CWE-352 · Cross-Site Request Forgery (CSRF) (page 3)
Page 3 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9731 | Medium | 4.3 | 2026-07-08 | The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorr… |
CVE-2026-49471 | High | 8.3 | 2026-07-07 | Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes… |
CVE-2026-58315 | Medium | 4.3 | 2026-07-07 | Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations… |
CVE-2026-34171 | High | 8.0 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoi… |
CVE-2026-59713 | High | 8.1 | 2026-07-06 | Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers… |
CVE-2026-14800 | Medium | 4.3 | 2026-07-06 | A weakness has been identified in imhamzaazam ecommerceFlask up to cb7d9e24c30a99379651b7493b32048126ef402b. The affected element is an unknown function. This… |
CVE-2026-59520 | Medium | 4.3 | 2026-07-05 | Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery. This issue affects CrawlWP SEO: from n/a thro… |
CVE-2026-12746 | High | 8.1 | 2026-07-04 | Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authentication_url method builds the pr… |
CVE-2026-12740 | High | 8.1 | 2026-07-04 | Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirec… |
CVE-2026-14620 | Medium | 4.7 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that… |
CVE-2026-57766 | High | 8.8 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions. |
CVE-2026-57761 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions. |
CVE-2026-57759 | High | 8.8 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid <= 5.9.9.7 versions. |
CVE-2026-57758 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions. |
CVE-2026-57757 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions. |
CVE-2026-57751 | High | 8.1 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions. |
CVE-2026-57747 | Medium | 6.5 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions. |
CVE-2026-57690 | Medium | 4.3 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions. |
CVE-2026-57723 | High | 7.4 | 2026-07-01 | Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel B… |
CVE-2026-12158 | High | 8.8 | 2026-07-01 | The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6… |
CVE-2026-58518 | Medium | 6.3 | 2026-07-01 | Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issu… |
CVE-2026-11981 | Medium | 4.3 | 2026-07-01 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on… |
CVE-2026-14016 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-13963 | Low | 3.1 | 2026-06-30 | Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-13952 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in PerformanceAPIs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-13946 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a craft… |
CVE-2026-13944 | Low | 3.1 | 2026-06-30 | Inappropriate implementation in DataTransfer in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2026-13887 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to le… |
CVE-2026-13826 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-35096 | | 2026-06-30 | KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and password-change functionalities. An attacker can craft a malic… | |
CVE-2026-8944 | Medium | 4.3 | 2026-06-30 | The Plugin for Google Analytics by IO technologies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This… |
CVE-2026-43735 | High | 8.1 | 2026-06-29 | The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 2… |
CVE-2026-31016 | Medium | 6.5 | 2026-06-29 | Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer a… |
CVE-2026-13537 | Medium | 4.3 | 2026-06-29 | A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request fo… |
CVE-2026-13422 | Medium | 4.3 | 2026-06-27 | The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to missing or incorrect nonce validation o… |
CVE-2026-50132 | High | 7.3 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that perf… |
CVE-2026-52784 | High | 8.8 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter… |
CVE-2026-57659 | High | 8.8 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions. |
CVE-2026-57657 | Medium | 4.3 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions. |
CVE-2026-57655 | High | 8.2 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions. |
CVE-2026-57641 | Medium | 6.5 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions. |
CVE-2026-57637 | Medium | 4.3 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions. |
CVE-2026-57635 | Medium | 6.5 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions. |
CVE-2025-68052 | High | 8.8 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions. |
CVE-2026-52800 | High | 8.8 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection… |
CVE-2026-12986 | | 2026-06-24 | A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak… | |
CVE-2026-57306 | Medium | 4.2 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacke… |
CVE-2026-57305 | Medium | 5.4 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an… |
CVE-2026-57298 | Medium | 5.4 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins… |
CVE-2026-57295 | Medium | 5.4 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-s… |
CVE-2026-57292 | Medium | 5.4 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specifie… |
CVE-2026-57290 | Medium | 4.3 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job… |
CVE-2026-57283 | Medium | 4.3 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types relat… |
CVE-2026-9724 | Medium | 4.3 | 2026-06-24 | The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect… |
CVE-2026-9721 | Medium | 4.3 | 2026-06-24 | The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missi… |
CVE-2026-8905 | Medium | 6.1 | 2026-06-24 | The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing… |
CVE-2026-6292 | Medium | 4.3 | 2026-06-24 | The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This is due to a c… |
CVE-2026-11997 | Medium | 4.3 | 2026-06-24 | The Bulk SEO Image plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1. This is due to missing or incorrect no… |
CVE-2026-10552 | Medium | 4.3 | 2026-06-24 | The Blue Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 2.0.1. This is due to missing or incorrect no… |
CVE-2026-53663 | Low | 3.1 | 2026-06-22 | React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests… |
CVE-2026-49871 | Critical | 9.3 | 2026-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send… |
CVE-2026-11775 | Medium | 4.3 | 2026-06-19 | The User Admin Simplifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing… |
CVE-2026-56024 | Medium | 6.5 | 2026-06-18 | Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue affects WP EasyPay: from n/a through 4… |
CVE-2026-54220 | | 2026-06-18 | uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user… | |
CVE-2026-55745 | Medium | 5.4 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.ed… |
CVE-2026-55744 | High | 8.1 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.ma… |
CVE-2026-55742 | Critical | 9.6 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.p… |
CVE-2026-55741 | High | 8.8 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.c… |
CVE-2026-11784 | Medium | 4.3 | 2026-06-18 | The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in… |
CVE-2026-9591 | | 2026-06-17 | Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or mod… | |
CVE-2026-22342 | High | 8.8 | 2026-06-17 | Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions. |
CVE-2024-35648 | Medium | 4.3 | 2026-06-17 | Cross-Site request forgery (CSRF) vulnerability in Andy Moyle Emergency Password Reset allows Cross Site Request Forgery. This issue affects Emergency Passwor… |
CVE-2024-34810 | Medium | 4.3 | 2026-06-17 | Cross-Site request forgery (CSRF) vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery. This issue affects Skyline WP: from n/a through… |
CVE-2026-46955 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). Supported versions that are affected are 12.2.3-12.2.15. D… |
CVE-2026-46894 | High | 8.0 | 2026-06-17 | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.1… |
CVE-2026-46869 | Medium | 6.5 | 2026-06-17 | Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load). Supported versions that are affected are 8.4.0-8.4.9 and 9.0.0-9… |
CVE-2026-46787 | High | 8.0 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1… |
CVE-2026-46786 | Critical | 9.6 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1… |
CVE-2026-46785 | Critical | 9.3 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1… |
CVE-2026-49043 | Medium | 4.7 | 2026-06-15 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions. |
CVE-2026-48518 | Medium | 4.3 | 2026-06-15 | MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0… |
CVE-2016-20083 | Medium | 5.3 | 2026-06-15 | WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF to… |
CVE-2016-20074 | Medium | 4.3 | 2026-06-15 | WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting… |
CVE-2016-20067 | Medium | 4.3 | 2026-06-15 | WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated u… |
CVE-2026-49396 | High | 7.1 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET req… |
CVE-2026-54359 | | 2026-06-12 | MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is disabled, state-cha… | |
CVE-2026-48612 | High | 8.0 | 2026-06-12 | Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked… |
CVE-2022-47150 | Medium | 4.3 | 2026-06-11 | Cross-Site request forgery (CSRF) vulnerability in weDevs WooCommerce Conversion Tracking allows Cross Site Request Forgery. This issue affects WooCommerce Co… |
CVE-2022-44630 | Medium | 4.6 | 2026-06-11 | Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery. This issue affects YITH Wo… |
CVE-2024-32110 | Medium | 4.3 | 2026-06-11 | Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery. This issue affects WpEvently: from n/a through… |
CVE-2026-53739 | Medium | 4.3 | 2026-06-10 | Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or c… |
CVE-2026-53736 | Medium | 4.3 | 2026-06-10 | Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attack… |
CVE-2025-58468 | High | 8.8 | 2026-06-10 | A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to g… |
CVE-2026-39170 | Medium | 6.3 | 2026-06-09 | SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php. |
CVE-2026-8940 | Medium | 4.3 | 2026-06-09 | The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or in… |
CVE-2026-8910 | Medium | 6.1 | 2026-06-09 | The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or… |
CVE-2026-8909 | Medium | 4.3 | 2026-06-09 | The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to missing or incorrect no… |
CVE-2026-8907 | Medium | 6.1 | 2026-06-09 | The WP-Ultimate-Map plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This is due to missing nonce valida… |
CVE-2026-8904 | Medium | 4.3 | 2026-06-09 | The FastPicker, an order picker and order management system (oms) for WooCommerce on steroids plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2026-8902 | Medium | 4.3 | 2026-06-09 | The AJAX Report Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing o… |