Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

wwbn/avideo Packagist

CVSS 5.4 Medium

WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
- Cross-site request forgery (CSRF)
<=29.0 · no fixed version yet

GHSA-8qm8-g55h-xmqr · CVE-2026-40929 Not analysed yet 14 Apr 2026
wwbn/avideo Packagist

CVSS 5.4 Medium

WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
- Cross-site request forgery (CSRF)
<=29.0 · no fixed version yet

GHSA-x2pw-9c38-cp2j · CVE-2026-40928 Not analysed yet 14 Apr 2026
wwbn/avideo Packagist

CVSS 7.1 High

WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
- Cross-site request forgery (CSRF)
<=29.0 · no fixed version yet

GHSA-ffw8-fwxp-h64w · CVE-2026-40926 Not analysed yet 14 Apr 2026
wwbn/avideo Packagist

CVSS 8.3 High

WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
- Cross-site request forgery (CSRF)
<=29.0 · no fixed version yet

GHSA-vvfw-4m39-fjqf · CVE-2026-40925 Not analysed yet 14 Apr 2026
github.com/patrickhener/goshs/v2 Go

CVSS 6.1 Medium

goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation
- Cross-site request forgery (CSRF)
>=2.0.0-beta.4, <2.0.0-beta.6 · fixed in 2.0.0-beta.6

GHSA-jrq5-hg6x-j6g3 · CVE-2026-40883 Not analysed yet 14 Apr 2026
CVE-2026-40041 CVE record

CVSS 5.3 Medium

Pachno 1.0.6 Cross-Site Request Forgery via State-Changing Endpoints
- Pachno
- Cross-site request forgery (CSRF)
Not analysed yet 13 Apr 2026
CVE-2019-25708 CVE record

CVSS 5.3 Medium

Heatmiser Wifi Thermostat 1.7 Cross-Site Request Forgery
- Heatmiser Wifi Thermostat
- Cross-site request forgery (CSRF)
Not analysed yet 12 Apr 2026
CVE-2019-25693 CVE record

CVSS 7.1 High

ResourceSpace 8.6 SQL Injection via collection_edit.php
- ResourceSpace
- Cross-site request forgery (CSRF)
Not analysed yet 12 Apr 2026
metagpt PyPI

CVSS 5.3 Medium

MetaGPT has an eval injection via a cross-site request forgery attack
- Cross-site request forgery (CSRF)
- Broken access control
<=0.8.2 · no fixed version yet

GHSA-w287-wwhf-95vv · CVE-2026-6109 Not analysed yet 12 Apr 2026
CVE-2026-1924 CVE record

CVSS 4.3 Medium

Aruba HiSpeed Cache <= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Reset
- arubadev Aruba HiSpeed Cache
- Cross-site request forgery (CSRF)
Not analysed yet 10 Apr 2026
CVE-2025-70811 CVE record

CVSS 4.3 Medium

Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality.
- Cross-site request forgery (CSRF)
Not analysed yet 9 Apr 2026
CVE-2025-70810 CVE record

CVSS 8.8 High

Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism
- Cross-site request forgery (CSRF)
Not analysed yet 9 Apr 2026
CVE-2026-5918 CVE record

CVSS 4.3 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 8 Apr 2026
CVE-2026-34721 CVE record

CVSS 5.9 Medium

Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints
- zammad
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-0811 CVE record

CVSS 5.4 Medium

Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion
- vsourz1td Advanced Contact form 7 DB
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-1672 CVE record

CVSS 6.5 Medium

BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification
- realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-1673 CVE record

CVSS 4.3 Medium

BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion
- realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39710 CVE record

CVSS 5.4 Medium

WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Cross Site Request Forgery (CSRF) vulnerability
- stmcan RT-Theme 18 | Extensions
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39671 CVE record

CVSS 7.1 High

WordPress Extra Fees Plugin for WooCommerce plugin <= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerability
- Dotstore Extra Fees Plugin for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39641 CVE record

CVSS 6.5 Medium

WordPress Blackfyre theme <= 2.5.4 - Cross Site Request Forgery (CSRF) vulnerability
- Skywarrior Blackfyre
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39640 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerability
- mndpsingh287 Theme Editor
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39635 CVE record

CVSS 5.4 Medium

WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeGoods Grand Magazine
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39634 CVE record

CVSS 5.4 Medium

WordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeGoods Grand Portfolio
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39633 CVE record

CVSS 6.5 Medium

WordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeGoods Grand Car Rental
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39632 CVE record

CVSS 6.5 Medium

WordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeGoods Grand Blog
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39621 CVE record

CVSS 8.8 High

WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability
- spicethemes SpicePress
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39620 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Appointment theme <= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability
- priyanshumittal Appointment
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39619 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Busiprof theme <= 2.5.2 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability
- priyanshumittal Busiprof
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39618 CVE record

CVSS 4.3 Medium

WordPress NewsExo theme <= 7.1 - Cross Site Request Forgery (CSRF) vulnerability
- themearile NewsExo
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39617 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Bluestreet theme <= 1.7.3 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation vulnerability
- priyanshumittal Bluestreet
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-39603 CVE record

CVSS 5.4 Medium

WordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeGoods Grand Photography
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-4141 CVE record

CVSS 4.3 Medium

Quran Translations <= 1.7 - Cross-Site Request Forgery to Playlist Settings Form
- edckwt Quran Translations
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
CVE-2026-3499 CVE record

CVSS 8.8 High

Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions
- jkohlbach Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 8 Apr 2026
rwsdk npm

CVSS 8.1 High

RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
- Cross-site request forgery (CSRF)
>=1.0.0-beta.50, <1.0.6 · fixed in 1.0.6

GHSA-x8rx-789c-2pxq · CVE-2026-39371 Not analysed yet 8 Apr 2026
CVE-2026-4401 CVE record

CVSS 5.4 Medium

Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling
- wpchill Download Monitor
- Cross-site request forgery (CSRF)
Not analysed yet 7 Apr 2026
CVE-2026-34904 CVE record

CVSS 7.5 High

WordPress Simple Social Media Share Buttons plugin <= 6.2.0 - Cross Site Request Forgery (CSRF) vulnerability
- Analytify Simple Social Media Share Buttons
- Cross-site request forgery (CSRF)
Not analysed yet 7 Apr 2026
CVE-2026-34896 CVE record

CVSS 7.5 High

WordPress Under Construction, Coming Soon & Maintenance Mode plugin <= 2.1.1 - Cross Site Request Forgery (CSRF) vulnerability
- Analytify Under Construction, Coming Soon & Maintenance Mode
- Cross-site request forgery (CSRF)
Not analysed yet 7 Apr 2026
CVE-2026-35180 CVE record

CVSS 4.3 Medium

WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 6 Apr 2026
CVE-2026-5624 CVE record

CVSS 5.3 Medium

ProjectSend upload.php cross-site request forgery
- ProjectSend
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 6 Apr 2026
CVE-2019-25682 CVE record

CVSS 5.3 Medium

CMSsite 1.0 Cross-Site Request Forgery via users.php
- VictorAlagwu CMSsite
- Cross-site request forgery (CSRF)
Not analysed yet 5 Apr 2026
CVE-2026-5572 CVE record

CVSS 5.3 Medium

Technostrobe HI-LED-WR120-G2 cross-site request forgery
- Technostrobe HI-LED-WR120-G2
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 5 Apr 2026
khodakhah/nodcms Packagist

CVSS 5.3 Medium

Nodcms contains a cross-site request forgery vulnerability
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
<=3.4.1 · no fixed version yet

GHSA-3qcm-pj6q-w4c5 · CVE-2016-20054 Not analysed yet 4 Apr 2026
CVE-2016-20053 CVE record

CVSS 6.9 Medium

Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint
- Redaxo CMS
- Cross-site request forgery (CSRF)
Not analysed yet 4 Apr 2026
CVE-2016-20051 CVE record

CVSS 6.9 Medium

Snews CMS 1.7 Cross-Site Request Forgery via changeup
- Snewscms Snews CMS Cross Site Request Forgery
- Cross-site request forgery (CSRF)
Not analysed yet 4 Apr 2026
wwbn/avideo Packagist

CVSS 4.3 Medium

AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
- Cross-site request forgery (CSRF)
<=26.0 · no fixed version yet

GHSA-4q27-4rrq-fx95 · CVE-2026-35181 Not analysed yet 3 Apr 2026
CVE-2026-34228 CVE record

CVSS 8.7 High

Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write
- emlog
- Cross-site request forgery (CSRF)
Not analysed yet 3 Apr 2026
openclaw npm

CVSS 2.3 Low

OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode
- Cross-site request forgery (CSRF)
- CWE-346
<2026.3.31 · fixed in 2026.3.31

GHSA-mhr7-2xmv-4c4q · CVE-2026-41347 Not analysed yet 3 Apr 2026
CVE-2025-36375 CVE record

CVSS 6.5 Medium

IBM DataPower Gateway vulnerable to CSRF
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.5.0
- Cross-site request forgery (CSRF)
Not analysed yet 1 Apr 2026
payload npm

CVSS 5.4 Medium

Payload has a CSRF Protection Bypass in Authentication Flow
- Cross-site request forgery (CSRF)
<3.79.1 · fixed in 3.79.1

GHSA-p6mr-xf3r-ghq4 · CVE-2026-34749 Not analysed yet 1 Apr 2026
wwbn/avideo Packagist

CVSS 6.5 Medium

AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
- Cross-site request forgery (CSRF)
<=26.0 · no fixed version yet

GHSA-hqxf-mhfw-rc44 · CVE-2026-34613 Not analysed yet 1 Apr 2026
wwbn/avideo Packagist

CVSS 6.5 Medium

AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
- Cross-site request forgery (CSRF)
<=26.0 · no fixed version yet

GHSA-c4xj-x7p8-3x7q · CVE-2026-34611 Not analysed yet 1 Apr 2026
CVE-2026-5283 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 1 Apr 2026
wwbn/avideo Packagist

CVSS 8.1 High

AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking
- Cross-site request forgery (CSRF)
<=26.0 · no fixed version yet

GHSA-4wwr-7h7c-chqr · CVE-2026-34394 Not analysed yet 31 Mar 2026
admidio/admidio Packagist

CVSS 4.3 Medium

Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter
- Cross-site request forgery (CSRF)
- CWE-20
<5.0.8 · fixed in 5.0.8

GHSA-4rwm-c5mj-wh7x · CVE-2026-34383 Not analysed yet 31 Mar 2026
admidio/admidio Packagist

CVSS 4.5 Medium

Admidio has Missing CSRF Protection on Registration Approval Actions
- Cross-site request forgery (CSRF)
<5.0.8 · fixed in 5.0.8

GHSA-ph84-r98x-2j22 · CVE-2026-34384 Not analysed yet 31 Mar 2026
admidio/admidio Packagist

CVSS 4.6 Medium

Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php
- Cross-site request forgery (CSRF)
>=5.0.0, <5.0.8 · fixed in 5.0.8

GHSA-g3mx-8jm6-rc85 · CVE-2026-34382 Not analysed yet 31 Mar 2026
CVE-2026-3191 CVE record

CVSS 5.4 Medium

Minify HTML <= 2.1.12 - Cross-Site Request Forgery to Plugin Settings Update
- teckel Minify HTML
- Cross-site request forgery (CSRF)
Not analysed yet 31 Mar 2026
CVE-2026-4315 CVE record

CVSS 7.1 High

WatchGuard Firebox Cross-Site Request Forgery (CSRF) in Fireware Web UI
- WatchGuard Fireware OS
- Cross-site request forgery (CSRF)
Not analysed yet 30 Mar 2026
CVE-2026-33373 CVE record

CVSS 8.8 High

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1.
- Cross-site request forgery (CSRF)
Not analysed yet 30 Mar 2026
CVE-2026-4971 CVE record

CVSS 5.3 Medium

SourceCodester Note Taking App cross-site request forgery
- SourceCodester Note Taking App
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 27 Mar 2026