Embed: from n/a through <= 0.0.4.
7.1 High severity
WP-BlackCheck: Cross-Site Request Forgery
CVE-2025-23511Jan 16, 2025Stargazer
Cross-Site Request Forgery (CSRF) vulnerability in Stargazer WP-BlackCheck wp-blackcheck allows Stored XSS.This issue affects WP-BlackCheck: from n/a through <= 2.7.2.