CWE-352 · Cross-Site Request Forgery (CSRF) (page 11)
Page 11 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22030 | Medium | 6.5 | 2026-01-10 | React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is… |
CVE-2026-22194 | High | 8.8 | 2026-01-09 | GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of… |
CVE-2025-13749 | Medium | 4.3 | 2026-01-09 | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version… |
CVE-2025-68158 | Medium | 5.7 | 2026-01-08 | Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tie… |
CVE-2025-61547 | Medium | 6.8 | 2026-01-08 | Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). The application… |
CVE-2019-25259 | Medium | 5.3 | 2026-01-08 | Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions… |
CVE-2025-31963 | Low | 2.9 | 2026-01-07 | Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform una… |
CVE-2025-14999 | Medium | 4.3 | 2026-01-07 | The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect… |
CVE-2025-14904 | Medium | 4.3 | 2026-01-07 | The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect… |
CVE-2025-14845 | Medium | 4.3 | 2026-01-07 | The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5. This is due… |
CVE-2025-14468 | Medium | 4.3 | 2026-01-07 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due… |
CVE-2025-14465 | Medium | 4.3 | 2026-01-07 | The Sticky Action Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or… |
CVE-2025-14077 | Medium | 4.3 | 2026-01-07 | The Simcast plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect n… |
CVE-2025-13990 | Medium | 4.3 | 2026-01-07 | The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing… |
CVE-2025-13657 | Medium | 4.3 | 2026-01-07 | The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing… |
CVE-2025-13527 | Medium | 4.3 | 2026-01-07 | The xShare plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce validatio… |
CVE-2025-13521 | Medium | 4.3 | 2026-01-07 | The WP Status Notifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or in… |
CVE-2025-13520 | Medium | 4.3 | 2026-01-07 | The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing or… |
CVE-2025-13519 | Medium | 6.1 | 2026-01-07 | The SVG Map Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or inco… |
CVE-2020-36918 | Medium | 4.3 | 2026-01-06 | iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without requ… |
CVE-2020-36908 | Medium | 5.3 | 2026-01-06 | SnapGear Management Console SG560 version 3.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions wit… |
CVE-2020-36906 | Medium | 4.3 | 2026-01-06 | P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent… |
CVE-2025-53344 | Medium | 4.3 | 2026-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3. |
CVE-2023-52212 | Medium | 5.4 | 2026-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a thro… |
CVE-2026-21430 | Critical | 9.3 | 2026-01-02 | Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can… |
CVE-2025-15405 | Medium | 4.3 | 2026-01-01 | A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The att… |
CVE-2025-31054 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Themefy Bloggie allows Reflected XSS.This issue affects Bloggie: from n/a through 2.0.8. |
CVE-2025-62123 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Cross Site Request Forgery.This issue affects WP Gmail SMTP: fr… |
CVE-2025-62113 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in emendo_seb Co-marquage service-public.fr co-marquage-service-public allows Cross Site Request Forgery.This i… |
CVE-2025-62101 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Omid Shamloo Pardakht Delkhah pardakht-delkhah allows Cross Site Request Forgery.This issue affects Pardakht… |
CVE-2025-63040 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Post Snippets post-snippets allows Cross Site Request Forgery.This issue affects Post Snippets: f… |
CVE-2025-63014 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Cross Site Request Forgery.This issue affects Gmedia P… |
CVE-2025-62148 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Eugen Bobrowski Robots.txt rewrite robotstxt-rewrite allows Cross Site Request Forgery.This issue affects Ro… |
CVE-2025-62133 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in manidoraisamy FormFacade formfacade allows Cross Site Request Forgery.This issue affects FormFacade: from n/… |
CVE-2025-62089 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in MERGADO Mergado Pack mergado-marketing-pack allows Cross Site Request Forgery.This issue affects Mergado Pac… |
CVE-2025-62084 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Imdad Next Web iNext Woo Pincode Checker inext-woo-pincode-checker allows Cross Site Request Forgery.This is… |
CVE-2025-62080 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Cross… |
CVE-2025-59130 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in appointify Appointify appointify allows Cross Site Request Forgery.This issue affects Appointify: from n/a t… |
CVE-2025-62134 | Medium | 5.4 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects C… |
CVE-2025-62120 | Medium | 5.4 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Rick Beckman OpenHook thesis-openhook allows Cross Site Request Forgery.This issue affects OpenHook: from n/… |
CVE-2025-62117 | Medium | 5.4 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Jayce53 EasyIndex easyindex allows Cross Site Request Forgery.This issue affects EasyIndex: from n/a through… |
CVE-2025-62992 | Medium | 6.5 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Path Traversal.This issue affects Everest Backup: from n/… |
CVE-2025-49028 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Zoho Mail Zoho ZeptoMail transmail allows Stored XSS.This issue affects Zoho ZeptoMail: from n/a through <=… |
CVE-2025-68885 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in page-carbajal Custom Post Status custom-post-status allows Stored XSS.This issue affects Custom Post Status… |
CVE-2025-49354 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Mindstien Technologies Recent Posts From Each Category recent-posts-from-each-category allows Stored XSS.Thi… |
CVE-2025-49353 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Marcin Kijak Noindex by Path noindex-by-path allows Stored XSS.This issue affects Noindex by Path: from n/a… |
CVE-2025-49345 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in mg12 WP-EasyArchives wp-easyarchives allows Stored XSS.This issue affects WP-EasyArchives: from n/a through… |
CVE-2025-49344 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in reneade SensitiveTagCloud sensitive-tag-cloud allows Stored XSS.This issue affects SensitiveTagCloud: from n… |
CVE-2025-49343 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in socialprofilr Social Profilr social-profilr-display-social-network-profile allows Stored XSS.This issue affe… |
CVE-2025-49342 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in merzedes Custom Style custom-style allows Stored XSS.This issue affects Custom Style: from n/a through <= 1… |
CVE-2025-59137 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects… |
CVE-2025-49346 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple… |
CVE-2025-59131 | High | 7.1 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in hoernerfranz WP-CalDav2ICS wp-caldav2ics allows Stored XSS.This issue affects WP-CalDav2ICS: from n/a throug… |
CVE-2022-50804 | High | 8.8 | 2025-12-30 | JM-DATA ONU JF511-TV version 1.0.67 is vulnerable to cross-site request forgery (CSRF) attacks, allowing attackers to perform administrative actions on behalf… |
CVE-2025-62112 | Medium | 4.3 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in Merv Barrett Import into Easy Property Listings easy-property-listings-xml-csv-import allows Cross Site Requ… |
CVE-2025-52835 | Critical | 9.6 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue aff… |
CVE-2025-69021 | Medium | 5.4 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a thr… |
CVE-2025-68998 | Medium | 5.4 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affec… |
CVE-2024-30855 | High | 8.8 | 2025-12-29 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php. |
CVE-2025-67013 | Medium | 6.5 | 2025-12-26 | The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) pr… |
CVE-2019-25254 | High | 8.8 | 2025-12-24 | KYOCERA Net Admin 3.4.0906 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request vali… |
CVE-2019-25252 | Medium | 4.3 | 2025-12-24 | Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request val… |
CVE-2019-25250 | Medium | 5.3 | 2025-12-24 | Devolo dLAN 500 AV Wireless+ 3.1.0-1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper… |
CVE-2019-25247 | Medium | 5.3 | 2025-12-24 | Beward N100 H.264 VGA IP Camera M2.1.6 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without prop… |
CVE-2019-25242 | Medium | 4.3 | 2025-12-24 | FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user… |
CVE-2019-25238 | Medium | 4.3 | 2025-12-24 | V-SOL GPON/EPON OLT Platform 2.03 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user cons… |
CVE-2019-25234 | Medium | 5.3 | 2025-12-24 | SmartHouse Webapp 6.5.33 contains multiple cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform unauthorized act… |
CVE-2019-25233 | Medium | 5.3 | 2025-12-24 | AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions witho… |
CVE-2018-25156 | Medium | 4.3 | 2025-12-24 | Teradek Cube 7.3.6 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validati… |
CVE-2018-25155 | Medium | 4.3 | 2025-12-24 | Teradek Slice 7.3.15 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request valida… |
CVE-2018-25152 | Medium | 5.3 | 2025-12-24 | Ecessa Edge EV150 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authenticatio… |
CVE-2018-25151 | Medium | 4.3 | 2025-12-24 | Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrative actions without… |
CVE-2018-25150 | Medium | 5.3 | 2025-12-24 | Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without auth… |
CVE-2018-25149 | Medium | 6.5 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent… |
CVE-2018-25133 | Medium | 4.3 | 2025-12-24 | Synaccess netBooter NP-0801DU 7.4 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper re… |
CVE-2018-25127 | Medium | 5.3 | 2025-12-24 | SOCA Access Control System 180612 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper re… |
CVE-2025-68601 | Medium | 5.4 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This… |
CVE-2025-68584 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This iss… |
CVE-2025-68583 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Tikweb Management Fast User Switching fast-user-switching allows Cross Site Request Forgery.This issue affec… |
CVE-2025-68580 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro allows Cross Site Re… |
CVE-2025-68573 | Medium | 5.4 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue… |
CVE-2025-68567 | Medium | 5.4 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Cross Site Request Forgery.This issue af… |
CVE-2025-68529 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email C… |
CVE-2025-67625 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in tmtraderunner Trade Runner traderunner allows Cross Site Request Forgery.This issue affects Trade Runner: fr… |
CVE-2025-67622 | High | 7.1 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in titopandub Evergreen Post Tweeter evergreen-post-tweeter allows Stored XSS.This issue affects Evergreen Post… |
CVE-2021-47722 | Low | 3.5 | 2025-12-23 | Zucchetti Axess CLOKI Access Control 1.64 contains a cross-site request forgery vulnerability that allows attackers to manipulate access control settings witho… |
CVE-2025-14163 | Medium | 4.3 | 2025-12-23 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11.53. This is due to… |
CVE-2023-53961 | Medium | 4.3 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user con… |
CVE-2025-62880 | Medium | 4.3 | 2025-12-22 | Cross-Site Request Forgery (CSRF) vulnerability in Kunal Custom 404 Pro custom-404-pro allows Cross Site Request Forgery.This issue affects Custom 404 Pro: fro… |
CVE-2025-62107 | Medium | 4.3 | 2025-12-22 | Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page feather-login-page allows Cross Site Request Forgery.This issue affects Feather… |
CVE-2025-13361 | Medium | 4.3 | 2025-12-21 | The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing n… |
CVE-2025-14734 | Medium | 5.4 | 2025-12-20 | The Amazon affiliate lite Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to m… |
CVE-2025-14168 | Medium | 4.3 | 2025-12-20 | The WP DB Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce va… |
CVE-2025-14164 | Medium | 4.3 | 2025-12-20 | The Quran Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce vali… |
CVE-2025-13365 | Medium | 6.1 | 2025-12-20 | The WP Hallo Welt plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorre… |
CVE-2025-68481 | Medium | 5.9 | 2025-12-19 | FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tok… |
CVE-2025-66906 | Medium | 6.1 | 2025-12-19 | Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows attackers to gain escalated privileges. |
CVE-2025-1927 | High | 7.1 | 2025-12-19 | Cross-Site Request Forgery (CSRF) vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Cross Site Request Forgery. This… |
CVE-2025-59949 | Medium | 5.3 | 2025-12-18 | FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of se… |
CVE-2025-68434 | High | 8.8 | 2025-12-17 | Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and pr… |