Filtered by CWE-352
Filtered by vendor Subscriptions
Total 9317 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-3406 1 Goprayer 1 Wp Prayer 2026-01-10 8.8 High
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-12774 1 Pulseextensions 1 Altra Side Menu 2026-01-10 6.5 Medium
The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary menu via a CSRF attack
CVE-2023-6503 1 Paulgriffinpetty 1 Wp Plugin Lister 2026-01-10 5.4 Medium
The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2021-24870 1 Wpfastestcache 1 Wp Fastest Cache 2026-01-10 6.1 Medium
The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitise and escape some the options available via the action, which could allow attackers to make logged in high privilege users call it and set a Cross-Site Scripting payload
CVE-2023-6845 1 Theresehansen 1 Commenttweets 2026-01-10 8.8 High
The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVE-2024-27783 1 Fortinet 1 Fortiaiops 2026-01-09 7.2 High
Multiple cross-site request forgery (CSRF) weaknesses [CWE-352] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user via tricking the victim to execute malicious GET requests.
CVE-2023-28688 2 Themehunk, Wordpress 2 Variation Swatches, Wordpress 2026-01-09 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.
CVE-2024-23554 1 Hcltech 1 Bigfix Platform 2026-01-08 5.7 Medium
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).
CVE-2024-31205 1 Saleor 1 Saleor 2026-01-07 4.2 Medium
Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace `saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token`. This will fix the issue, but be aware, that it returns `JWT_MISSING_TOKEN` instead of `JWT_INVALID_TOKEN`.
CVE-2024-34809 2 Extendthemes, Wordpress 2 Empowerwp, Wordpress 2026-01-07 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes EmpowerWP.This issue affects EmpowerWP: from n/a through 1.0.21.
CVE-2022-47443 1 Danielpowney 1 Multi Rating 2026-01-07 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.
CVE-2023-50931 1 Savignano 1 S-notify 2026-01-06 8.3 High
An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Bitbucket, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
CVE-2023-50932 1 Savignano 1 S-notify 2026-01-06 8.3 High
An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Confluence, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
CVE-2024-6719 2 Webgarh, Wordpress 2 Offload Videos, Wordpress 2026-01-05 8.1 High
The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack
CVE-2025-65203 1 Keepassxc 1 Keepassxc-browser 2026-01-05 7.1 High
KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlled script in the sandboxed document to access populated form fields and exfiltrate credentials.
CVE-2024-30855 1 Dedecms 1 Dedecms 2026-01-05 8.8 High
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.
CVE-2025-35030 2 Medical Informatics Engineering, Mieweb 2 Enterprise Health, Enterprise Health 2026-01-02 8.1 High
Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08.
CVE-2024-6230 2 Wordpress, Wp-master 2 Wordpress, Pardakht-delkhah 2026-01-02 6.5 Medium
The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CVE-2024-2232 1 2code 1 Himer 2026-01-02 8.1 High
The lacks CSRF checks allowing a user to invite any user to any group (including private groups)
CVE-2025-66906 2 Turms, Turms-im 2 Admin Api, Turms 2026-01-02 6.1 Medium
Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows attackers to gain escalated privileges.