Advisories · Weakness
Cross-site request forgery (CSRF).
A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.1 High
Masa CMS CSRF in site bundle creation allows unauthorized site data export
- MasaCMS
- Cross-site request forgery (CSRF)
- CVSS 8.7 High
Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content
- MasaCMS
- Cross-site request forgery (CSRF)
- CVSS 7.2 High
Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content
- MasaCMS
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
Masa CMS CSRF in user address management allows unauthorized address changes
- MasaCMS
- Cross-site request forgery (CSRF)
- CVSS 2.6 Low
HCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.
- HCL Software BigFix Service Management (SM)
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content
- Cross-site request forgery (CSRF)
<=29.0 · no fixed version yet
GHSA-jw8g-5j46-44rp · CVE-2026-43877 - CVSS 5.4 Medium
JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)
- Cross-site request forgery (CSRF)
>=4.1.0, <5.4.5 · fixed in 5.4.5
GHSA-m68r-v472-jgq9 · CVE-2026-40864 - CVSS 6.1 Medium
Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter
- foux Publish 2 Ping.fm
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update
- xavortm DX Sources
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page
- kazunii addfreespace
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation
- davidvongries Ultimate Dashboard – Custom WordPress Dashboard
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
- benjaminprojas WP Editor
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0.
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0.
- Cross-site request forgery (CSRF)
- CVSS 3.5 Low
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send
- Cross-site request forgery (CSRF)
<5.0.9 · fixed in 5.0.9
GHSA-rw74-vc9h-534j · CVE-2026-41663 - CVSS 6.1 Medium
CKAN has CSRF exemption primed by anonymous requests
- Cross-site request forgery (CSRF)
>=2.10.0, <2.10.10 || >=2.11.0, <2.11.5 · fixed in 2.10.10, 2.11.5
GHSA-mcvf-jxcw-vj73 · CVE-2026-41255 - CVSS 5.3 Medium
VideoFlow Digital Video Protection DVP 2.10 - Authenticated Remote Code Execution
- VideoFlow Ltd. VideoFlow Digital Video Protection
- Cross-site request forgery (CSRF)
- CVSS 6.9 Medium
Merge PACS 7.0 Cross-Site Request Forgery via merge-viewer
- Merge PACS
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.11.0 - Cross Site Request Forgery (CSRF) vulnerability
- Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
code-projects Invoice System in Laravel cross-site request forgery
- code-projects Invoice System in Laravel
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 8.8 High
Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/setting…
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions
- Cross-site request forgery (CSRF)
>=1.0.0-beta.50, <1.2.3 · fixed in 1.2.3
GHSA-m2m6-cff5-3w7c · CVE-2026-42190 - CVSS 4.3 Medium
Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action
- Taqnix
- Cross-site request forgery (CSRF)
- CVSS 6.6 Medium
Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation
- frappe press
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode
- Cross-site request forgery (CSRF)
<2026.3.31 · fixed in 2026.3.31
GHSA-2xp4-qhr4-xqm2 - CVSS 8.4 High
SenseLive X3050 Cross-Site request forgery
- SenseLive X3050
- Cross-site request forgery (CSRF)
- CVSS 9.6 CriticalCritical · CVSS 9+
Hackage CSRF vulnerability
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS
- Cross-site request forgery (CSRF)
<=1.1.4 · no fixed version yet
GHSA-rhf7-wvw3-vjvm · CVE-2026-42091 - CVSS 8.1 High
Cross-Site Request Forgery (CSRF) in GitLab
- GitLab
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeFusion Avada
- Cross-site request forgery (CSRF)
- CVSS 4.0, no score published
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection
- Authentication bypass
- Cross-site request forgery (CSRF)
<2.0.2 · fixed in 2.0.2
GHSA-2r2p-4cgf-hv7h - CVSS 4.3 Medium
DX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update
- nofearinc DX Unanswered Comments
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Google PageRank Display <= 1.4 - Cross-Site Request Forgery to Settings Update via Settings Page
- byybora Google PageRank Display
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Kcaptcha <= 1.0.1 - Cross-Site Request Forgery to Settings Update
- ksolves Kcaptcha
- Cross-site request forgery (CSRF)
- CVSS 6.1 Medium
Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form
- ravster Inquiry cart
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Call To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update
- tmarek Call To Action Plugin
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function
- chsxf mCatFilter
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Fast & Fancy Filter – 3F <= 1.2.2 - Cross-Site Request Forgery to Settings Modification via fff_save_settins AJAX Action
- webarea Fast & Fancy Filter – 3F
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Ni WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action
- anzia Ni WooCommerce Order Export
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
TextP2P Texting Widget <= 1.7 - Cross-Site Request Forgery to Settings Update
- TextP2P Texting Widget
- Cross-site request forgery (CSRF)
- CVSS 6.1 Medium
WP Responsive Popup + Optin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter
- sphex1987 WP Responsive Popup + Optin
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable
- freescout
- Cross-site request forgery (CSRF)
- CVSS 5.5 Medium
Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints
- Cross-site request forgery (CSRF)
- CWE-1385
<1.9.10-0.20260316053337-1a9cd29a3082 · fixed in 1.9.10-0.20260316053337-1a9cd29a3082
GHSA-78mf-482w-62qj · CVE-2026-34403 - CVSS 5.3 Medium
Other issue in the Networking: DNS component
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site request forgery (CSRF)
- Denial of service
- CVSS 6.5 Medium
Mitigation bypass in the DOM: postMessage component
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site request forgery (CSRF)
- CVSS 6.3 Medium
Dovestones Softwares AD Self Update <4.0.0.5 is vulnerable to Cross Site Request Forgery (CSRF).
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
ComfyUI server.py create_origin_only_middleware cross-site request forgery
- ComfyUI
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 5.4 Medium
apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation
- Cross-site request forgery (CSRF)
>=0.0.1, <0.7.0 · fixed in 0.7.0
GHSA-5w6h-pjw6-wvc6 · CVE-2026-40948 - CVSS 8.1 High
ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion
- CRM
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 7.0 High
PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability
- Cross-site request forgery (CSRF)
<5.7.10 || >=6.0.0-RC1, <6.4.1 · fixed in 5.7.10, 6.4.1
GHSA-xw5c-jc7x-gf75 · CVE-2026-40458 - CVSS 6.8 Medium
Mattermost doesn't validate CSRF tokens on an authentication endpoint
- Cross-site request forgery (CSRF)
>=8.0.0-20250721062209-4952acea88ce, <8.0.0-20260220133927-c29cf05d40f8 || >=11.3.0-rc1, <11.3.3 || >=11.4.0-rc1, <11.4.3 || >=11.5.0-rc1, <11.5.0 · fixed in 8.0.0-20260220133927-c29cf05d40f8, 11.3.3, 11.4.3, 11.5.0
GHSA-m7cf-4gh2-v4qg · CVE-2026-28741 - CVSS 4.3 Medium
CMS für Motorrad Werkstätten <= 1.0.0 - Cross-Site Request Forgery
- tholstkabelbwde Plugin: CMS für Motorrad Werkstätten
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
Authlib: Cross-site request forging when using cache
- Cross-site request forgery (CSRF)
<1.6.11 · fixed in 1.6.11
GHSA-jj8c-mmj3-mmgv · CVE-2026-41425 - CVSS 4.3 Medium
WordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability
- ZAYTECH Smart Online Order for Clover
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Userpro plugin < 5.1.11 - Cross Site Request Forgery (CSRF) vulnerability
- DeluxeThemes Userpro
- Cross-site request forgery (CSRF)
- CVSS 6.1 Medium
Product Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion
- woobeewoo Product Pricing Table by WooBeWoo
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability
- Syed Balkhi Contact Form by WPForms
- Cross-site request forgery (CSRF)
- CVSS 6.1 Medium
OPEN-BRAIN <= 0.5.0 - Cross-Site Request Forgery
- faridsaniee OPEN-BRAIN
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Petje.af <= 2.1.8 - Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action
- petjeaf Petje.af
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Inquiry form to posts or pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter
- udamadu Inquiry form to posts or pages
- Cross-site request forgery (CSRF)