The Innovs HR WordPress plugin through 1.0.3.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.

CVE-2024-0859MEDIUMCVSS 4.3EG 4.3

2024-02-05

The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or incorrect nonce validation on the process_bulk_action function in ListAffiliate…

CVE-2024-0880MEDIUMCVSS 4.3EG 4.3

2024-01-25

A vulnerability was found in Qidianbang qdbcrm 1.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/edit?id=2 of the component Password Reset. The manipulation leads to cross-site requ…

CVE-2024-0892MEDIUMCVSS 4.3EG 4.3

2024-06-14

The Schema App Structured Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the MarkUpdate function. This makes it pos…

CVE-2024-10040MEDIUMCVSS 5.3EG 5.3

2024-10-18

The Infinite-Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation on the process_ajax_edit and process_ajax_delete functio…

CVE-2024-10045MEDIUMCVSS 4.3EG 4.3

2024-10-23

The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the process_actions function. This makes it possib…

CVE-2024-10448MEDIUMCVSS 4.3EG 4.3

2024-10-28

A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this issue is some unknown functionality of the file /file/delete.php. The manipulation of the argument bid…

CVE-2024-10480MEDIUMCVSS 4.3EG 4.3

2024-12-06

The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

CVE-2024-10481MEDIUMCVSS 6.5EG 6.5

2025-03-20

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of …

CVE-2024-10521MEDIUMCVSS 4.3EG 4.3

2024-11-27

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the process_bulk_action function. …

CVE-2024-10557MEDIUMCVSS 4.3EG 4.3

2024-10-31

A vulnerability has been found in code-projects Blood Bank Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /file/updateprofile.php. The manipulation leads to cross…

CVE-2024-10581MEDIUMCVSS 4.3EG 4.3

2025-02-15

The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missing or incorrect nonce validation on the dpfl_listingStatusChange() function. This…

CVE-2024-10593MEDIUMCVSS 4.3EG 4.3

2024-11-13

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.1.6. This is due to missing or inc…

CVE-2024-10605MEDIUMCVSS 4.3EG 4.3

2024-11-01

A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /file/request.php. The manipulation leads to cross-site request forgery. It is pos…

CVE-2024-10634MEDIUMCVSS 4.3EG 4.3

2025-05-15

The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset the Nokaut Offers Box WordPress plugin through 1.4.0 via a CSRF …

CVE-2024-10677MEDIUMCVSS 4.3EG 4.3

2025-05-15

The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVE-2024-10711HIGHCVSS 8.8EG 8.8

2024-11-05

The WooCommerce Report plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it p…

CVE-2024-10726MEDIUMCVSS 6.1EG 6.1

2024-11-21

The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing nonce validation on the settings update functionality. This makes it po…

CVE-2024-10789MEDIUMCVSS 4.3EG 4.3

2025-01-16

The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupa_user_admin() function. This makes it…

CVE-2024-10819HIGHCVSS 8.8EG 7.1

2025-03-20

A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uplo…

CVE-2024-10892MEDIUMCVSS 5.4EG 5.4

2024-12-18

The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.

CVE-2024-10906HIGHCVSS 8.1EG 7.1

2025-03-20

In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Origin` to `*` for all requests. This configuration makes all …

CVE-2024-11014MEDIUMCVSS 4.3EG 4.3

2024-11-29

Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a attacker to hijack the authentication of screens on the devic…

CVE-2024-11071HIGHCVSS 8.8EG 8.8

2025-04-07

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, wh…

CVE-2024-11118MEDIUMCVSS 5.3EG 5.3

2024-11-16

The 404 Error Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the updatePluginSettings() function. This makes it po…

CVE-2024-11125MEDIUMCVSS 4.3EG 4.3

2024-11-12

A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic. This issue affects some unknown processing of the file /admin/profile.php. The manipulation leads to cross-site request forgery. The attack may be initiated re…

CVE-2024-11142HIGHCVSS 8.8EG 5.4

2025-05-02

Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still on…

CVE-2024-11143MEDIUMCVSS 4.3EG 4.3

2024-11-13

The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due to missing or incorrect nonce validation on the update_assistant, add_new_assista…

CVE-2024-11336MEDIUMCVSS 6.1EG 6.1

2024-12-06

The Clickbank WordPress Plugin (Storefront) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing or incorrect nonce validation via the cs_menu page. This makes i…

CVE-2024-11341MEDIUMCVSS 4.3EG 4.3

2024-12-05

The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings_page() function. This makes it possible…

CVE-2024-11342MEDIUMCVSS 6.1EG 6.1

2024-11-26

The Skt NURCaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing or incorrect nonce validation in the skt-nurc-admin.php file. This makes it possible fo…

CVE-2024-11373MEDIUMCVSS 4.3EG 4.3

2025-05-15

The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVE-2024-11415HIGHCVSS 8.8EG 8.8

2024-11-23

The WP-Orphanage Extended plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the wporphanageex_menu_settings() function. This …

CVE-2024-11416MEDIUMCVSS 6.1EG 6.1

2024-11-21

The WIP Incoming Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the save_option() function. This makes it possible …

CVE-2024-11417MEDIUMCVSS 6.1EG 6.1

2024-12-12

The dejure.org Vernetzungsfunktion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.97.5. This is due to missing or incorrect nonce validation on the djo_einstellungen_menue() functio…

CVE-2024-11419MEDIUMCVSS 6.1EG 6.1

2024-12-12

The Password for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the get3_init_admin_page() function. This makes it poss…

CVE-2024-11444MEDIUMCVSS 4.3EG 4.3

2024-12-06

The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.13.2. This is due to missing or incorrect nonce validation on the cluevo_render_module_ui() functi…

CVE-2024-11601HIGHCVSS 8.1EG 8.1

2024-11-22

The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, …

CVE-2024-11607MEDIUMCVSS 6.1EG 6.1

2024-12-21

The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

CVE-2024-1162MEDIUMCVSS 4.3EG 4.3

2024-02-02

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. This is due to missing or incorrect nonce validation on the register_reference() function. This make…

CVE-2024-11640HIGHCVSS 8.8EG 8.8

2025-03-08

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'save' function. This mak…

CVE-2024-11641HIGHCVSS 8.8EG 8.8

2025-01-26

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes…

CVE-2024-11673MEDIUMCVSS 4.3EG 4.3

2024-11-25

A vulnerability, which was classified as problematic, has been found in 1000 Projects Bookstore Management System 1.0. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be init…

CVE-2024-11689HIGHCVSS 8.8EG 8.8

2024-12-12

The HQ Rental Software plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.29. This is due to missing or incorrect nonce validation on the displaySettingsPage() function. This makes it…

CVE-2024-11719MEDIUMCVSS 6.1EG 6.1

2025-05-15

The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

CVE-2024-11743MEDIUMCVSS 4.3EG 4.3

2024-11-26

A vulnerability, which was classified as problematic, was found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file /rental/ajax.php?action=delete_user of the component POST Request Handle…

CVE-2024-11812MEDIUMCVSS 6.1EG 6.1

2024-12-20

The Wtyczka SeoPilot dla WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.091. This is due to missing or incorrect nonce validation on the SeoPilot_Admin_Options() function. This…

CVE-2024-11813MEDIUMCVSS 6.1EG 6.1

2024-12-04

The Pulsating Chat Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.1. This is due to missing or incorrect nonce validation on the amin_chat_button_settings_page() function. …

CVE-2024-11842MEDIUMCVSS 4.3EG 4.3

2024-12-27

The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVE-2024-12003MEDIUMCVSS 6.1EG 6.1

2024-12-06

The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the generate_wp_system_page_content() function. This makes …

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 105 of 175

Map vulnerabilities like CWE-352 to your infrastructure