CWE-352— Cross-Site Request Forgery (CSRF)

CVE-2023-52136MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31.

CVE-2023-52145MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.

CVE-2023-52149MEDIUMCVSS 5.4EG 5.4

Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts.This issue affects Republish Old Posts: from n/a through 1.21.

CVE-2023-52150HIGHCVSS 8.8EG 8.8

Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0.

CVE-2023-52184MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Elementor: from n/a before 2.12.5.

CVE-2023-52200CRITICALCVSS 9.6EG 9.6

Cross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.6.

2024-01-08

Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Members…

CVE-2023-52212MEDIUMCVSS 5.4EG 5.4

2026-01-05

Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0.

CVE-2023-52216MEDIUMCVSS 4.3EG 4.3

2024-01-08

Cross-Site Request Forgery (CSRF) vulnerability in Yevhen Kotelnytskyi JS & CSS Script Optimizer.This issue affects JS & CSS Script Optimizer: from n/a through 0.3.3.

CVE-2023-52222MEDIUMCVSS 4.3EG 4.3

2024-01-08

Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2.

CVE-2023-52223MEDIUMCVSS 5.4EG 5.4

2024-02-28

Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.

CVE-2023-52226MEDIUMCVSS 4.3EG 4.3

2024-02-28

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0.

CVE-2023-52431HIGHCVSS 8.8EG 8.8

2024-02-13

The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty cookie (if signed cookies are disabled).

CVE-2023-52555MEDIUMCVSS 6.1EG 6.1

2024-03-01

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.

CVE-2023-53688MEDIUMCVSS 5.4EG 5.4

2025-10-30

Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component. An attacker can submit crafted input that is not properly validated or escaped, allow…

CVE-2023-5382MEDIUMCVSS 6.5EG 6.5

2023-11-22

The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_delete_posts function. This makes it possible for…

CVE-2023-5383MEDIUMCVSS 4.3EG 4.3

2023-11-22

The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_copy_posts function. This makes it possible for u…

CVE-2023-53961MEDIUMCVSS 4.3EG 5.3

2025-12-22

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages that submit HTTP requests to the r…

CVE-2023-5444HIGHCVSS 8.0EG 8.0

2023-11-17

A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new user with administrator privileges to the ePO server. This impacts the dashboard …

CVE-2023-5448HIGHCVSS 8.8EG 8.8

2024-01-11

The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the update_password_validate function.…

CVE-2023-5455MEDIUMCVSS 6.5EG 6.5

2024-01-10

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in…

CVE-2023-5498MEDIUMCVSS 4.3EG 4.3

2023-10-10

Cross-Site Request Forgery (CSRF) in GitHub repository chiefonboarding/chiefonboarding prior to v2.0.47.

CVE-2023-5511HIGHCVSS 8.8EG 8.8

2023-10-11

Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.

CVE-2023-5519MEDIUMCVSS 4.3EG 4.3

2023-10-31

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.

CVE-2023-5531MEDIUMCVSS 4.3EG 4.3

2023-10-12

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the delete functionality. This makes it poss…

CVE-2023-5532MEDIUMCVSS 6.1EG 4.3

2023-11-07

The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the 'imgmap_save_area_title' function. This makes it possible…

CVE-2023-5534MEDIUMCVSS 4.3EG 4.3

CVE-2023-5537MEDIUMCVSS 4.3EG 4.3

The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible …

2023-11-22

The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing nonce validation on the delumet_options_page() function. This makes it possible for unauth…

CVE-2023-5602MEDIUMCVSS 4.3EG 4.3

CVE-2023-5626HIGHCVSS 8.8EG 3.5

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions c…

2023-10-18

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.

CVE-2023-5687HIGHCVSS 8.8EG 5.4

CVE-2023-5690HIGHCVSS 8.8EG 8.8

Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3.

CVE-2023-5756MEDIUMCVSS 5.4EG 5.4

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.

2023-12-09

The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it …

CVE-2023-5772MEDIUMCVSS 4.3EG 4.3

2023-11-30

The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible fo…

CVE-2023-5776MEDIUMCVSS 4.3EG 4.3

2023-11-21

The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the pmdm_wp_ajax_delete_meta, pmdm_wp_delete_user_meta, and…

CVE-2023-5802MEDIUMCVSS 4.3EG 4.3

2023-10-26

Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions.

CVE-2023-5803MEDIUMCVSS 4.3EG 4.3

2023-11-30

Cross-Site Request Forgery (CSRF) vulnerability in Business Directory Team Business Directory Plugin – Easy Listing Directories for WordPress allows Cross-Site Request Forgery.This issue affects Business Directory Plugin – Easy Listing…

CVE-2023-5818MEDIUMCVSS 4.3EG 4.3

2023-11-07

The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect nonce validation on the amazonifyOptionsPage() function. This makes it possible…

CVE-2023-5820CRITICALCVSS 9.6EG 9.6

2023-10-27

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the addedit functionality. This makes it possible for unauthenticat…

CVE-2023-5821MEDIUMCVSS 4.3EG 4.3

2023-10-27

The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to …

CVE-2023-5823MEDIUMCVSS 4.3EG 8.8

2023-11-06

Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.

CVE-2023-5882HIGHCVSS 8.8EG 8.8

2023-12-18

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform u…

CVE-2023-5884MEDIUMCVSS 6.5EG 6.5

2023-12-04

The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.

CVE-2023-5886HIGHCVSS 8.8EG 8.8

2023-12-18

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files …

CVE-2023-5893HIGHCVSS 8.8EG 3.5

CVE-2023-5897HIGHCVSS 8.8EG 6.3

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVE-2023-5898HIGHCVSS 8.8EG 3.5

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.

CVE-2023-5899HIGHCVSS 8.8EG 3.5

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.