CWE-352 · Cross-Site Request Forgery (CSRF) (page 4)
Page 4 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10553 | Medium | 4.3 | 2026-06-09 | The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing o… |
CVE-2026-9719 | Medium | 4.3 | 2026-06-06 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… |
CVE-2026-7047 | Medium | 4.3 | 2026-06-06 | The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or… |
CVE-2026-11270 | Medium | 6.5 | 2026-06-05 | Inappropriate implementation in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa… |
CVE-2026-11265 | High | 7.5 | 2026-06-05 | Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2026-11214 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2026-11200 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-11195 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-11194 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2026-11156 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-11155 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-11148 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HT… |
CVE-2026-11139 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-11134 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-11129 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-11106 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-11084 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-11083 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-11020 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted XML file… |
CVE-2026-43985 | High | 8.8 | 2026-06-04 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `configUpdate` as a state-changing administrator… |
CVE-2019-25729 | Critical | 9.8 | 2026-06-04 | PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP command… |
CVE-2026-9732 | Medium | 4.3 | 2026-06-03 | The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2026-42073 | Medium | 6.5 | 2026-06-02 | OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication… |
CVE-2026-34460 | Medium | 5.4 | 2026-06-02 | NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-sid… |
CVE-2026-9730 | Medium | 4.3 | 2026-06-02 | The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to mi… |
CVE-2026-9723 | Medium | 4.3 | 2026-06-02 | The Google Plus One Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.2. This is due to missing… |
CVE-2026-9722 | Medium | 4.3 | 2026-06-02 | The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrec… |
CVE-2026-9599 | Medium | 4.3 | 2026-06-02 | The Tectite Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorre… |
CVE-2026-8422 | Medium | 4.3 | 2026-06-02 | The Remove meta boxes per user role plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.01. This is due to… |
CVE-2026-4071 | Medium | 4.3 | 2026-06-02 | The BirdSeed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing nonce validat… |
CVE-2018-25435 | Medium | 5.3 | 2026-06-01 | ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicio… |
CVE-2026-49433 | Medium | 5.0 | 2026-06-01 | The DeepAI endpoint 'https://api.deepai.org/change_user_email' accepts POST requests without any CSRF protection. If an attacker can trick a logged-in user int… |
CVE-2026-40549 | | 2026-06-01 | SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An attacker can craft a malicious website tha… | |
CVE-2018-25397 | Medium | 5.3 | 2026-05-29 | PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML f… |
CVE-2018-25387 | Medium | 5.3 | 2026-05-29 | HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the u… |
CVE-2026-45610 | Medium | 5.7 | 2026-05-29 | WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/s… |
CVE-2026-6075 | High | 8.1 | 2026-05-29 | The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonc… |
CVE-2026-35266 | High | 7.9 | 2026-05-28 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allow… |
CVE-2026-9618 | Medium | 4.3 | 2026-05-28 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) plugin for WordPress is vulnerable to Cross-Si… |
CVE-2026-6455 | High | 8.1 | 2026-05-28 | The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via SQL Injection and PHP… |
CVE-2026-7533 | Medium | 4.3 | 2026-05-28 | The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing… |
CVE-2026-48147 | Medium | 6.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.t… |
CVE-2026-9674 | Medium | 4.3 | 2026-05-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds. |
CVE-2026-48925 | Medium | 4.3 | 2026-05-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a… |
CVE-2026-30498 | Medium | 6.3 | 2026-05-27 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0. |
CVE-2026-8942 | Medium | 4.3 | 2026-05-27 | The MetaMagic SEO Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or… |
CVE-2026-8906 | Medium | 6.1 | 2026-05-27 | The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect… |
CVE-2026-49001 | Medium | 5.3 | 2026-05-27 | Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the executio… |
CVE-2026-8943 | Medium | 4.3 | 2026-05-27 | The GoStats for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or… |
CVE-2026-8941 | Medium | 4.3 | 2026-05-27 | The CDN Linker lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorre… |
CVE-2026-8939 | Medium | 4.3 | 2026-05-27 | The Search Simple Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or inco… |
CVE-2026-8938 | Medium | 4.3 | 2026-05-27 | The auto making JSON-LD plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.3. This is due to missing or… |
CVE-2026-8911 | Medium | 6.1 | 2026-05-27 | The WP AutoBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorre… |
CVE-2026-8903 | Medium | 4.3 | 2026-05-27 | The Two-factor authentication (formerly IP Vault) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. T… |
CVE-2026-8708 | Medium | 4.3 | 2026-05-27 | The Genzel breadcrumbs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or in… |
CVE-2026-7614 | Medium | 4.3 | 2026-05-27 | The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing… |
CVE-2026-9236 | Medium | 4.3 | 2026-05-27 | The CM Ad Changer – A simple tool to control and optimize your site's banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions… |
CVE-2026-9582 | Medium | 4.3 | 2026-05-26 | A security flaw has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects an unknown function. Performi… |
CVE-2026-35220 | Medium | 4.3 | 2026-05-26 | Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users. |
CVE-2026-46620 | Medium | 6.5 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem… |
CVE-2026-8174 | Medium | 5.7 | 2026-05-26 | Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wordpress plugin versions before 1.6.2. |
CVE-2026-39436 | High | 7.1 | 2026-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery. This issue affects CformsII: from n/a through 15.1.3. |
CVE-2026-24554 | Medium | 4.3 | 2026-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in Convers Lab WPSubscription allows Cross Site Request Forgery. This issue affects WPSubscription: from n/a t… |
CVE-2026-24597 | Medium | 4.3 | 2026-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart allows Cross Site Request Forgery. This issue affects Organization chart: from… |
CVE-2026-24574 | Medium | 6.5 | 2026-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in Recorp Export WP Page to Static HTML/CSS allows Cross Site Request Forgery. This issue affects Export WP Pa… |
CVE-2026-9486 | Medium | 4.3 | 2026-05-25 | A security flaw has been discovered in SourceCodester Student Grades Management System 1.0. This affects an unknown part. The manipulation results in cross-sit… |
CVE-2018-25370 | Medium | 5.3 | 2026-05-25 | Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin c… |
CVE-2018-25363 | Medium | 4.3 | 2026-05-25 | Twitter-Clone 1 contains a cross-site request forgery vulnerability that allows remote attackers to force victims to delete posts by crafting malicious HTML fo… |
CVE-2018-25354 | Medium | 4.3 | 2026-05-23 | Joomla Component jomres 9.11.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information by tricking authent… |
CVE-2018-25343 | Medium | 4.3 | 2026-05-23 | Smartshop 1 contains a cross-site request forgery vulnerability that allows attackers to modify user profiles by tricking authenticated users into submitting m… |
CVE-2026-9303 | Medium | 4.3 | 2026-05-23 | A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is poss… |
CVE-2026-41074 | High | 7.1 | 2026-05-22 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability… |
CVE-2026-40864 | Medium | 5.4 | 2026-05-22 | JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1… |
CVE-2026-8340 | Medium | 4.3 | 2026-05-22 | Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permission is CSRF'd into publishing an att… |
CVE-2026-7615 | Medium | 4.3 | 2026-05-22 | The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is due to missing or inco… |
CVE-2026-4070 | Medium | 4.3 | 2026-05-22 | The Alfie – Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing no… |
CVE-2026-8435 | Medium | 6.5 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security… |
CVE-2026-8434 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security… |
CVE-2026-8433 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security team ga… |
CVE-2026-8432 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). The Concrete CMS security team gave… |
CVE-2026-8427 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id). The Concrete CMS… |
CVE-2026-8416 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). The Concrete CMS se… |
CVE-2026-8415 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. The Concrete CMS sec… |
CVE-2026-8414 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team g… |
CVE-2026-8413 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design. The Concrete CMS security team… |
CVE-2026-8412 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team… |
CVE-2026-8411 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team… |
CVE-2026-8410 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete. The The Concrete CMS security… |
CVE-2026-8409 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete. The The Concrete CMS security team… |
CVE-2026-7882 | Medium | 4.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an… |
CVE-2026-8428 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method i… |
CVE-2026-8426 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>. An atta… |
CVE-2026-8421 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. A… |
CVE-2026-8417 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() metho… |
CVE-2026-8140 | Medium | 6.5 | 2026-05-21 | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method… |
CVE-2026-22880 | Medium | 6.1 | 2026-05-21 | Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allow… |
CVE-2026-44925 | High | 8.8 | 2026-05-20 | Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to force the user with an active session into… |
CVE-2025-11954 | High | 8.0 | 2026-05-20 | Cross-Site request forgery (CSRF) vulnerability in Sitemio Information Technologies Trade Ltd. Co. WISECP allows Cross Site Request Forgery. This issue affect… |
CVE-2026-6405 | Medium | 4.3 | 2026-05-20 | The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting… |
CVE-2026-8424 | Medium | 4.3 | 2026-05-20 | The Remove Yellow BGBOX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or i… |