CWE-352 · Cross-Site Request Forgery (CSRF) (page 38)
Page 38 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27955 | High | 8.8 | 2024-05-17 | Cross-Site Request Forgery (CSRF) vulnerability in WP Automatic Automatic allows Privilege Escalation.This issue affects Automatic: from n/a through 3.92.0. |
CVE-2023-44478 | High | 7.1 | 2024-05-17 | Cross-Site Request Forgery (CSRF) vulnerability in WP Hive Events Rich Snippets for Google allows Exploitation of Trusted Credentials.This issue affects Events… |
CVE-2024-4204 | Medium | 4.3 | 2024-05-16 | The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due… |
CVE-2024-35039 | Low | 3.8 | 2024-05-16 | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/tplSys_deal.php?mudi=area. |
CVE-2024-34958 | Medium | 6.5 | 2024-05-16 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/banner_deal.php?mudi=add |
CVE-2024-34957 | Medium | 5.4 | 2024-05-16 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/sysImages_deal.php?mudi=infoSet. |
CVE-2024-3643 | High | 8.8 | 2024-05-16 | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform suc… |
CVE-2024-3642 | Medium | 6.9 | 2024-05-16 | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perfo… |
CVE-2024-4929 | Medium | 4.3 | 2024-05-16 | A vulnerability classified as problematic has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file /simple-o… |
CVE-2024-3824 | Medium | 5.5 | 2024-05-15 | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a… |
CVE-2024-3823 | Low | 2.4 | 2024-05-15 | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping… |
CVE-2024-3631 | Medium | 4.3 | 2024-05-15 | The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admin… |
CVE-2024-3629 | Low | 2.4 | 2024-05-15 | The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-3407 | Medium | 5.3 | 2024-05-15 | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted act… |
CVE-2024-3406 | High | 8.8 | 2024-05-15 | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged i… |
CVE-2024-3405 | High | 7.6 | 2024-05-15 | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admi… |
CVE-2024-35109 | Medium | 6.5 | 2024-05-15 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /homePro_deal.php?mudi=add&nohrefStr=close. |
CVE-2024-35108 | High | 8.8 | 2024-05-15 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/homePro_deal.php?mudi=del&dataType=&dataTypeCN. |
CVE-2024-35012 | Medium | 6.3 | 2024-05-14 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=add&nohrefStr=close. |
CVE-2024-35011 | Medium | 5.4 | 2024-05-14 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-35010 | High | 8.8 | 2024-05-14 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/banner_deal.php?mudi=del&dataType=&dataTypeCN=%E5%9B%BE%E7%… |
CVE-2024-35009 | High | 8.8 | 2024-05-14 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=&fieldName=state&fiel… |
CVE-2024-4689 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Imag… |
CVE-2024-4597 | Medium | 5.7 | 2024-05-14 | An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions startin… |
CVE-2024-4463 | Medium | 4.3 | 2024-05-14 | The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.7. This i… |
CVE-2024-4314 | Medium | 4.3 | 2024-05-14 | The Hostel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5.3. This is due to missing or incorrect… |
CVE-2024-4312 | Medium | 4.3 | 2024-05-14 | The Soccer Engine – Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. Th… |
CVE-2024-4103 | Medium | 4.3 | 2024-05-14 | The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is… |
CVE-2024-4082 | Medium | 4.3 | 2024-05-14 | The Joli FAQ SEO – WordPress FAQ Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is d… |
CVE-2024-3941 | Medium | 4.7 | 2024-05-14 | The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allo… |
CVE-2024-3940 | High | 8.8 | 2024-05-14 | The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-3903 | High | 7.1 | 2024-05-14 | The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-3590 | Medium | 6.1 | 2024-05-14 | The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… |
CVE-2024-3582 | Medium | 4.8 | 2024-05-14 | The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attack… |
CVE-2024-34828 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32. |
CVE-2024-34827 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Razvan Mocanu, Madalin Ungureanu, Cristophor Hurduban TranslatePress.This issue affects Translat… |
CVE-2024-34825 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Warfare Plugins Social Warfare.This issue affects Social Warfare: from n/a through 4.4.5.1. |
CVE-2024-34823 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter.This issue affects Arigato Autoresponder and Newsletter: fr… |
CVE-2024-34818 | High | 7.1 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress.This issue affects WebinarPress: from n/a through 1.33.17. |
CVE-2024-34817 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects I… |
CVE-2024-34816 | Medium | 5.4 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a thr… |
CVE-2024-34814 | Medium | 5.4 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Unyson Unyson unyson.This issue affects Unyson: from n/a through <= 2.7.29. |
CVE-2024-34557 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to… |
CVE-2024-34439 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in divSpot DS Site Message.This issue affects DS Site Message: from n/a through 1.14.4. |
CVE-2024-34427 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Favorite Posts.This issue affects WP Favorite Posts: from n/a through 1.6.8. |
CVE-2024-32712 | High | 7.5 | 2024-05-14 | Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.14. |
CVE-2024-31113 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11. |
CVE-2024-4594 | Medium | 4.3 | 2024-05-07 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. Affected is an unknown function of the file /src/dede/sys_safe.php. The manipul… |
CVE-2024-4593 | Medium | 4.3 | 2024-05-07 | A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. This issue affects some unknown processing of the file /src/dede/sys_multi… |
CVE-2024-4592 | Medium | 4.3 | 2024-05-07 | A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/sys_group_edit.php. The manip… |
CVE-2024-4591 | Medium | 4.3 | 2024-05-07 | A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/sys_group_add.php. The manipulation… |
CVE-2024-4590 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/sys_info… |
CVE-2024-4589 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede… |
CVE-2024-4588 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/mytag_add.php. The manip… |
CVE-2024-4587 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7 and classified as problematic. This issue affects some unknown processing of the file /src/dede/tpl.php. The manipulat… |
CVE-2024-4586 | Medium | 4.3 | 2024-05-07 | A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/shops_delivery.php… |
CVE-2024-4600 | High | 7.1 | 2024-05-07 | Cross-Site Request Forgery vulnerability in Socomec Net Vision, version 7.20. This vulnerability could allow an attacker to trick registered users into perform… |
CVE-2024-4585 | Medium | 4.3 | 2024-05-07 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/member_type.php. The manipul… |
CVE-2024-34379 | Medium | 4.3 | 2024-05-06 | Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Restaurant and Cafe.This issue affects Restaurant and Cafe: from n/a through 1.2.1. |
CVE-2024-34367 | High | 7.1 | 2024-05-06 | Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through 4… |
CVE-2024-34069 | High | 7.5 | 2024-05-06 | Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's… |
CVE-2024-33830 | High | 8.1 | 2024-05-06 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=clearWebCache. |
CVE-2024-33829 | Medium | 5.4 | 2024-05-06 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=updateWebCache. |
CVE-2024-3756 | High | 7.5 | 2024-05-06 | The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and abo… |
CVE-2024-34502 | Critical | 9.8 | 2024-05-05 | An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attemp… |
CVE-2023-7065 | Medium | 5.4 | 2024-05-04 | The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl… |
CVE-2024-4086 | Medium | 4.3 | 2024-05-02 | The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.1… |
CVE-2024-4083 | Medium | 4.3 | 2024-05-02 | The Easy Restaurant Table Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to… |
CVE-2024-3215 | Medium | 5.3 | 2024-05-02 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… |
CVE-2024-2960 | Medium | 4.3 | 2024-05-02 | The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or… |
CVE-2024-2959 | Medium | 4.3 | 2024-05-02 | The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or… |
CVE-2024-1416 | Medium | 4.3 | 2024-05-02 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capabi… |
CVE-2024-1415 | Medium | 4.3 | 2024-05-02 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ… |
CVE-2024-0847 | Medium | 4.3 | 2024-05-02 | The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due t… |
CVE-2024-0613 | Medium | 6.1 | 2024-05-02 | The Delete Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.1. This is due to missing o… |
CVE-2024-4128 | Low | 2.6 | 2024-05-02 | This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from… |
CVE-2024-33913 | Critical | 9.6 | 2024-05-02 | Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload in Xserver Migrator.This issue affects Xserver Migrator: from n/a through 1.6… |
CVE-2024-3481 | Medium | 5.2 | 2024-05-02 | The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unw… |
CVE-2024-3478 | Medium | 6.1 | 2024-05-02 | The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform un… |
CVE-2024-3477 | Medium | 4.3 | 2024-05-02 | The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwan… |
CVE-2024-3476 | High | 8.8 | 2024-05-02 | The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform… |
CVE-2024-3475 | High | 7.5 | 2024-05-02 | The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform… |
CVE-2024-3474 | High | 8.8 | 2024-05-02 | The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perfor… |
CVE-2024-3472 | Medium | 5.9 | 2024-05-02 | The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in a… |
CVE-2024-3471 | Low | 3.4 | 2024-05-02 | The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin d… |
CVE-2024-2405 | Medium | 4.5 | 2024-05-02 | The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrar… |
CVE-2024-23597 | Medium | 4.3 | 2024-05-01 | Cross-site request forgery (CSRF) vulnerability exists in TvRock 0.9t8a. If a logged-in user of TVRock accesses a specially crafted page, unintended operations… |
CVE-2024-33449 | Critical | 9.8 | 2024-04-29 | An SSRF issue in the PDFMyURL service allows a remote attacker to obtain sensitive information and execute arbitrary code via a POST request in the url paramet… |
CVE-2024-33681 | High | 7.1 | 2024-04-29 | Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Regenerate post permalink allows Cross-Site Scripting (XSS).This issue affects Regenerate post… |
CVE-2024-33632 | Medium | 5.4 | 2024-04-29 | Cross-Site Request Forgery (CSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a throu… |
CVE-2024-33646 | High | 7.1 | 2024-04-29 | Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Sticky Anything allows Cross-Site Scripting (XSS).This issue affects Sticky Anything: from n/a… |
CVE-2024-3076 | Low | 3.8 | 2024-04-26 | The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow a… |
CVE-2024-33691 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in OptinMonster Popup Builder Team OptinMonster.This issue affects OptinMonster: from n/a through 2.15.3. |
CVE-2024-33690 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Jegstudio Financio.This issue affects Financio: from n/a through 1.1.3. |
CVE-2024-33689 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station.This issue affects Radio Station: from n/a through <= 2.5.7. |
CVE-2024-33688 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Teluro.This issue affects Teluro: from n/a through 1.0.31. |
CVE-2024-33683 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in WP Republic Hide Dashboard Notifications.This issue affects Hide Dashboard Notifications: from n/a through 1… |
CVE-2024-33682 | Medium | 5.4 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Cookie Information A/S WP GDPR Compliance.This issue affects WP GDPR Compliance: from n/a through 2.0.23. |
CVE-2024-33680 | Medium | 5.4 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in MainWP MainWP Child Reports.This issue affects MainWP Child Reports: from n/a through 2.1.1. |
CVE-2024-33679 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in FameThemes FameTheme Demo Importer.This issue affects FameTheme Demo Importer: from n/a through 1.1.5. |