CWE-352— Cross-Site Request Forgery (CSRF)

CVE-2023-22689MEDIUMCVSS 4.6EG 5.4

Cross-Site Request Forgery (CSRF) vulnerability in Abdul Ibad WP Tabs Slides plugin <= 2.0.3 versions.

2023-05-20

Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions.

CVE-2023-22691MEDIUMCVSS 4.3EG 4.3

2023-05-03

Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.

CVE-2023-22692MEDIUMCVSS 4.3EG 4.3

CVE-2023-22693MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Jeroen Peters Name Directory plugin <= 1.27.1 versions.

2023-05-26

Cross-Site Request Forgery (CSRF) vulnerability in conlabzgmbh WP Google Tag Manager plugin <= 1.1 versions.

CVE-2023-22694MEDIUMCVSS 4.3EG 4.3

2023-07-10

Cross-Site Request Forgery (CSRF) vulnerability in Arian Khosravi, Norik Davtian BigContact Contact Page plugin <= 1.5.8 versions.

CVE-2023-22695MEDIUMCVSS 4.3EG 4.3

2023-07-10

Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.8 versions.

CVE-2023-22700MEDIUMCVSS 4.3EG 4.3

2023-03-13

Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 9.3.0 versions.

CVE-2023-22709MEDIUMCVSS 4.3EG 4.3

CVE-2023-2271MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Atif N SRS Simple Hits Counter plugin <= 1.1.0 versions.

2023-08-16

The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack

CVE-2023-22714MEDIUMCVSS 4.3EG 4.3

CVE-2023-2277MEDIUMCVSS 6.1EG 6.1

Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Coming Soon by Supsystic plugin <= 1.7.10 versions.

2023-06-13

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauth…

CVE-2023-2279MEDIUMCVSS 5.4EG 5.4

2023-08-31

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'admin_page_display' function. This makes it possibl…

CVE-2023-2285MEDIUMCVSS 4.3EG 4.3

2023-06-09

The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_switch_db function. This makes it possib…

CVE-2023-22852MEDIUMCVSS 6.5EG 6.5

2023-01-14

Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php.

CVE-2023-2286MEDIUMCVSS 4.3EG 4.3

2023-06-09

The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_run_cleanup function. This makes it possible for unauth…

CVE-2023-22942MEDIUMCVSS 5.4EG 4.3

2023-02-14

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an…

CVE-2023-2301MEDIUMCVSS 6.1EG 6.1

2023-06-03

The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. This is due to missing nonce validation on the ls_parse_vcita_callback function. This makes it pos…

CVE-2023-2303MEDIUMCVSS 6.1EG 6.1

2023-06-03

The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.5. This is due to missing nonce validation in the vcita-callback.php file. This makes it …

CVE-2023-2307MEDIUMCVSS 4.7EG 4.7

2023-04-26

Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.

CVE-2023-2326MEDIUMCVSS 6.5EG 6.5

2023-06-27

The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in a…

CVE-2023-2329HIGHCVSS 8.8EG 8.8

CVE-2023-2330HIGHCVSS 8.8EG 8.8

The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack

CVE-2023-2334MEDIUMCVSS 5.4EG 5.4

The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack

2025-05-15

The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged …

CVE-2023-23465CRITICALCVSS 9.1EG 8.8

2023-02-15

Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint.

CVE-2023-23473MEDIUMCVSS 5.3EG 5.3

2023-08-28

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 245400.

CVE-2023-2352MEDIUMCVSS 4.3EG 4.3

2023-08-31

The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is due to missing or incorrect nonce validation on the chp_abd_action function. This makes it possibl…

CVE-2023-23572MEDIUMCVSS 4.8EG 6.5

2023-04-11

Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. [Note] Web Config is the software that allows us…

CVE-2023-23646MEDIUMCVSS 4.3EG 4.3

CVE-2023-23659MEDIUMCVSS 4.3EG 8.8

Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin <= 1.4.9 versions.

2023-02-23

Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions.

CVE-2023-23671HIGHCVSS 7.1EG 7.1

CVE-2023-23680MEDIUMCVSS 5.4EG 5.4

Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions.

CVE-2023-23704MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Bob Goetz WP-TopBar plugin <= 5.36 versions.

CVE-2023-23705MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions.

CVE-2023-23706MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions.

CVE-2023-23711MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

2023-03-13

Cross-Site Request Forgery (CSRF) vulnerability in A2 Hosting A2 Optimized WP plugin <= 3.0.4 versions.

CVE-2023-23712MEDIUMCVSS 5.4EG 5.4

CVE-2023-23713MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in User Meta Manager plugin <= 3.4.9 versions.

CVE-2023-23714MEDIUMCVSS 4.3EG 4.3

Cross-Site Request Forgery (CSRF) vulnerability in Manoj Thulasidas Theme Tweaker plugin <= 5.20 versions.

2023-05-26

Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions.

CVE-2023-23719MEDIUMCVSS 5.4EG 5.4

CVE-2023-23721MEDIUMCVSS 4.3EG 8.8

Cross-Site Request Forgery (CSRF) vulnerability in Premmerce plugin <= 1.3.17 versions.

2023-03-20

Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions.

CVE-2023-23724MEDIUMCVSS 4.3EG 4.3

CVE-2023-23726MEDIUMCVSS 5.4EG 5.4

Cross-Site Request Forgery (CSRF) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.

2024-12-09

Cross-Site Request Forgery (CSRF) vulnerability in Tickera.com Tickera allows Cross Site Request Forgery.This issue affects Tickera: from n/a through 3.5.1.0.

CVE-2023-23731MEDIUMCVSS 4.3EG 4.3

CVE-2023-23750MEDIUMCVSS 6.3EG 6.3

Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <= 1.3.3 versions.

2023-02-01

An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.

CVE-2023-23787MEDIUMCVSS 4.3EG 4.3

2023-07-10

Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.

CVE-2023-23790HIGHCVSS 7.1EG 7.1

2023-05-03

Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.

CVE-2023-23791MEDIUMCVSS 4.3EG 4.3