The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the reset_db_page() function. This makes it possible for unauthen…

CVE-2024-13707HIGHCVSS 8.8EG 8.8

2025-01-30

The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the gky_image_uploader_main_function() function. Th…

CVE-2024-13709MEDIUMCVSS 4.3EG 4.3

2025-01-25

The Linear plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on the 'linear-debug'. This makes it possible for unauthenticated…

CVE-2024-13710MEDIUMCVSS 4.3EG 4.3

2025-03-25

The Estatebud – Properties & Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.0. This is due to missing or incorrect nonce validation on the 'estatebud_settings' page. Th…

CVE-2024-13718MEDIUMCVSS 4.3EG 4.3

2025-02-18

The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.26. This is due to missing or incorrect nonce validati…

CVE-2024-13720HIGHCVSS 8.8EG 8.8

2025-01-30

The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_image_uploader_main_function() function in all versions up to, and including, 1.0.1. This makes it poss…

CVE-2024-1375MEDIUMCVSS 4.3EG 4.3

2024-07-12

The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the save_bulkdatas function in all versions up to, and including, 5.9.10. This makes it possible for unauthenticated att…

CVE-2024-13753HIGHCVSS 8.1EG 8.1

2025-02-20

The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the update_profile function. This makes it…

CVE-2024-13758MEDIUMCVSS 6.5EG 6.5

2025-01-30

The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to missing or incorrect nonce validation on the cp_contact_form_paypal_check_init_ac…

CVE-2024-13768MEDIUMCVSS 4.3EG 4.3

2025-03-22

The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or incorrect nonce validation on …

CVE-2024-13774MEDIUMCVSS 6.1EG 6.1

2025-03-08

The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'save_to_m…

CVE-2024-13795MEDIUMCVSS 4.3EG 4.3

2025-02-18

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.27. This is due to missing or incorrect nonce validation on the ecwid_deactivate_fe…

CVE-2024-13826MEDIUMCVSS 5.4EG 5.4

2025-03-08

The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVE-2024-13852HIGHCVSS 8.8EG 8.8

2025-02-18

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the plugin_page() function. This makes it possible for unauthenticated attackers to update arbitr…

CVE-2024-13883MEDIUMCVSS 4.3EG 4.3

2025-02-21

The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This is due to missing or incorrect nonce validation on the 'save_custom_css_request' function. This mak…

CVE-2024-13913HIGHCVSS 8.8EG 8.8

2025-03-14

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/t…

CVE-2024-13933HIGHCVSS 8.8EG 8.8

2025-03-19

The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7. This is due to missing or incorrect nonce validation on the foodbaker…

CVE-2024-1407MEDIUMCVSS 5.4EG 5.4

2024-06-19

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect n…

CVE-2024-1415MEDIUMCVSS 4.3EG 4.3

2024-05-02

The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.9. This is due to missing or incorrect nonce validation on several func…

CVE-2024-1416MEDIUMCVSS 4.3EG 4.3

2024-05-02

The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on several functions in all versions up to, and including, 1.8.9. Thi…

CVE-2024-1446MEDIUMCVSS 5.4EG 5.4

2024-05-22

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.3. This is due to missing or incorrect nonce validation on the nxssnap-reposter page. T…

CVE-2024-1489MEDIUMCVSS 4.3EG 4.3

2024-03-13

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction f…

CVE-2024-1501MEDIUMCVSS 4.7EG 4.7

2024-02-21

The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due to missing or incorrect nonce validation on the install_wpr() function. This makes it possible for …

CVE-2024-1503MEDIUMCVSS 4.3EG 4.3

2024-03-21

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_da…

CVE-2024-1504MEDIUMCVSS 4.3EG 4.3

2024-04-02

The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5.1. This is due to missing or incorrect nonce validation on the secupress_blackhole_ban_i…

CVE-2024-1522HIGHCVSS 8.8EG 8.8

2024-03-30

A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the `/execute_code` API endpoint, which does not pr…

CVE-2024-1538HIGHCVSS 8.8EG 8.8

2024-03-21

The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the…

CVE-2024-1592MEDIUMCVSS 4.3EG 4.3

2024-03-02

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.6. This is due to missing or incorrect nonce validation on the process_delete function in…

CVE-2024-1642MEDIUMCVSS 4.3EG 4.3

2024-03-13

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validat…

CVE-2024-1719MEDIUMCVSS 4.3EG 4.3

2024-02-28

The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. Th…

CVE-2024-1727MEDIUMCVSS 4.3EG 4.3

2024-03-21

A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized…

CVE-2024-1747MEDIUMCVSS 6.5EG 6.5

2024-08-01

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, als…

CVE-2024-1756MEDIUMCVSS 6.5EG 6.5

2024-04-24

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along…

CVE-2024-1760MEDIUMCVSS 4.3EG 4.3

2024-03-06

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. This is due to missing or incorrect nonce val…

CVE-2024-1777MEDIUMCVSS 4.3EG 4.3

2024-02-23

The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the settings update functi…

CVE-2024-1785MEDIUMCVSS 5.4EG 5.4

2024-03-20

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it …

CVE-2024-1845HIGHCVSS 8.8EG 8.8

2024-07-11

The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

CVE-2024-1879HIGHCVSS 8.8EG 8.8

2024-06-06

A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint…

CVE-2024-1889HIGHCVSS 8.8EG 8.8

2024-02-26

Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a malicious link to an authenticated user to perform actions with these user permissions o…

CVE-2024-1906MEDIUMCVSS 4.3EG 4.3

2024-02-27

The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxAddCategory function. This makes it po…

CVE-2024-1907MEDIUMCVSS 4.3EG 4.3

2024-02-27

The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxDeleteCategory function. This makes it…

CVE-2024-1909MEDIUMCVSS 4.3EG 4.3

2024-02-27

The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxRenameCategory function. This makes it…

CVE-2024-1910MEDIUMCVSS 4.3EG 4.3

2024-02-27

The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxClearCategory function. This makes it …

CVE-2024-1912MEDIUMCVSS 4.3EG 4.3

2024-02-27

The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxUpdateFolderPosition function. This ma…

CVE-2024-1943MEDIUMCVSS 4.3EG 4.3

2024-02-28

The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce validation on the reset_customizer_options() function. This makes it possible f…

CVE-2024-1954MEDIUMCVSS 6.3EG 6.3

2024-02-28

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1.8. This is due to missing or incorrect nonce validation in the includes/class…

CVE-2024-1962HIGHCVSS 8.8EG 8.8

2024-03-25

The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack

CVE-2024-1976MEDIUMCVSS 4.3EG 4.3

2024-02-29

The Marketing Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20200925. This is due to missing or incorrect nonce validation via the admin/main-settings-page.php file. This m…

CVE-2024-20252CRITICALCVSS 9.6EG 9.6

2024-02-07

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions…

CVE-2024-20254CRITICALCVSS 9.6EG 9.6

2024-02-07

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions…

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 108 of 175

Map vulnerabilities like CWE-352 to your infrastructure