Advisories · Weakness
Cross-site request forgery (CSRF).
A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.3 Medium
WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability
- Fuelthemes Werkstatt
- Cross-site request forgery (CSRF)
- CVSS 7.4 High
WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability
- e4jvikwp VikBooking Hotel Booking Engine & PMS
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
- metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
GiveWP <= 4.15.3 - Cross-Site Request Forgery
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site request forgery (CSRF)
- CVSS 6.9 Medium
Cross-site request forgery in The Wikimedia Foundation Mediawiki - RedirectManager Extension
- The Wikimedia Foundation Mediawiki - RedirectManager Extension
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CVSS 3.1 Low
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CVSS 3.1 Low
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
- CVSS 6.5 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
- CVSS 5.1 Medium
Cross-Site Request Forgery (CSRF) in KTM System e-BOK
- KTM System e-BOK
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter
- engagementanalytics Plugin for Google Analytics by IO technologies
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
Cross-site request forgery in Apple Safari and others
- Apple Safari
- Apple iOS and iPadOS
- Cross-site request forgery (CSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
misp-modules website - Missing CSRF protection in the website home blueprint
- Cross-site request forgery (CSRF)
<=3.0.7 · no fixed version yet
GHSA-j4rh-7jcr-qm69 · CVE-2026-44364 - CVSS 5.3 Medium
CodeAstro Human Resource Management System cross-site request forgery
- CodeAstro Human Resource Management System
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 6.5 Medium
Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer account profile endpoint
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers
- harmonic_design HD Quiz
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"
- opf openproject
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerability
- Stranger Studios Paid Memberships Pro - Add Member From Admin
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability
- Noor Alam Gmail SMTP
- Cross-site request forgery (CSRF)
- CVSS 8.2 High
WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
- Jay Versluis Child Theme Wizard
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability
- Contempoinc Real Estate 7
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerability
- tychesoftwares Abandoned Cart Lite for WooCommerce
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability
- FunnelKit Payment Gateway for Stripe WooCommerce
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
WordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability
- Eagle-Themes Eagle Booking
- Cross-site request forgery (CSRF)
- CVSS 7.3 High
Payara Server Full has a Cross-Site Request Forgery vulnerability
- Cross-site request forgery (CSRF)
- Server-side request forgery (SSRF)
>=4.0.0, <7.2026.6 · fixed in 7.2026.6
GHSA-x939-7fq5-v9v6 · CVE-2026-12986 - CVSS 5.4 Medium
Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability
- Cross-site request forgery (CSRF)
<3.12 · fixed in 3.12
GHSA-6qc4-57v3-28rr · CVE-2026-57298 - CVSS 4.2 Medium
Jenkins Zowe zDevOps Plugin has a CSRF vulnerability
- Cross-site request forgery (CSRF)
<=1.1.3.50.ve350c9b · no fixed version yet
GHSA-43m2-hcmm-qpm7 · CVE-2026-57306 - CVSS 5.4 Medium
Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability
- Cross-site request forgery (CSRF)
<=1.4 · no fixed version yet
GHSA-429r-3j78-2pxm · CVE-2026-57305 - CVSS 5.4 Medium
Jenkins Gitee Plugin has a cross-site request forgery vulnerability
- Cross-site request forgery (CSRF)
<1292.v2559f2f3f2c0 · fixed in 1292.v2559f2f3f2c0
GHSA-w794-rwp2-jc9m · CVE-2026-57292 - CVSS 4.3 Medium
Jenkins Priority Sorter Plugin has a CSRF vulnerability
- Cross-site request forgery (CSRF)
<936.937.v5581d0b · fixed in 936.937.v5581d0b
GHSA-fq56-wvv2-p8jf · CVE-2026-57290 - CVSS 4.3 Medium
Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability
- Cross-site request forgery (CSRF)
<4331.4333 · fixed in 4331.4333
GHSA-72c8-3wwg-r59w · CVE-2026-57283 - CVSS 5.4 Medium
Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability
- Cross-site request forgery (CSRF)
<4.2.3.540.va · fixed in 4.2.3.540.va
GHSA-2x9c-vp3g-hvv2 · CVE-2026-57295 - CVSS 4.3 Medium
Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update
- seo_tools Bulk SEO Image
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
MP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Update
- manuelpadillac MP Customize Login Page
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Blue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter
- jotis Blue Captcha
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
MotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update
- MotorDesk
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Book a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Update
- chuhpl Book a Room Event Calendar
- Cross-site request forgery (CSRF)
- CVSS 6.1 Medium
Osiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter
- osiris8 Osiris Signature Banner
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
Gogs Vulnerable to CSRF Leading to Organization Owner Takeover
- Cross-site request forgery (CSRF)
<0.14.3 · fixed in 0.14.3
GHSA-pwx3-qcgw-vh7h · CVE-2026-52800 - CVSS 7.3 High
Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF
- Broken access control
- Cross-site request forgery (CSRF)
<3.39.0 · fixed in 3.39.0
GHSA-v7j5-vc4m-723w · CVE-2026-50132 - CVSS 8.6 High
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
- Cross-site request forgery (CSRF)
- CWE-346
<0.225.2 · fixed in 0.225.2
GHSA-v3f4-w7r7-v3hm · CVE-2026-58497 - CVSS 5.9 Medium
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
- Cross-site request forgery (CSRF)
- Broken access control
>=5.0.0, <5.12.2 · fixed in 5.12.2
GHSA-mxjx-28vx-xjjj · CVE-2026-58482 - CVSS 2.1 Low
symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted
- Cross-site request forgery (CSRF)
>=2.22.0, <2.36.0 || >=3.0.0, <3.1.0 · fixed in 2.36.0, 3.1.0
GHSA-4m4j-hmqq-3gxm · CVE-2026-49215 - CVSS 2.1 Low
Apache APISIX: cas-auth login CSRF / session injection issue
- Apache Software Foundation Apache APISIX
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery
- adamsilverstein User Admin Simplifier
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
WordPress WP EasyPay plugin <= 4.5.0 - Cross Site Request Forgery (CSRF) vulnerability
- Saad Iqbal WP EasyPay
- Cross-site request forgery (CSRF)
- CVSS 8.6 High
Cross-Site Request Forgery in UBB.threads
- UBB Systems UBB.threads
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module
- Cross-site request forgery (CSRF)
<=1.0.0 · no fixed version yet
GHSA-hp3v-wp32-953h · CVE-2026-55745 - CVSS 8.6 High
Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module
- Cross-site request forgery (CSRF)
<=1.0.0 · no fixed version yet
GHSA-wx35-cv59-9gwr · CVE-2026-55744 - CVSS 9.4 CriticalCritical · CVSS 9+
Cotonti: Cross-Site Request Forgery in the administration rights handler
- Cross-site request forgery (CSRF)
<=1.0.0 · no fixed version yet
GHSA-7g3p-35vc-mgjr · CVE-2026-55742 - CVSS 8.7 High
Cotonti CSRF in admin.config.php allows unauthorized configuration changes
- Cotonti
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
- Cross-site request forgery (CSRF)
- CVSS 6.9 Medium
Cross-Site Request Forgery (CSRF) in SimplCommerce News Module
- SimplCommerce
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Emergency Password Reset plugin <= 8.0 - Cross Site Request Forgery (CSRF) vulnerability
- Andy Moyle Emergency Password Reset
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Skyline WP theme <= 1.0.10 - Cross Site Request Forgery (CSRF) vulnerability
- Extend Themes Skyline WP
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability
- PremiumPress Limited. WordPress Dating Theme
- Cross-site request forgery (CSRF)
- CVSS 7.5 High
Open redirect in Oracle Corporation Oracle Human Resources
- Oracle Corporation Oracle Human Resources
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)