Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-14234 CVE record

CVSS 7.1 High

WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
- WOLF
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 29 Jul 2026
CVE-2026-15136 CVE record

CVSS 4.3 Medium

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries
- wplegalpages WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
- Cross-site request forgery (CSRF)
Not analysed yet 28 Jul 2026
org.xwiki.contrib:discussions-server Maven

CVSS 6.5 Medium

org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages
- Cross-site request forgery (CSRF)
<2.0-rc-1 · fixed in 2.0-rc-1

GHSA-4j38-rw27-97gx · CVE-2023-37465 Not analysed yet 27 Jul 2026
CVE-2026-66474 CVE record

CVSS 4.3 Medium

WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability
- HT Plugins Insert Headers and Footers Code – HT Script
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jul 2026
CVE-2026-66428 CVE record

CVSS 4.3 Medium

WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vulnerability
- jgwhite33 WP Google Review Slider
- Cross-site request forgery (CSRF)
Not analysed yet 27 Jul 2026
@budibase/server npm

CVSS 8.7 High

Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
- Broken access control
- Cross-site request forgery (CSRF)
<=3.38.1 · no fixed version yet

GHSA-pvcr-8mvp-w8qr · CVE-2026-72849 Not analysed yet 24 Jul 2026
react-router npm

CVSS 4.0, no score published

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
- Cross-site request forgery (CSRF)
>=7.12.0, <7.18.2 || >=8.0.0, <8.3.0 · fixed in 7.18.2, 8.3.0

GHSA-qwww-vcr4-c8h2 Not analysed yet 24 Jul 2026
CVE-2026-15212 CVE record

CVSS 8.8 High

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-57626 CVE record

CVSS 7.1 High

WordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerability
- MailPoet
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-65540 CVE record

CVSS 7.1 High

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability
- Metin Saraç Popup for CF7 with Sweet Alert
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-65539 CVE record

CVSS 7.1 High

WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability
- Bimal Rekhadiya Kwayy HTML Sitemap
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-65536 CVE record

CVSS 6.5 Medium

WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability
- Mahdi Yousefi افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری)
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-65512 CVE record

CVSS 5.4 Medium

WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
- Melapress WP Activity Log
- Melapress WP Activity Log Premium
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-65488 CVE record

CVSS 7.1 High

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- LA-Studio Element Kit for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-65471 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability
- Avada Studio Avada Core
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-65464 CVE record

CVSS 5.4 Medium

WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability
- Nexcess GiveWP
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-65460 CVE record

CVSS 4.3 Medium

WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- Zarinpal Gateway
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-61981 CVE record

CVSS 5.4 Medium

WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability
- QuantumCloud Simple Link Directory Pro
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-57785 CVE record

CVSS 8.8 High

WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability
- ApusTheme ApusListing
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-57784 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability
- Ninja Forms File Uploads Extension
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-24537 CVE record

CVSS 4.3 Medium

WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability
- Alex Volkov WP Accessibility Helper (WAH)
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-64871 CVE record

CVSS 5.4 Medium

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension
- regularlabs.com Cache Cleaner extension for Joomla
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-65757 CVE record

CVSS 8.1 High

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension
- regularlabs.com Modules Anywhere extension for Joomla
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-64876 CVE record

CVSS 8.8 High

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension
- regularlabs.com GeoIP extension for Joomla
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-63265 CVE record

CVSS 8.0 High

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints
- regularlabs.com Advanced Module Manager extension for Joomla
- regularlabs.com Articles Anywhere extension for Joomla
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 22 Jul 2026
CVE-2026-63280 CVE record

CVSS 8.8 High

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager
- regularlabs.com Advanced Module Manager extension for Joomla
- regularlabs.com Conditional Content extension for Joomla
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 22 Jul 2026
CVE-2026-64791 CVE record

CVSS 8.8 High

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager
- regularlabs.com Regular Labs Extension Manager extension for Joomla
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 22 Jul 2026
CVE-2026-63684 CVE record

CVSS 8.8 High

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension
- regularlabs.com Content Templater extension for Joomla
- regularlabs.com ReReplacer extension for Joomla
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 22 Jul 2026
CVE-2026-62563 CVE record

CVSS 5.4 Medium

Open redirect in Oracle Corporation Oracle Work in Process
- Oracle Corporation Oracle Work in Process
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-62487 CVE record

CVSS 6.1 Medium

Cross-site request forgery in Oracle Corporation Oracle Contracts Integration
- Oracle Corporation Oracle Contracts Integration
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-62443 CVE record

CVSS 7.1 High

Cross-site request forgery in Oracle Corporation Oracle Contracts Integration
- Oracle Corporation Oracle Contracts Integration
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-61253 CVE record

CVSS 5.4 Medium

Cross-site request forgery in Oracle Corporation Oracle HRMS (Japanese)
- Oracle Corporation Oracle HRMS (Japanese)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-61217 CVE record

CVSS 6.4 Medium

Authentication bypass by spoofing in Oracle Corporation Oracle Security Service
- Oracle Corporation Oracle Security Service
- Broken access control
- Authentication bypass
Not analysed yet 21 Jul 2026
CVE-2026-61204 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Improper access control in Oracle Corporation PeopleSoft Enterprise FIN Program Management
- Oracle Corporation PeopleSoft Enterprise FIN Program Management
- Privilege escalation
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-61132 CVE record

CVSS 7.6 High

Cross-site request forgery in Oracle Corporation Oracle Commerce Platform
- Oracle Corporation Oracle Commerce Platform
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-61101 CVE record

CVSS 8.2 High

Cross-site request forgery in Oracle Corporation Oracle MES for Process Manufacturing
- Oracle Corporation Oracle MES for Process Manufacturing
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-61097 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Open redirect in Oracle Corporation Oracle Banking Trade Finance Process Management
- Oracle Corporation Oracle Banking Trade Finance Process Management
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-61082 CVE record

CVSS 6.5 Medium

Open redirect in Oracle Corporation MySQL Connectors
- Oracle Corporation MySQL Connectors
- Information disclosure
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-60962 CVE record

CVSS 5.4 Medium

Improper access control in Oracle Corporation Oracle Flow Manufacturing
- Oracle Corporation Oracle Flow Manufacturing
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60957 CVE record

CVSS 5.4 Medium

Open redirect in Oracle Corporation Oracle Transportation Execution
- Oracle Corporation Oracle Transportation Execution
- Privilege escalation
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-60911 CVE record

CVSS 5.4 Medium

Open redirect in Oracle Corporation Oracle Property Manager
- Oracle Corporation Oracle Property Manager
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60886 CVE record

CVSS 7.6 High

Improper authorization in Oracle Corporation Oracle Work in Process
- Oracle Corporation Oracle Work in Process
- Information disclosure
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-60842 CVE record

CVSS 6.1 Medium

Open redirect in Oracle Corporation Oracle Knowledge Management
- Oracle Corporation Oracle Knowledge Management
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60685 CVE record

CVSS 6.1 Medium

Open redirect in Oracle Corporation Oracle iSupport
- Oracle Corporation Oracle iSupport
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60664 CVE record

CVSS 8.8 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60658 CVE record

CVSS 7.5 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site request forgery (CSRF)
- Open redirect
Not analysed yet 21 Jul 2026
CVE-2026-60650 CVE record

CVSS 8.0 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60648 CVE record

CVSS 8.0 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Weak cryptography or TLS
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60646 CVE record

CVSS 8.0 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60643 CVE record

CVSS 8.0 High

Cross-site request forgery in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60642 CVE record

CVSS 7.6 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60640 CVE record

CVSS 8.3 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site request forgery (CSRF)
- Open redirect
Not analysed yet 21 Jul 2026
CVE-2026-60639 CVE record

CVSS 8.8 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60638 CVE record

CVSS 8.8 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60637 CVE record

CVSS 8.8 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60636 CVE record

CVSS 8.8 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60635 CVE record

CVSS 8.8 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60634 CVE record

CVSS 8.8 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60633 CVE record

CVSS 8.8 High

Open redirect in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-60631 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Improper access control in Oracle Corporation Oracle WebCenter Content
- Oracle Corporation Oracle WebCenter Content
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026