Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-40549 CVE record

CVSS 5.1 Medium

Cross-Site Request Forgery in SOPlanning
- SOPlanning
- Cross-site request forgery (CSRF)
Not analysed yet 1 Jun 2026
admidio/admidio Packagist

CVSS 4.3 Medium

Admidio PKCS#12 private key export action lacks CSRF protection
- Cross-site request forgery (CSRF)
<5.0.10 · fixed in 5.0.10

GHSA-4rgq-38mh-9xqg · CVE-2026-47232 Not analysed yet 29 May 2026
admidio/admidio Packagist

CVSS 5.4 Medium

Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
- Cross-site request forgery (CSRF)
<5.0.10 · fixed in 5.0.10

GHSA-xg76-5qj2-2hhv · CVE-2026-47229 Not analysed yet 29 May 2026
admidio/admidio Packagist

CVSS 5.2 Medium

Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
- Cross-site request forgery (CSRF)
<5.0.10 · fixed in 5.0.10

GHSA-mx25-j3rc-6w2w · CVE-2026-47228 Not analysed yet 29 May 2026
CVE-2018-25397 CVE record

CVSS 6.9 Medium

PHP-SHOP 1.0 Cross-Site Request Forgery via users.php
- joeyrush PHP-SHOP master
- Cross-site request forgery (CSRF)
Not analysed yet 29 May 2026
CVE-2018-25387 CVE record

CVSS 6.9 Medium

HaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.php
- Sitejo HaPe PKH
- Cross-site request forgery (CSRF)
Not analysed yet 29 May 2026
CVE-2026-6075 CVE record

CVSS 8.1 High

Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
- dglingren Media Library Assistant
- Cross-site request forgery (CSRF)
Not analysed yet 29 May 2026
CVE-2026-35266 CVE record

CVSS 7.9 High

Cross-site request forgery in Oracle Corporation Oracle REST Data Services
- Oracle Corporation Oracle REST Data Services
- Cross-site request forgery (CSRF)
Not analysed yet 28 May 2026
CVE-2026-6455 CVE record

CVSS 8.1 High

WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter
- yudiz WP Contact Form 7 DB Handler
- Cross-site request forgery (CSRF)
Not analysed yet 28 May 2026
CVE-2026-9618 CVE record

CVSS 4.3 Medium

PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
- Cross-site request forgery (CSRF)
Not analysed yet 28 May 2026
CVE-2026-7533 CVE record

CVSS 4.3 Medium

Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site request forgery (CSRF)
Not analysed yet 28 May 2026
org.jenkins-ci.plugins:jenkins-multijob-plugin Maven

CVSS 4.3 Medium

Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability
- Cross-site request forgery (CSRF)
<669.v9d96a · fixed in 669.v9d96a

GHSA-hj3h-r49w-34wh · CVE-2026-9674 Not analysed yet 27 May 2026
org.jenkins-ci.plugins:github-integration-parent Maven

CVSS 4.3 Medium

Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability
- Cross-site request forgery (CSRF)
<0.7.4 · fixed in 0.7.4

GHSA-rf8w-7c3g-7h3g · CVE-2026-48925 Not analysed yet 27 May 2026
CVE-2026-8942 CVE record

CVSS 4.3 Medium

MetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page
- lhughes33472 MetaMagic SEO Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-8906 CVE record

CVSS 6.1 Medium

WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter
- rahulbhangale WP Promoter
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-49001 CVE record

CVSS 5.3 Medium

Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product
- ZTE ZXUniPOS NDS-LTE
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-8708 CVE record

CVSS 4.3 Medium

Genzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page
- shra Genzel breadcrumbs
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-7614 CVE record

CVSS 4.3 Medium

Old Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update
- mkhfr Old Posts Highlighter
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-8903 CVE record

CVSS 4.3 Medium

Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update
- youtag Two-factor authentication (formerly IP Vault)
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-8911 CVE record

CVSS 6.1 Medium

WP AutoBuzz <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter
- godlessons WP AutoBuzz
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-8943 CVE record

CVSS 4.3 Medium

GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function
- rchmura GoStats for WordPress
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-8941 CVE record

CVSS 4.3 Medium

CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update
- wmark CDN Linker lite
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-8938 CVE record

CVSS 4.3 Medium

auto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass
- nakamura1458 auto making JSON-LD
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-8939 CVE record

CVSS 4.3 Medium

Search Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update
- simonailie Search Simple Fields
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-9236 CVE record

CVSS 4.3 Medium

CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management
- creativemindssolutions CM Ad Changer – A simple tool to control and optimize your site's banners
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-30498 CVE record

CVSS 6.3 Medium

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.
- Cross-site request forgery (CSRF)
Not analysed yet 27 May 2026
CVE-2026-9582 CVE record

CVSS 5.3 Medium

SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery
- SourceCodester CET Automated Grading System with AI Predictive Analytics
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 26 May 2026
CVE-2026-35220 CVE record

CVSS 4.6 Medium

Joomla! Core - [20260505] - CSRF in user activation endpoint
- Joomla! Project Joomla! CMS
- Cross-site request forgery (CSRF)
Not analysed yet 26 May 2026
weblate PyPI

CVSS 5.0 Medium

Weblate has a Server-Side Request Forgery issue
- Cross-site request forgery (CSRF)
- Server-side request forgery (SSRF)
<5.15 · fixed in 5.15

GHSA-hfpv-mc5v-p9mm · CVE-2025-66407 Not analysed yet 26 May 2026
CVE-2026-46620 CVE record

CVSS 6.5 Medium

e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()
- e107
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 26 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion
- Cross-site request forgery (CSRF)
<9.5.1 · fixed in 9.5.1

GHSA-xjg6-5v39-v7fc · CVE-2026-8340 Not analysed yet 26 May 2026
CVE-2026-8174 CVE record

CVSS 5.7 Medium

Cross-site Request Forgery
- Zohocorp Zoho Mail wordpress plugin
- Cross-site request forgery (CSRF)
Not analysed yet 26 May 2026
CVE-2026-39436 CVE record

CVSS 7.1 High

WordPress CformsII plugin <= 15.1.3 - Cross Site Request Forgery (CSRF) vulnerability
- bgermann CformsII
- Cross-site request forgery (CSRF)
Not analysed yet 25 May 2026
CVE-2026-24554 CVE record

CVSS 4.3 Medium

WordPress WPSubscription plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability
- Convers Lab WPSubscription
- Cross-site request forgery (CSRF)
Not analysed yet 25 May 2026
CVE-2026-24574 CVE record

CVSS 6.5 Medium

WordPress Export WP Page to Static HTML/CSS plugin <= 6.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- Recorp Export WP Page to Static HTML/CSS
- Cross-site request forgery (CSRF)
Not analysed yet 25 May 2026
CVE-2026-24597 CVE record

CVSS 4.3 Medium

WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability
- WpDevArt Organization chart
- Cross-site request forgery (CSRF)
Not analysed yet 25 May 2026
CVE-2026-9486 CVE record

CVSS 5.3 Medium

SourceCodester Student Grades Management System cross-site request forgery
- SourceCodester Student Grades Management System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 25 May 2026
CVE-2018-25370 CVE record

CVSS 6.9 Medium

Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php
- Admidio
- Cross-site request forgery (CSRF)
Not analysed yet 25 May 2026
CVE-2018-25363 CVE record

CVSS 5.3 Medium

Twitter-Clone 1 Cross-Site Request Forgery via tweetdel.php
- Fyffe PHP-Twitter-Clone
- Cross-site request forgery (CSRF)
Not analysed yet 25 May 2026
CVE-2018-25354 CVE record

CVSS 5.3 Medium

Joomla Component jomres 9.11.2 Cross-Site Request Forgery
- Jomres
- Cross-site request forgery (CSRF)
Not analysed yet 23 May 2026
CVE-2018-25343 CVE record

CVSS 5.3 Medium

Smartshop 1 Cross-Site Request Forgery via editprofile.php
- Behance Smartshop
- Cross-site request forgery (CSRF)
Not analysed yet 23 May 2026
CVE-2026-9303 CVE record

CVSS 5.3 Medium

calcom cal.diy cross-site request forgery
- calcom cal.diy
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 23 May 2026
CVE-2026-41074 CVE record

CVSS 7.1 High

RT has broken CSRF protection for authenticated users
- bestpractical rt
- Cross-site request forgery (CSRF)
Not analysed yet 22 May 2026
CVE-2026-7615 CVE record

CVSS 4.3 Medium

Widget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter
- kasparsd Widget Context
- Cross-site request forgery (CSRF)
Not analysed yet 22 May 2026
CVE-2026-4070 CVE record

CVSS 4.3 Medium

Alfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter
- pftool Alfie – Feed Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-xj25-753j-wgp9 · CVE-2026-8415 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-v7c7-658v-hh7v · CVE-2026-8410 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-rv3q-xmfw-mcjv · CVE-2026-8412 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-qj94-6rx6-27fr · CVE-2026-8416 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-mpq2-mv8p-9wm6 · CVE-2026-8413 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-98qf-jvwj-2r5f · CVE-2026-8414 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-97jw-gr4m-c5v8 · CVE-2026-8432 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-752x-23hp-jmv6 · CVE-2026-8411 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-6qjh-p324-694f · CVE-2026-8434 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-6fxm-r8p3-mx5c · CVE-2026-8433 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-67hj-8239-cmf5 · CVE-2026-8427 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-56c9-xq5g-xrf9 · CVE-2026-8409 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()
- Cross-site request forgery (CSRF)
- CWE-1275
>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

GHSA-44q4-354f-c826 · CVE-2026-8435 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS is vulnerable to unauthorized file deletion
- Cross-site request forgery (CSRF)
<9.5.1 · fixed in 9.5.1

GHSA-66rg-92q4-6m8q · CVE-2026-7882 Not analysed yet 22 May 2026
concrete5/concrete5 Packagist

CVSS 7.5 High

Concrete CMS is Vulnerable to Cross-Site Request Forgery
- Cross-site request forgery (CSRF)
- CWE-829
<9.5.1 · fixed in 9.5.1

GHSA-prxr-vjgc-2cq9 · CVE-2026-8428 Not analysed yet 21 May 2026