Medium · 4.3 CVE-2025-25146 EUVD-2025-4056GHSA-w859-82rj-c26w

WordPress Songkick Concerts and Festivals plugin <= 0.9.7 - Cross Site Request Forgery (CSRF) vulnerability

Published Feb 7, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: saleandro Product: Songkick Concerts and Festivals

Description

Cross-Site Request Forgery (CSRF) vulnerability in saleandro Songkick Concerts and Festivals songkick-concerts-and-festivals allows Cross Site Request Forgery.This issue affects Songkick Concerts and Festivals: from n/a through <= 0.9.7.

Affected products

Vendor	Product	Affected	Fixed
saleandro	Songkick Concerts and Festivals	≤ 0.9.7	—

References

https://patchstack.com/database/Wordpress/Plugin/songkick-concerts-and-festivals/vulnerability/wordpress-songkick-concerts-and-festivals-plugin-0-9-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry