CWE-352 · Cross-Site Request Forgery (CSRF) (page 5)
Page 5 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57757 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions. |
CVE-2026-57751 | High | 8.1 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions. |
CVE-2026-57747 | Medium | 6.5 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions. |
CVE-2026-57690 | Medium | 4.3 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions. |
CVE-2026-57723 | High | 7.4 | 2026-07-01 | Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel B… |
CVE-2026-12158 | High | 8.8 | 2026-07-01 | The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6… |
CVE-2026-58518 | Medium | 6.3 | 2026-07-01 | Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issu… |
CVE-2026-11981 | Medium | 4.3 | 2026-07-01 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on… |
CVE-2026-14016 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-13963 | Low | 3.1 | 2026-06-30 | Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-13952 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in PerformanceAPIs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-13946 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a craft… |
CVE-2026-13944 | Low | 3.1 | 2026-06-30 | Inappropriate implementation in DataTransfer in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2026-13887 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to le… |
CVE-2026-13826 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-35096 | | 2026-06-30 | KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and password-change functionalities. An attacker can craft a malic… | |
CVE-2026-8944 | Medium | 4.3 | 2026-06-30 | The Plugin for Google Analytics by IO technologies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This… |
CVE-2026-43735 | High | 8.1 | 2026-06-29 | The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 2… |
CVE-2026-31016 | Medium | 6.5 | 2026-06-29 | Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer a… |
CVE-2026-13537 | Medium | 4.3 | 2026-06-29 | A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request fo… |
CVE-2026-13422 | Medium | 4.3 | 2026-06-27 | The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to missing or incorrect nonce validation o… |
CVE-2026-50132 | High | 7.3 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that perf… |
CVE-2026-52784 | High | 8.8 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter… |
CVE-2026-57659 | High | 8.8 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions. |
CVE-2026-57657 | Medium | 4.3 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions. |
CVE-2026-57655 | High | 8.2 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions. |
CVE-2026-57641 | Medium | 6.5 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions. |
CVE-2026-57637 | Medium | 4.3 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions. |
CVE-2026-57635 | Medium | 6.5 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions. |
CVE-2025-68052 | High | 8.8 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions. |
CVE-2026-52800 | High | 8.8 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection… |
CVE-2026-12986 | | 2026-06-24 | A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak… | |
CVE-2026-57306 | Medium | 4.2 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacke… |
CVE-2026-57305 | Medium | 5.4 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an… |
CVE-2026-57298 | Medium | 5.4 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins… |
CVE-2026-57295 | Medium | 5.4 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-s… |
CVE-2026-57292 | Medium | 5.4 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specifie… |
CVE-2026-57290 | Medium | 4.3 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job… |
CVE-2026-57283 | Medium | 4.3 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types relat… |
CVE-2026-9724 | Medium | 4.3 | 2026-06-24 | The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect… |
CVE-2026-9721 | Medium | 4.3 | 2026-06-24 | The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missi… |
CVE-2026-8905 | Medium | 6.1 | 2026-06-24 | The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing… |
CVE-2026-6292 | Medium | 4.3 | 2026-06-24 | The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This is due to a c… |
CVE-2026-11997 | Medium | 4.3 | 2026-06-24 | The Bulk SEO Image plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1. This is due to missing or incorrect no… |
CVE-2026-10552 | Medium | 4.3 | 2026-06-24 | The Blue Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 2.0.1. This is due to missing or incorrect no… |
CVE-2026-53663 | Low | 3.1 | 2026-06-22 | React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests… |
CVE-2026-49871 | Critical | 9.3 | 2026-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send… |
CVE-2026-11775 | Medium | 4.3 | 2026-06-19 | The User Admin Simplifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing… |
CVE-2026-56024 | Medium | 6.5 | 2026-06-18 | Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue affects WP EasyPay: from n/a through 4… |
CVE-2026-54220 | | 2026-06-18 | uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user… | |
CVE-2026-55745 | Medium | 5.4 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.ed… |
CVE-2026-55744 | High | 8.1 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.ma… |
CVE-2026-55742 | Critical | 9.6 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.p… |
CVE-2026-55741 | High | 8.8 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.c… |
CVE-2026-11784 | Medium | 4.3 | 2026-06-18 | The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in… |
CVE-2026-9591 | | 2026-06-17 | Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or mod… | |
CVE-2026-22342 | High | 8.8 | 2026-06-17 | Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions. |
CVE-2024-35648 | Medium | 4.3 | 2026-06-17 | Cross-Site request forgery (CSRF) vulnerability in Andy Moyle Emergency Password Reset allows Cross Site Request Forgery. This issue affects Emergency Passwor… |
CVE-2024-34810 | Medium | 4.3 | 2026-06-17 | Cross-Site request forgery (CSRF) vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery. This issue affects Skyline WP: from n/a through… |
CVE-2026-46955 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). Supported versions that are affected are 12.2.3-12.2.15. D… |
CVE-2026-46894 | High | 8.0 | 2026-06-17 | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.1… |
CVE-2026-46869 | Medium | 6.5 | 2026-06-17 | Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load). Supported versions that are affected are 8.4.0-8.4.9 and 9.0.0-9… |
CVE-2026-46787 | High | 8.0 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1… |
CVE-2026-46786 | Critical | 9.6 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1… |
CVE-2026-46785 | Critical | 9.3 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1… |
CVE-2026-49043 | Medium | 4.7 | 2026-06-15 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions. |
CVE-2026-48518 | Medium | 4.3 | 2026-06-15 | MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0… |
CVE-2016-20083 | Medium | 5.3 | 2026-06-15 | WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF to… |
CVE-2016-20074 | Medium | 4.3 | 2026-06-15 | WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting… |
CVE-2016-20067 | Medium | 4.3 | 2026-06-15 | WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated u… |
CVE-2026-49396 | High | 7.1 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET req… |
CVE-2026-54359 | | 2026-06-12 | MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is disabled, state-cha… | |
CVE-2026-48612 | High | 8.0 | 2026-06-12 | Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked… |
CVE-2022-47150 | Medium | 4.3 | 2026-06-11 | Cross-Site request forgery (CSRF) vulnerability in weDevs WooCommerce Conversion Tracking allows Cross Site Request Forgery. This issue affects WooCommerce Co… |
CVE-2022-44630 | Medium | 4.6 | 2026-06-11 | Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery. This issue affects YITH Wo… |
CVE-2024-32110 | Medium | 4.3 | 2026-06-11 | Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery. This issue affects WpEvently: from n/a through… |
CVE-2026-53739 | Medium | 4.3 | 2026-06-10 | Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or c… |
CVE-2026-53736 | Medium | 4.3 | 2026-06-10 | Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attack… |
CVE-2025-58468 | High | 8.8 | 2026-06-10 | A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to g… |
CVE-2026-39170 | Medium | 6.3 | 2026-06-09 | SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php. |
CVE-2026-8940 | Medium | 4.3 | 2026-06-09 | The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or in… |
CVE-2026-8910 | Medium | 6.1 | 2026-06-09 | The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or… |
CVE-2026-8909 | Medium | 4.3 | 2026-06-09 | The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to missing or incorrect no… |
CVE-2026-8907 | Medium | 6.1 | 2026-06-09 | The WP-Ultimate-Map plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This is due to missing nonce valida… |
CVE-2026-8904 | Medium | 4.3 | 2026-06-09 | The FastPicker, an order picker and order management system (oms) for WooCommerce on steroids plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2026-8902 | Medium | 4.3 | 2026-06-09 | The AJAX Report Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing o… |
CVE-2026-10553 | Medium | 4.3 | 2026-06-09 | The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing o… |
CVE-2026-9719 | Medium | 4.3 | 2026-06-06 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… |
CVE-2026-7047 | Medium | 4.3 | 2026-06-06 | The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or… |
CVE-2026-11270 | Medium | 6.5 | 2026-06-05 | Inappropriate implementation in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa… |
CVE-2026-11265 | High | 7.5 | 2026-06-05 | Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2026-11214 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2026-11200 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-11195 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-11194 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2026-11156 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-11155 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-11148 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HT… |
CVE-2026-11139 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-11134 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |