Filtered by CWE-352
Filtered by vendor Subscriptions
Total 8012 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-53249 2 Hakeemnala, Wordpress 2 Build App Online, Wordpress 2025-08-15 6.5 Medium
Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online allows Cross Site Request Forgery. This issue affects Build App Online: from n/a through 1.0.23.
CVE-2025-53347 2 Laborator, Wordpress 2 Kalium, Wordpress 2025-08-15 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium allows Cross Site Request Forgery. This issue affects Kalium: from n/a through 3.18.3.
CVE-2025-52765 2 Lisensee, Wordpress 2 Netinsight Analytics Implementation Plugin, Wordpress 2025-08-15 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin allows Stored XSS. This issue affects NetInsight Analytics Implementation Plugin: from n/a through 1.0.3.
CVE-2025-49044 1 Wordpress 1 Wordpress 2025-08-14 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in tosend.it Simple Poll allows Stored XSS. This issue affects Simple Poll: from n/a through 1.1.1.
CVE-2025-54673 2 Ays-pro, Wordpress 2 Chartify, Wordpress 2025-08-14 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify allows Cross Site Request Forgery. This issue affects Chartify: from n/a through 3.5.3.
CVE-2025-54671 2 Bobbingwide, Wordpress 2 Oik, Wordpress 2025-08-14 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide oik allows Cross Site Request Forgery. This issue affects oik: from n/a through 4.15.2.
CVE-2025-54682 1 Wordpress 1 Wordpress 2025-08-14 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets allows Cross Site Request Forgery. This issue affects Connector for Gravity Forms and Google Sheets: from n/a through 1.2.4.
CVE-2025-54694 2 Bplugins, Wordpress 2 Button Block, Wordpress 2025-08-14 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block allows Cross Site Request Forgery. This issue affects Button Block: from n/a through 1.2.0.
CVE-2025-8491 2 Nikelschubert, Wordpress 2 Easy Restaurant Menu Manager Plugin, Wordpress 2025-08-14 4.3 Medium
The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsc_eprm_save_menu() function. This makes it possible for unauthenticated attackers to upload a menu file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2025-8891 2 Oceanwp, Wordpress 2 Oceanwp Plugin, Wordpress 2025-08-14 4.3 Medium
The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwp_notice_button_click() function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2025-5988 1 Redhat 2 Ansible Automation Platform, Ansible Automation Platform Developer 2025-08-13 5.3 Medium
A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.
CVE-2025-3150 1 Itning 1 Student-homework-management-system 2025-08-13 4.3 Medium
A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected.
CVE-2025-8814 1 Atjiu 1 Pybbs 2025-08-12 4.3 Medium
A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 8aa2bb1aef3346e49aec6358edf5e47ce905ae7b. It is recommended to apply a patch to fix this issue.
CVE-2024-12279 2 Wordpress, Wp Social Autoconnect Project 2 Wordpress, Wp Social Autoconnect 2025-08-12 6.1 Medium
The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2024-13518 1 Simplepress 1 Simplepress 2025-08-12 4.3 Medium
The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.11. This is due to missing or incorrect nonce validation on the 'sp_save_edited_post' function. This makes it possible for unauthenticated attackers to modify a forum post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2025-31482 1 Freshrss 1 Freshrss 2025-08-12 4.3 Medium
FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively causing that user to suffer denial of service. Version 1.26.2 contains a patch for the issue.
CVE-2025-8739 1 My-blog Project 1 My-blog 2025-08-12 4.3 Medium
A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /admin/tags/save. The manipulation of the argument tagName leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-4994 1 Gitlab 1 Gitlab 2025-08-12 8.1 High
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations.
CVE-2025-22963 1 Sismics 1 Teedy 2025-08-12 7.5 High
Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.
CVE-2020-9322 1 Statamic 1 Statamic 2025-08-12 8.8 High
The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account registration. Reflected XSS can occur via the /users PATH_INFO.