CWE-352 · Cross-Site Request Forgery (CSRF) (page 51)
Page 51 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4394 | Medium | 4.3 | 2023-07-01 | The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect non… |
CVE-2021-4393 | Medium | 4.3 | 2023-07-01 | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.17. T… |
CVE-2021-4392 | Medium | 4.3 | 2023-07-01 | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. T… |
CVE-2021-4391 | Medium | 4.3 | 2023-07-01 | The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due t… |
CVE-2021-4390 | Medium | 4.3 | 2023-07-01 | The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or inco… |
CVE-2021-4389 | Medium | 4.3 | 2023-07-01 | The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missing or incorrect non… |
CVE-2020-36745 | Medium | 4.3 | 2023-07-01 | The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0. This is due to missing or inco… |
CVE-2020-36744 | Medium | 4.3 | 2023-07-01 | The NotificationX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to missing or incorrect… |
CVE-2020-36743 | Medium | 4.3 | 2023-07-01 | The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This is due to missing or… |
CVE-2020-36742 | Medium | 4.3 | 2023-07-01 | The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or i… |
CVE-2020-36741 | Medium | 4.3 | 2023-07-01 | The MultiVendorX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. This is due to missing or incorrect… |
CVE-2020-36740 | Medium | 4.3 | 2023-07-01 | The Radio Buttons for Taxonomies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. This is due to missi… |
CVE-2021-4387 | Medium | 4.3 | 2023-07-01 | The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to missing or incorrect… |
CVE-2021-4386 | Medium | 4.3 | 2023-07-01 | The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is due to missing or in… |
CVE-2021-4385 | Medium | 4.3 | 2023-07-01 | The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or i… |
CVE-2021-4384 | Medium | 4.3 | 2023-07-01 | The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is d… |
CVE-2020-36739 | Medium | 4.3 | 2023-07-01 | The Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including… |
CVE-2020-36738 | Medium | 4.3 | 2023-07-01 | The Cool Timeline (Horizontal & Vertical Timeline) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. Th… |
CVE-2020-36737 | Medium | 4.3 | 2023-07-01 | The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due t… |
CVE-2020-36736 | Medium | 4.3 | 2023-07-01 | The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.1… |
CVE-2020-36735 | Medium | 4.3 | 2023-07-01 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forge… |
CVE-2023-3407 | Medium | 4.3 | 2023-06-28 | The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect no… |
CVE-2023-3427 | Medium | 5.4 | 2023-06-28 | The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or in… |
CVE-2020-18409 | Medium | 6.8 | 2023-06-27 | Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.p… |
CVE-2020-18416 | Medium | 6.8 | 2023-06-27 | An cross site request forgery (CSRF) vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbitrary code via /admin.php?s=/addons/confi… |
CVE-2020-18418 | High | 8.8 | 2023-06-27 | A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.p… |
CVE-2023-34839 | Medium | 6.8 | 2023-06-27 | A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to cre… |
CVE-2023-3411 | Medium | 6.1 | 2023-06-27 | The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and… |
CVE-2023-1722 | Critical | 9.1 | 2023-06-24 | Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correct… |
CVE-2023-34028 | Medium | 4.3 | 2023-06-22 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 versions. |
CVE-2023-34927 | Medium | 6.5 | 2023-06-22 | Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers… |
CVE-2023-32960 | High | 7.1 | 2023-06-22 | Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cros… |
CVE-2023-35917 | Medium | 4.3 | 2023-06-22 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions. |
CVE-2023-23795 | High | 7.1 | 2023-06-22 | Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Form Builder plugin <= 1.9.9.0 versions. |
CVE-2022-3372 | High | 8.8 | 2023-06-21 | There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due… |
CVE-2023-2533 | High | 8.4 | 2023-06-20 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker… |
CVE-2020-21366 | High | 8.0 | 2023-06-20 | Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser function of index.php. |
CVE-2020-21252 | High | 8.8 | 2023-06-20 | Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers… |
CVE-2020-20726 | High | 8.8 | 2023-06-20 | Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/update_rows/user parameter. |
CVE-2020-20502 | Medium | 6.5 | 2023-06-20 | Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function. |
CVE-2023-34373 | Medium | 5.4 | 2023-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions. |
CVE-2023-30759 | High | 7.8 | 2023-06-19 | The driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to detect its modification and may spawn an unexpected process w… |
CVE-2023-27634 | High | 8.8 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability allows arbitrary file upload in Shingo Intrepidity plugin <= 1.5.1 versions. |
CVE-2023-25055 | Medium | 4.3 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Videos plugin <= 2.6.1 versions. |
CVE-2023-25450 | Medium | 5.4 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions. |
CVE-2023-23802 | Medium | 4.3 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) plugin <= 1.0.6 versions. |
CVE-2023-25449 | Medium | 4.3 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions. |
CVE-2023-35030 | High | 8.8 | 2023-06-15 | Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 updat… |
CVE-2023-35148 | Medium | 6.5 | 2023-06-14 | A cross-site request forgery (CSRF) vulnerability in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers to connect to an attac… |
CVE-2023-35141 | High | 8.0 | 2023-06-14 | In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insuffi… |
CVE-2023-3203 | Medium | 4.3 | 2023-06-14 | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. Th… |
CVE-2023-3201 | Medium | 4.3 | 2023-06-14 | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function… |
CVE-2023-3200 | Medium | 4.3 | 2023-06-14 | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function… |
CVE-2023-3198 | Medium | 4.3 | 2023-06-14 | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message funct… |
CVE-2022-42880 | Medium | 6.1 | 2023-06-13 | Cross-Site Request Forgery (CSRF) vulnerability in Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting (XSS). |
CVE-2023-30901 | Medium | 4.3 | 2023-06-13 | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.11), SICAM P8… |
CVE-2023-2563 | Medium | 4.3 | 2023-06-13 | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.7. This is due to… |
CVE-2023-2277 | Medium | 6.1 | 2023-06-13 | The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorr… |
CVE-2023-2286 | Medium | 4.3 | 2023-06-09 | The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonc… |
CVE-2023-2285 | Medium | 4.3 | 2023-06-09 | The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or… |
CVE-2023-2896 | Medium | 4.3 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2895 | Medium | 4.3 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2894 | Medium | 4.3 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2893 | Medium | 4.3 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2892 | Medium | 6.5 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2891 | Medium | 6.5 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2599 | Low | 3.1 | 2023-06-09 | The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order… |
CVE-2023-2526 | Medium | 5.4 | 2023-06-09 | The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. This is due to missing or incor… |
CVE-2023-2087 | Medium | 4.3 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due to missing or incorr… |
CVE-2023-2067 | Medium | 6.3 | 2023-06-09 | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce validation on the 'bu… |
CVE-2023-1807 | Medium | 4.3 | 2023-06-09 | The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.3… |
CVE-2023-0832 | Medium | 4.3 | 2023-06-09 | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incor… |
CVE-2023-0831 | Medium | 4.3 | 2023-06-09 | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incor… |
CVE-2023-0729 | Medium | 5.4 | 2023-06-09 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0292 | Medium | 5.4 | 2023-06-09 | The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing non… |
CVE-2023-31200 | Medium | 5.7 | 2023-06-07 | PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay a… |
CVE-2021-4373 | High | 8.8 | 2023-06-07 | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthen… |
CVE-2021-4349 | High | 8.8 | 2023-06-07 | The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This makes it pos… |
CVE-2020-36717 | High | 8.8 | 2023-06-07 | The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to incorrect nonce handlin… |
CVE-2020-36707 | High | 8.8 | 2023-06-07 | The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.57. This is due to… |
CVE-2015-10116 | Medium | 4.3 | 2023-06-06 | A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the function install_ne… |
CVE-2023-33409 | Medium | 6.5 | 2023-06-05 | Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php. |
CVE-2013-10029 | Medium | 4.3 | 2023-06-05 | A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this vulnerability is the function exitboxadmi… |
CVE-2013-10027 | Medium | 4.3 | 2023-06-04 | A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of t… |
CVE-2023-2416 | Medium | 5.4 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check o… |
CVE-2023-2407 | Medium | 6.1 | 2023-06-03 | The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for W… |
CVE-2023-2405 | Medium | 6.1 | 2023-06-03 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to m… |
CVE-2023-2303 | Medium | 6.1 | 2023-06-03 | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.5. This i… |
CVE-2023-2301 | Medium | 6.1 | 2023-06-03 | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. This is due to mis… |
CVE-2023-3055 | Medium | 6.1 | 2023-06-03 | The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing o… |
CVE-2023-3052 | Medium | 6.3 | 2023-06-03 | The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing o… |
CVE-2023-3075 | Medium | 6.5 | 2023-06-02 | Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8. |
CVE-2015-10109 | Medium | 4.3 | 2023-06-01 | A vulnerability was found in Video Playlist and Gallery Plugin up to 1.136 on WordPress. It has been rated as problematic. Affected by this issue is some unkno… |
CVE-2023-3029 | Medium | 4.3 | 2023-06-01 | A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. This vulnerability affects unknown code o… |
CVE-2015-10108 | Medium | 4.3 | 2023-05-31 | A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic. Affected by this issue is t… |
CVE-2023-2549 | High | 8.8 | 2023-05-31 | The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is du… |
CVE-2012-10015 | Medium | 4.3 | 2023-05-31 | A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings… |
CVE-2022-36250 | High | 8.8 | 2023-05-30 | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-45372 | Medium | 4.3 | 2023-05-29 | Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions. |
CVE-2022-33974 | Medium | 5.4 | 2023-05-29 | Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions. |