Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.53.

CVE-2026-25024MEDIUMCVSS 5.4EG 5.4

2026-02-03

Cross-Site Request Forgery (CSRF) vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects ThirstyAffiliates: from n/a through <= 3.11.9.

CVE-2026-25151MEDIUMCVSS 5.9EG 5.9

2026-02-03

Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission C…

CVE-2026-25155MEDIUMCVSS 5.9EG 5.9

2026-02-03

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

CVE-2026-25221HIGHCVSS 8.1EG 8.1

2026-02-02

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery (CSRF). The application fails to im…

CVE-2026-25319MEDIUMCVSS 4.3EG 4.3

2026-02-19

Cross-Site Request Forgery (CSRF) vulnerability in wpzita Zita Elementor Site Library zita-site-library allows Cross Site Request Forgery.This issue affects Zita Elementor Site Library: from n/a through <= 1.6.6.

CVE-2026-25322MEDIUMCVSS 5.4EG 5.4

2026-02-19

Cross-Site Request Forgery (CSRF) vulnerability in PublishPress PublishPress Revisions revisionary allows Cross Site Request Forgery.This issue affects PublishPress Revisions: from n/a through <= 3.7.22.

CVE-2026-25337MEDIUMCVSS 5.4EG 5.4

2026-02-19

Cross-Site Request Forgery (CSRF) vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through <= 1.1.5.

CVE-2026-25411MEDIUMCVSS 4.3EG 4.3

2026-02-19

Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through <= 2.8.22.

CVE-2026-25422MEDIUMCVSS 5.4EG 5.4

2026-02-19

Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Extra: from n/a through <= 1.2.10.

CVE-2026-25812HIGHCVSS 8.8EG 8.8

2026-02-09

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.

CVE-2026-26075MEDIUMCVSS 5.4EG 5.4

2026-02-12

FastGPT is an AI Agent building platform. Due to the fact that FastGPT's web page acquisition nodes, HTTP nodes, etc. need to initiate data acquisition requests from the server, there are certain security issues. In addition to implementin…

CVE-2026-2626HIGHCVSS 8.1EG 8.1

2026-03-11

The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to modify stored divi-booster WordPress plugin before 5.0.2 options. Furthermore, due …

CVE-2026-2658MEDIUMCVSS 4.3EG 4.3

2026-02-18

A vulnerability was found in newbee-ltd newbee-mall up to a069069b07027613bf0e7f571736be86f431faee. Affected is an unknown function of the component Multiple Endpoints. Performing a manipulation results in cross-site request forgery. Remot…

CVE-2026-27050MEDIUMCVSS 5.4EG 5.4

2026-02-19

Cross-Site Request Forgery (CSRF) vulnerability in ThimPress RealPress realpress allows Cross Site Request Forgery.This issue affects RealPress: from n/a through <= 1.1.0.

CVE-2026-27090MEDIUMCVSS 4.3EG 4.3

2026-02-19

Cross-Site Request Forgery (CSRF) vulnerability in WP Moose Kenta Companion kenta-companion allows Cross Site Request Forgery.This issue affects Kenta Companion: from n/a through <= 1.3.3.

CVE-2026-2723MEDIUMCVSS 6.1EG 6.1

2026-03-21

The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page handlers for saving, adding, and deleting snippets. …

CVE-2026-27415MEDIUMCVSS 4.3EG 4.3

2026-05-07

Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5.

CVE-2026-27841HIGHCVSS 8.1EG 8.1

2026-04-24

A vulnerability in SenseLive X3050's web management interface allows state-changing operations to be triggered without proper Cross-Site Request Forgery (CSRF) protections. Because the application does not enforce server-side validation …

CVE-2026-28201HIGHCVSS 7.8EG 7.8

2026-05-07

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malic…

CVE-2026-28741MEDIUMCVSS 6.8EG 6.8

2026-04-15

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user's authentication method via a CSRF attack by…

CVE-2026-28761HIGHCVSS 8.1EG 8.1

2026-05-15

Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a user views a malicious page while logged-in to the affected product, unexpected operations may be done.

CVE-2026-29521MEDIUMCVSS 4.3EG 4.3

2026-03-16

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi. Attackers can host malicious …

CVE-2026-30498MEDIUMCVSS 6.3EG 6.3

2026-05-27

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.

CVE-2026-30807HIGHCVSS 8.8EG 8.8

2026-05-12

Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800

CVE-2026-31014MEDIUMCVSS 6.3EG 6.3

2026-04-21

Dovestones Softwares AD Self Update <4.0.0.5 is vulnerable to Cross Site Request Forgery (CSRF). The affected endpoint processes state-changing requests without requiring a CSRF token or equivalent protection. The endpoint accepts applicat…

CVE-2026-3140MEDIUMCVSS 4.3EG 4.3

2026-05-01

The Ultimate Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.14. This is due to a flawed nonce validation conditional in the 'handle_module_actions' function. This makes …

CVE-2026-31849MEDIUMCVSS 6.5EG 6.5

2026-03-23

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a result, an attacker can craft malicious …

CVE-2026-3191MEDIUMCVSS 5.4EG 5.4

2026-03-31

The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorrect nonce validation on the 'minify_html_menu_options' function. This makes it p…

CVE-2026-3193LOWCVSS 3.1EG 3.1

2026-02-25

A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site request forgery. The attack may be performed from remote. The attack requires a hi…

CVE-2026-32328MEDIUMCVSS 5.4EG 5.4

2026-03-13

Cross-Site Request Forgery (CSRF) vulnerability in shufflehound Lemmony lemmony allows Cross Site Request Forgery.This issue affects Lemmony: from n/a through < 1.7.1.

CVE-2026-32330MEDIUMCVSS 4.3EG 4.3

2026-03-13

Cross-Site Request Forgery (CSRF) vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Cross Site Request Forgery.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.37.

CVE-2026-32342MEDIUMCVSS 4.3EG 4.3

2026-03-13

Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through <= 6.7.1.2.

CVE-2026-32343MEDIUMCVSS 4.3EG 4.3

2026-03-13

Cross-Site Request Forgery (CSRF) vulnerability in Magazine3 Easy Table of Contents easy-table-of-contents allows Cross Site Request Forgery.This issue affects Easy Table of Contents: from n/a through <= 2.0.80.

CVE-2026-32344MEDIUMCVSS 4.3EG 4.3

2026-03-13

Cross-Site Request Forgery (CSRF) vulnerability in desertthemes Corpiva corpiva allows Cross Site Request Forgery.This issue affects Corpiva: from n/a through <= 1.0.96.

CVE-2026-32420MEDIUMCVSS 5.4EG 5.4

2026-03-13

Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.This issue affects GamiPress: from n/a through <= 7.6.6.

CVE-2026-32443MEDIUMCVSS 6.5EG 6.5

2026-03-13

Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed-pro allows Cross Site Request Forgery.This issue affects Product Feed PRO for WooCommerce: from n/a through <= 13.5.2.

CVE-2026-32456MEDIUMCVSS 4.3EG 4.3

2026-03-13

Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor admin-menu-editor allows Cross Site Request Forgery.This issue affects Admin Menu Editor: from n/a through <= 1.14.1.

CVE-2026-32989HIGHCVSS 8.8EG 8.8

2026-03-20

Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests to a profile update endpoint handling file uploads. Attackers can exploit this …

CVE-2026-3331MEDIUMCVSS 4.3EG 4.3

2026-03-21

The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing or incorrect nonce validation on the fourty_slider_options_page function. This …

CVE-2026-3332MEDIUMCVSS 4.3EG 4.3

2026-03-21

The Xhanch - My Advanced Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation in the `xms_setting()` function on the settings update …

CVE-2026-33373HIGHCVSS 8.8EG 8.8

2026-03-30

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account …

CVE-2026-34228MEDIUMCVSS 6.5EG 6.5

2026-04-03

Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The server first downloads and executes the SQL file, then downloads the ZIP file an…

CVE-2026-34460MEDIUMCVSS 5.4EG 5.4

2026-06-02

NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a…

CVE-2026-34721MEDIUMCVSS 6.5EG 6.5

2026-04-08

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This vulnerability …

CVE-2026-34749MEDIUMCVSS 5.4EG 5.4

2026-04-01

Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection co…

CVE-2026-34896HIGHCVSS 7.5EG 7.5

2026-04-07

Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, Coming Soon & Maintenance Mode allows Cross Site Request Forgery.This issue affects Under Construction, Coming Soon & Maintenance Mode: from n/a through 2.1.1.

CVE-2026-34904HIGHCVSS 7.5EG 7.5

2026-04-07

Cross-Site Request Forgery (CSRF) vulnerability in Analytify Simple Social Media Share Buttons allows Cross Site Request Forgery.This issue affects Simple Social Media Share Buttons: from n/a through 6.2.0.

CVE-2026-3499HIGHCVSS 8.8EG 8.8

2026-04-08

The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 13.4.6 through 13.5.2.1. This is due to missing or incorrect nonce validation o…

CVE-2026-35180MEDIUMCVSS 4.3EG 4.3

2026-04-06

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/customize_settings_nativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's…

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 171 of 176

Map vulnerabilities like CWE-352 to your infrastructure