Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-3903 CVE record

CVSS 4.3 Medium

Modular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth
- modulards Modular DS: Monitor, update, and backup multiple websites
- Cross-site request forgery (CSRF)
Not analysed yet 11 Mar 2026
CVE-2026-2626 CVE record

CVSS 8.1 High

Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection
- divi-booster
- Cross-site request forgery (CSRF)
- Insecure deserialization
Not analysed yet 11 Mar 2026
CVE-2026-2324 CVE record

CVSS 6.1 Medium

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site request forgery (CSRF)
Not analysed yet 11 Mar 2026
CVE-2026-28495 CVE record

CVSS 9.7 CriticalCritical · CVSS 9+

GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php
- GetSimpleCMS-CE
- Cross-site request forgery (CSRF)
Not analysed yet 10 Mar 2026
craftcms/cms Packagist

CVSS 2.3 Low

Craft CMS has a potential information disclosure vulnerability in preview tokens
- Authentication bypass
- Cross-site request forgery (CSRF)
>=4.0.0-RC1, <4.17.3 || >=5.0.0-RC1, <5.9.7 · fixed in 4.17.3, 5.9.7

GHSA-vg3j-hpm9-8v5v · CVE-2026-29113 Not analysed yet 10 Mar 2026
CVE-2026-1508 CVE record

CVSS 4.3 Medium

Court Reservation < 1.10.9 - Event Deletion via CSRF
- Court Reservation
- Cross-site request forgery (CSRF)
Not analysed yet 10 Mar 2026
CVE-2026-28281 CVE record

CVSS 7.1 High

InstantCMS has Multiple CSRF Vulnerabilities
- instantsoft icms2
- Cross-site request forgery (CSRF)
Not analysed yet 9 Mar 2026
CVE-2025-70031 CVE record

CVSS 8.8 High

An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
- Cross-site request forgery (CSRF)
Not analysed yet 9 Mar 2026
CVE-2026-3770 CVE record

CVSS 5.3 Medium

SourceCodester Computer Laboratory Management System cross-site request forgery
- SourceCodester Computer Laboratory Management System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 8 Mar 2026
CVE-2026-1087 CVE record

CVSS 4.3 Medium

The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update
- openplatform The Guardian News Feed
- Cross-site request forgery (CSRF)
Not analysed yet 7 Mar 2026
CVE-2026-1086 CVE record

CVSS 4.3 Medium

Font Pairing Preview For Landing Pages <= 1.3 - Cross-Site Request Forgery to Settings Update
- wpsolutions Font Pairing Preview For Landing Pages
- Cross-site request forgery (CSRF)
Not analysed yet 7 Mar 2026
CVE-2026-1085 CVE record

CVSS 4.3 Medium

True Ranker <= 2.2.9 - Cross-Site Request Forgery to Unauthorized True Ranker Disconnection
- optimizza True Ranker
- Cross-site request forgery (CSRF)
Not analysed yet 7 Mar 2026
CVE-2026-1073 CVE record

CVSS 4.3 Medium

Purchase Button For Affiliate Link <= 1.0.2 - Cross-Site Request Forgery to Settings Update
- themepul Purchase Button For Affiliate Link
- Cross-site request forgery (CSRF)
Not analysed yet 7 Mar 2026
CVE-2026-2494 CVE record

CVSS 4.3 Medium

ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial
- metagauss ProfileGrid – User Profiles, Groups and Communities
- Cross-site request forgery (CSRF)
Not analysed yet 7 Mar 2026
CVE-2026-1644 CVE record

CVSS 4.3 Medium

WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection
- glowlogix WP Frontend Profile
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2018-25200 CVE record

CVSS 6.9 Medium

OOP CMS BLOG 1.0 Cross-Site Request Forgery via addUser.php
- Zsoft OOP CMS BLOG
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2018-25190 CVE record

CVSS 6.9 Medium

Easyndexer 1.0 Cross-Site Request Forgery via createuser.php
- Sourceforge Easyndexer
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2018-25186 CVE record

CVSS 6.9 Medium

Tina4 Stack 1.0.3 Cross-Site Request Forgery via profile
- Tina4 Stack
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2018-25177 CVE record

CVSS 6.9 Medium

Data Center Audit 2.6.2 Cross-Site Request Forgery via dca_resetpw.php
- Sourceforge Data Center Audit
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2018-25176 CVE record

CVSS 8.8 High

Alive Parish 2.0.4 SQL Injection and Arbitrary File Upload
- Demo Alive Parish
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2018-25174 CVE record

CVSS 6.9 Medium

ABC ERP 0.6.4 Cross-Site Request Forgery via _configurar_perfil.php
- Abc-Erp ABC ERP
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2018-25170 CVE record

CVSS 8.8 High

DoceboLMS 1.2 SQL Injection via lesson.php
- Spaghettilearning DoceboLMS
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2026-1468 CVE record

CVSS 5.1 Medium

Cross-Site Request Forgery in QuickCMS
- OpenSolution QuickCMS
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2026-3589 CVE record

CVSS 7.5 High

WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
- Automattic WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2026-1128 CVE record

CVSS 4.3 Medium

WP eCommerce <= 3.15.1 - Coupon Deletion via CSRF
- WP eCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2025-59541 CVE record

CVSS 8.1 High

Chamilo: CSRF Vulnerability in Project Deletion
- chamilo-lms
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
github.com/forceu/gokapi Go

CVSS 4.6 Medium

Gokapi has CSRF in Login Endpoint
- Cross-site request forgery (CSRF)
<2.2.3 · fixed in 2.2.3

GHSA-hcff-qv74-7hr4 · CVE-2026-29084 Not analysed yet 5 Mar 2026
mercurius npm

CVSS 5.4 Medium

Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
- Cross-site request forgery (CSRF)
<16.4.0 · fixed in 16.4.0

GHSA-v66j-6wwf-jc57 · CVE-2025-64166 Not analysed yet 5 Mar 2026
CVE-2026-30793 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
- rustdesk-client RustDesk Client
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 5 Mar 2026
ghost npm

CVSS 7.5 High

Ghost has incomplete CSRF protections around OTC use
- Cross-site request forgery (CSRF)
>=5.101.6, <6.19.3 · fixed in 6.19.3

GHSA-9m84-wc28-w895 · CVE-2026-29784 Not analysed yet 5 Mar 2026
concrete5/concrete5 Packagist

CVSS 2.3 Low

Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)
- Cross-site request forgery (CSRF)
<9.4.8 · fixed in 9.4.8

GHSA-6mxw-2vhf-42g5 · CVE-2026-2994 Not analysed yet 4 Mar 2026
CVE-2021-35486 CVE record

CVSS 8.1 High

A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the entire application configuration.
- Cross-site request forgery (CSRF)
Not analysed yet 3 Mar 2026
CVE-2026-27758 CVE record

CVSS 5.1 Medium

SODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF Protections
- Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) SODOLA SL902-SWTGW124AS
- Cross-site request forgery (CSRF)
Not analysed yet 27 Feb 2026
parse-dashboard npm

CVSS 8.3 High

Parse Dashboard is Missing CSRF Protection for its Agent Endpoint
- Cross-site request forgery (CSRF)
>=7.3.0-alpha.42, <9.0.0-alpha.8 · fixed in 9.0.0-alpha.8

GHSA-3534-xp88-25rc · CVE-2026-27609 Not analysed yet 25 Feb 2026
CVE-2026-3193 CVE record

CVSS 2.3 Low

Chia Blockchain send_transaction cross-site request forgery
- Chia Blockchain
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 25 Feb 2026
CVE-2026-2410 CVE record

CVSS 4.3 Medium

Disable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update
- themeisle Disable Admin Notices – Hide Dashboard Notifications
- Cross-site request forgery (CSRF)
Not analysed yet 25 Feb 2026
CVE-2026-27632 CVE record

CVSS 2.6 Low

Talishar Vulnerable to Cross-Site Request Forgery (CSRF)
- Talishar
- Cross-site request forgery (CSRF)
Not analysed yet 25 Feb 2026
github.com/caddyserver/caddy/v2 Go

CVSS 6.9 Medium

Caddy is vulnerable to cross-origin config application via local admin API /load
- Cross-site request forgery (CSRF)
<2.11.1 · fixed in 2.11.1

GHSA-879p-475x-rqh2 · CVE-2026-27589 Not analysed yet 24 Feb 2026
CVE-2026-27518 CVE record

CVSS 5.1 Medium

Binardat 10G08-0800GSM Network Switch CSRF
- Binardat Ltd. 10G08-0800GSM Network Switch
- Cross-site request forgery (CSRF)
Not analysed yet 24 Feb 2026
CVE-2026-27741 CVE record

CVSS 5.1 Medium

Bludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints
- Bludit
- Cross-site request forgery (CSRF)
Not analysed yet 23 Feb 2026
CVE-2026-25649 CVE record

CVSS 7.3 High

Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints
- traccar
- Cross-site request forgery (CSRF)
- Open redirect
Not analysed yet 23 Feb 2026
CVE-2026-23694 CVE record

CVSS 5.1 Medium

Aruba HiSpeed Cache < 3.0.5 CSRF in Multiple Administrative AJAX Actions
- Aruba.it Aruba HiSpeed Cache
- Cross-site request forgery (CSRF)
Not analysed yet 23 Feb 2026
CVE-2026-27513 CVE record

CVSS 5.1 Medium

Tenda F3 CSRF in Web Management Interface
- Shenzhen Tenda Technology Co., Ltd. Tenda F3
- Cross-site request forgery (CSRF)
Not analysed yet 23 Feb 2026
CVE-2026-27146 CVE record

CVSS 7.1 High

GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads
- GetSimpleCMS-CE
- Cross-site request forgery (CSRF)
- Unrestricted file upload
Not analysed yet 20 Feb 2026
CVE-2019-25447 CVE record

CVSS 5.3 Medium

OrientDB 3.0.17 Cross-Site Request Forgery
- OrientDB
- Cross-site request forgery (CSRF)
Not analysed yet 20 Feb 2026
CVE-2025-13671 CVE record

CVSS 5.9 Medium

Cross Site request forgery vulnerability discovered in OpenText WSM Management Server.
- OpenText™ Web Site Management Server
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2026-27090 CVE record

CVSS 4.3 Medium

WordPress Kenta Companion plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability
- WP Moose Kenta Companion
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2026-27050 CVE record

CVSS 5.4 Medium

WordPress RealPress plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- ThimPress RealPress
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2026-25422 CVE record

CVSS 5.4 Medium

WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability
- Themes4WP Popularis Extra
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2026-25411 CVE record

CVSS 4.3 Medium

WordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability
- themastercut Revision Manager TMC
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2026-25337 CVE record

CVSS 5.4 Medium

WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- Coachify
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2026-25322 CVE record

CVSS 5.4 Medium

WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability
- PublishPress Revisions
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2026-25319 CVE record

CVSS 4.3 Medium

WordPress Zita Elementor Site Library plugin <= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerability
- wpzita Zita Elementor Site Library
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2026-1455 CVE record

CVSS 4.3 Medium

Whatsiplus Scheduled Notification for Woocommerce <= 1.0.1 - Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action
- Whatsiplus Scheduled Notification for Woocommerce
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2025-14167 CVE record

CVSS 4.3 Medium

Remove Post Type Slug <= 1.0.2 - Cross-Site Request Forgery to Settings Update
- akshayshah5189 Remove Post Type Slug
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2025-13438 CVE record

CVSS 4.3 Medium

Page Title, Description & Open Graph Updater <= 1.02 - Cross-Site Request Forgery to Arbitrary Page Title Modification
- dienodigital Page Title, Description & Open Graph Updater
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2025-13413 CVE record

CVSS 4.3 Medium

Country Blocker for AdSense <= 1.0 - Cross-Site Request Forgery to Settings Update
- soyrodriguez Country Blocker for AdSense
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2025-12821 CVE record

CVSS 8.8 High

NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation
- spicethemes NewsBlogger
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2025-12172 CVE record

CVSS 4.3 Medium

Mailchimp List Subscribe Form <= 2.0.0 - Cross-Site Request Forgery to Mailchimp List Change
- Mailchimp List Subscribe Form
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2026
CVE-2019-25359 CVE record

CVSS 8.8 High

SD.NET RIM 4.7.3c - 'idtyp' SQL Injection
- Sitzungsdienst SD.NET RIM
- Cross-site request forgery (CSRF)
Not analysed yet 18 Feb 2026