Advisories · Weakness
Cross-site request forgery (CSRF).
A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.1 High
Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125
- Drupal Acquia Content Hub
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120
- Drupal Login Time Restriction
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Stop Spammers Classic <= 2026.1 - Cross-Site Request Forgery via Email Allowlist
- webguyio Stop Spammers Classic
- Cross-site request forgery (CSRF)
- CVSS 8.5 High
authenticated reflected XSS vulnerability in Sync Breeze Enterprise Server
- Flexense Sync Breeze Enterprise Server
- Flexense Disk Pulse Enterprise
- Cross-site request forgery (CSRF)
- CVSS 8.5 High
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
- Flexense Sync Breeze Enterprise Server
- Flexense Disk Pulse Enterprise
- Cross-site request forgery (CSRF)
- CVSS 8.5 High
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
- Flexense Sync Breeze Enterprise Server
- Flexense Disk Pulse Enterprise
- Cross-site request forgery (CSRF)
- CVSS 8.5 High
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
- Flexense Sync Breeze Enterprise Server
- Flexense Disk Pulse Enterprise
- Cross-site request forgery (CSRF)
- CVSS 8.5 High
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
- Flexense Sync Breeze Enterprise Server
- Flexense Disk Pulse Enterprise
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Change WP URL <= 1.0 - Cross-Site Request Forgery to Settings Update
- chrisnowak Change WP URL
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Recooty <= 1.0.6 - Cross-Site Request Forgery to Settings Update
- Recooty – Job Widget (Old Dashboard)
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Bitcoin Donate Button <= 1.0 - Cross-Site Request Forgery to Settings Update
- lxicon Bitcoin Donate Button
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
imwptip <= 1.1 - Cross-Site Request Forgery to Settings Update
- hu_chao imwptip
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
CSS-based exfiltration of the content from partially encrypted emails when allowing remote content
- Mozilla Thunderbird
- Information disclosure
- Cross-site request forgery (CSRF)
- CVSS 0.0 None
sigstore CSRF possibility in OIDC authentication during signing
- Cross-site request forgery (CSRF)
<4.2.0 · fixed in 4.2.0
GHSA-hm8f-75xx-w2vr · CVE-2026-24408 - CVSS 5.1 Medium
Tenda W30E V2 Missing CSRF Protections for Administrative Actions
- Shenzhen Tenda Technology Co., Ltd. W30E V2
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloning
- devsoftbaltic SurveyJS: Drag & Drop Form Builder
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renaming
- devsoftbaltic SurveyJS: Drag & Drop Form Builder
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update
- mainichiweb Friendly Functions for Welcart
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey Creation
- devsoftbaltic SurveyJS: Drag & Drop Form Builder
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
AdminQuickbar <= 1.9.3 - Cross-Site Request Forgery to Settings Update
- rtowebsites AdminQuickbar
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Moderate Selected Posts <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update
- hallsofmontezuma Moderate Selected Posts
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Login Page Editor <= 1.2 - Cross-Site Request Forgery to Settings Update
- zero1zerouk Login Page Editor
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
ZT Captcha <= 1.0.4 - Cross-Site Request Forgery to Settings Update
- teamzt ZT Captcha
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Set Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update
- sauravrox Set Bulk Post Categories
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Star Review Manager <= 1.2.2 - Cross-Site Request Forgery to Settings Update
- bramdnl Star Review Manager
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WP Youtube Video Gallery <= 1.0 - Cross-Site Request Forgery to Plugin Settings Update
- waqasvickey0071 WP Youtube Video Gallery
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Alex User Counter <= 6.0 - Cross-Site Request Forgery to Settings Update
- adzbierajewski Alex User Counter
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Simple Crypto Shortcodes <= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Update
- stefanristic Simple Crypto Shortcodes
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Related Posts Thumbnails plugin for WordPress plugin <= 4.3.2 - Cross Site Request Forgery (CSRF) vulnerability
- marynixie Related Posts Thumbnails Plugin for WordPress
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress GeoDirectory plugin <= 2.8.149 - Cross Site Request Forgery (CSRF) vulnerability
- Paolo GeoDirectory
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress WP Term Order plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- John James Jacoby WP Term Order
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Kama Thumbnail plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability
- Timur Kamaev Kama Thumbnail
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Wordpress Movies Bulk Importer plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability
- AA-Team Wordpress Movies Bulk Importer
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
WordPress Merge + Minify + Refresh plugin <= 2.14 - Cross Site Request Forgery (CSRF) vulnerability
- launchinteractive Merge + Minify + Refresh
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
WordPress RegistrationMagic plugin <= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerability
- Metagauss RegistrationMagic
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
WordPress Stock Manager for WooCommerce plugin < 3.6.0 - Cross Site Request Forgery (CSRF) vulnerability
- storeapps Stock Manager for WooCommerce
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
WordPress teachPress plugin <= 9.0.12 - Cross Site Request Forgery (CSRF) vulnerability
- winkm89 teachPress
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Add Polylang support for Customizer plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability
- richardevcom Add Polylang support for Customizer
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability
- Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress SearchAzon plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
- AA-Team SearchAzon
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
WordPress Simple XML Sitemap plugin <= 1.3 - CSRF to Stored XSS vulnerability
- gregmolnar Simple XML Sitemap
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress WP SEO Search plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability
- Angel Costa WP SEO Search
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
WordPress Element Pack Elementor Addons plugin <= 8.3.13 - Cross Site Request Forgery (CSRF) vulnerability
- bdthemes Element Pack Elementor Addons
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms.
- Cross-site request forgery (CSRF)
- CVSS 8.5 High
GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE
- GetSimple CMS Custom JS Plugin
- Cross-site request forgery (CSRF)
- CVSS 5.1 Medium
GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF
- GetSimple CMS My SMTP Contact Plugin
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
- Cross-site request forgery (CSRF)
- Race condition
<7.5.4 · fixed in 7.5.4
GHSA-r6q2-hw4h-h46w · CVE-2026-23950 - CVSS 3.5 Low
Multiple vulnerabilities found in IBM ApplinX.
- IBM ApplinX
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription
- satollo Newsletter – Send awesome emails from WordPress
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
birkir prime cross-site request forgery
- birkir prime
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 5.3 Medium
technical-laohu mpay cross-site request forgery
- technical-laohu mpay
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 5.3 Medium
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System cross-site request forgery
- SourceCodester Patients Waiting Area Queue Management System
- Patrick Mvuma Patients Waiting Area Queue Management System
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 5.3 Medium
PHPGurukul News Portal cross-site request forgery
- PHPGurukul News Portal
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 5.1 Medium
Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF)
- Ubeeinteractive Ubee EVW327
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
LEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Update
- smings LEAV Last Email Address Validator
- Cross-site request forgery (CSRF)
- CVSS 6.9 Medium
b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)
- b2evolution
- Cross-site request forgery (CSRF)
- CVSS 7.4 High
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass
- Cross-site request forgery (CSRF)
<=1.5.2 · no fixed version yet
GHSA-54v4-4685-vwrj · CVE-2026-23622 - CVSS 6.9 Medium
Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)
- Arunna
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Stopwords for comments <= 1.1 - Missing Authorization to Cross-Site Request Forgery
- rndsand81 Stopwords for comments
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
SocialChamp with WordPress <= 1.3.5 - Cross-Site Request Forgery to Plugin Settings Update
- socialchampio Auto Post to Social Media from Social Champ
- Cross-site request forgery (CSRF)