Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-46894 CVE record

CVSS 8.0 High

Open redirect in Oracle Corporation Oracle iSupplier Portal
- Oracle Corporation Oracle iSupplier Portal
- Cross-site request forgery (CSRF)
- Open redirect
Not analysed yet 16 Jun 2026
CVE-2026-46869 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Oracle Corporation MySQL Shell
- Oracle Corporation MySQL Shell
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jun 2026
CVE-2026-46787 CVE record

CVSS 8.0 High

Cross-site request forgery in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jun 2026
CVE-2026-46786 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Cross-site request forgery in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jun 2026
CVE-2026-46785 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Cross-site request forgery in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jun 2026
CVE-2026-49043 CVE record

CVSS 4.7 Medium

WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability
- WP Engine WP Migrate Lite
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jun 2026
react-router +1 npm

CVSS 3.1 Low

React Router: Potential CSRF via PUT/PATCH/DELETE document requests
- Cross-site request forgery (CSRF)
>=7.12.0, <7.15.1 · fixed in 7.15.1

GHSA-84g9-w2xq-vcv6 · CVE-2026-53663 Not analysed yet 15 Jun 2026
CVE-2026-48518 CVE record

CVSS 4.3 Medium

MultiJuicer: Login CSRF allows attacker to force victims into their team
- juice-shop multi-juicer
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jun 2026
CVE-2016-20083 CVE record

CVSS 6.9 Medium

WordPress More Fields Plugin 2.1 Cross-Site Request Forgery
- henrikmelin More Fields
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jun 2026
CVE-2016-20074 CVE record

CVSS 5.3 Medium

WordPress Lazy Content Slider Plugin 3.4 CSRF
- leethompson Lazy Content Slider Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jun 2026
CVE-2016-20067 CVE record

CVSS 5.3 Medium

WordPress CP Polls 1.0.8 Cross-Site Request Forgery
- dwbooster CP Polls
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jun 2026
CVE-2026-54359 CVE record

CVSS 7.1 High

MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default
- misp
- Cross-site request forgery (CSRF)
- CWE-1188
Not analysed yet 12 Jun 2026
@budibase/backend-core npm

CVSS 6.5 Medium

Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
- Cross-site request forgery (CSRF)
- CWE-185
<3.35.4 · fixed in 3.35.4

GHSA-wxq7-x3qp-vcr8 · CVE-2026-48147 Not analysed yet 12 Jun 2026
CVE-2026-48612 CVE record

CVSS 8.0 High

Cross-site request forgery in phpBB
- phpBB
- Cross-site request forgery (CSRF)
Not analysed yet 12 Jun 2026
CVE-2022-47150 CVE record

CVSS 4.3 Medium

WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability
- weDevs WooCommerce Conversion Tracking
- Cross-site request forgery (CSRF)
Not analysed yet 11 Jun 2026
CVE-2022-44630 CVE record

CVSS 4.6 Medium

WordPress YITH WooCommerce Product Slider Carousel plugin <= 1.16.0 - Cross-Site Request Forgery (CSRF)
- YITH WooCommerce Product Slider Carousel
- Cross-site request forgery (CSRF)
Not analysed yet 11 Jun 2026
CVE-2024-32110 CVE record

CVSS 4.3 Medium

WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.1.2 - Cross Site Request Forgery (CSRF) vulnerability
- Magepeople inc. WpEvently
- Cross-site request forgery (CSRF)
Not analysed yet 11 Jun 2026
CVE-2026-53739 CVE record

CVSS 5.1 Medium

Yoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate_post_dismiss_notice
- Yoast Duplicate Post
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jun 2026
CVE-2026-53736 CVE record

CVSS 5.1 Medium

Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action
- bplugins Easy Twitter Feeds
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jun 2026
github.com/nezhahq/nezha Go

CVSS 7.1 High

Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents
- Cross-site request forgery (CSRF)
>=1.0.0, <2.0.14 · fixed in 2.0.14

GHSA-8qhj-4f8c-j8qg · CVE-2026-49396 Not analysed yet 10 Jun 2026
CVE-2025-58468 CVE record

CVSS 5.1 Medium

Notification Center
- QNAP Systems Inc. Notification Center
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jun 2026
CVE-2026-8904 CVE record

CVSS 4.3 Medium

FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save
- yuluma FastPicker, an order picker and order management system (oms) for WooCommerce on steroids
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jun 2026
CVE-2026-10553 CVE record

CVSS 4.3 Medium

jQuery Hover Footnotes <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update
- weaverlancegmailcom jQuery Hover Footnotes
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jun 2026
CVE-2026-8910 CVE record

CVSS 6.1 Medium

WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter
- rahulbhangale WP Emoticon Rating
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jun 2026
CVE-2026-8902 CVE record

CVSS 4.3 Medium

AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update
- tierrainnovation AJAX Report Comments
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jun 2026
CVE-2026-8909 CVE record

CVSS 4.3 Medium

WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action
- rahulbhangale WpMobi
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jun 2026
CVE-2026-8907 CVE record

CVSS 6.1 Medium

WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter
- rahulbhangale WP-Ultimate-Map
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jun 2026
CVE-2026-8940 CVE record

CVSS 4.3 Medium

WP Meta Sort Posts <= 0.9 - Cross-Site Request Forgery to Plugin Settings Update
- jasonpitts WP Meta Sort Posts
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jun 2026
CVE-2026-39170 CVE record

CVSS 6.3 Medium

SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jun 2026
github.com/juev/nebula-mesh Go

CVSS 6.9 Medium

nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints
- Privilege escalation
- Cross-site request forgery (CSRF)
<0.3.3 · fixed in 0.3.3

GHSA-273q-qgh5-wrj6 · CVE-2026-47725 Not analysed yet 8 Jun 2026
CVE-2026-9719 CVE record

CVSS 4.3 Medium

LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site request forgery (CSRF)
Not analysed yet 5 Jun 2026
CVE-2026-7047 CVE record

CVSS 4.3 Medium

Frontend User Notes <= 2.1.1 - Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action
- absikandar Frontend User Notes
- Cross-site request forgery (CSRF)
Not analysed yet 5 Jun 2026
CVE-2026-11270 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2026-11265 CVE record

CVSS 7.5 High

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2026-11214 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 4 Jun 2026
CVE-2026-11200 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 4 Jun 2026
CVE-2026-11195 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 4 Jun 2026
CVE-2026-11194 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 4 Jun 2026
CVE-2026-11156 CVE record

CVSS 4.3 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2026-11155 CVE record

CVSS 4.3 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2026-11148 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2026-11139 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2026-11134 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2026-11129 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2026-11106 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2026-11084 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 4 Jun 2026
CVE-2026-11083 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 4 Jun 2026
CVE-2026-11020 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 4 Jun 2026
CVE-2026-43985 CVE record

CVSS 8.8 High

Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover
- Tautulli
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2019-25729 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie
- simcy_creative PDF Signer
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jun 2026
CVE-2026-9732 CVE record

CVSS 4.3 Medium

EmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update
- planetshaker EmergencyWP – Dead Man's switch & legacy deliverance
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jun 2026
CVE-2026-34460 CVE record

CVSS 5.4 Medium

NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping
- Nameless
- Cross-site request forgery (CSRF)
- CWE-302
Not analysed yet 2 Jun 2026
CVE-2026-9722 CVE record

CVSS 4.3 Medium

Laiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form
- pcis Laiser Tag
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jun 2026
CVE-2026-8422 CVE record

CVSS 4.3 Medium

Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update
- mr_mat Remove meta boxes per user role
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jun 2026
CVE-2026-9730 CVE record

CVSS 4.3 Medium

Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update
- jamesmuga Remove NoFollow Commenter URL
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jun 2026
CVE-2026-9599 CVE record

CVSS 4.3 Medium

Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update
- russellr Tectite Forms
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jun 2026
CVE-2026-9723 CVE record

CVSS 4.3 Medium

Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page
- ddd2500 Google Plus One Bottom
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jun 2026
CVE-2026-4071 CVE record

CVSS 4.3 Medium

BirdSeed <= 2.2.0 - Cross-Site Request Forgery via BirdSeed Token Change
- BirdSeed
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jun 2026
CVE-2018-25435 CVE record

CVSS 6.9 Medium

ZeusCart 4.0 Deactivate Customer Accounts CSRF
- ZeusCart
- Cross-site request forgery (CSRF)
Not analysed yet 1 Jun 2026
CVE-2026-49433 CVE record

CVSS 2.3 Low

DeepAI api.deepai.org/change_user_email CSRF
- api.deepai.org
- Cross-site request forgery (CSRF)
Not analysed yet 1 Jun 2026