Filtered by CWE-352
Filtered by vendor Subscriptions
Total 8331 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-54404 1 Wordpress 1 Wordpress 2025-07-13 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Nazmul Ahsan MDC Comment Toolbar allows Stored XSS.This issue affects MDC Comment Toolbar: from n/a through 1.1.
CVE-2025-31393 1 Wordpress 1 Wordpress 2025-07-13 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in vfvalent Social Bookmarking RELOADED allows Stored XSS. This issue affects Social Bookmarking RELOADED: from n/a through 3.18.
CVE-2024-56140 1 Withastro 1 Astro 2025-07-13 5.9 Medium
Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the `security.checkOrigin` configuration option is set to `true`, Astro middleware will perform a CSRF check. However, a vulnerability exists that can bypass this security. A semicolon-delimited parameter is allowed after the type in `Content-Type`. Web browsers will treat a `Content-Type` such as `application/x-www-form-urlencoded; abc` as a `simple request` and will not perform preflight validation. In this case, CSRF is not blocked as expected. Additionally, the `Content-Type` header is not required for a request. This issue has been addressed in version 4.16.17 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-54418 1 Wordpress 1 Wordpress 2025-07-13 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Diversified Technology Corp., WPYog, and Gagan Deep Singh DTC Documents allows Cross Site Request Forgery.This issue affects DTC Documents: from n/a through 1.1.05.
CVE-2024-5804 1 Wordpress 1 Wordpress 2025-07-13 4.3 Medium
The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This is due to missing or incorrect nonce validation on the wpcf7cf_admin_init function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2025-23511 1 Wordpress 1 Wordpress 2025-07-13 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Viktoria Rei Bauer WP-BlackCheck allows Stored XSS.This issue affects WP-BlackCheck: from n/a through 2.7.2.
CVE-2025-30546 1 Wordpress 1 Wordpress 2025-07-13 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in boroV Cackle allows Cross Site Request Forgery. This issue affects Cackle: from n/a through 4.33.
CVE-2025-31845 1 Wordpress 1 Wordpress 2025-07-13 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rohit Choudhary Theme Duplicator allows Cross Site Request Forgery. This issue affects Theme Duplicator: from n/a through 1.1.
CVE-2025-30556 1 Wordpress 1 Wordpress 2025-07-13 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds allows Cross Site Request Forgery. This issue affects Fix Rss Feeds: from n/a through 3.1.
CVE-2025-30568 1 Wordpress 1 Wordpress 2025-07-13 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in hitoy Super Static Cache allows Cross Site Request Forgery. This issue affects Super Static Cache: from n/a through 3.3.5.
CVE-2025-32546 1 Wordpress 1 Wordpress 2025-07-13 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in gtlwpdev All push notification for WP allows Reflected XSS. This issue affects All push notification for WP: from n/a through 1.5.3.
CVE-2025-22563 1 Wordpress 1 Wordpress 2025-07-13 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Faaiq Pretty Url allows Cross Site Request Forgery.This issue affects Pretty Url: from n/a through 1.5.4.
CVE-2024-51649 1 Wordpress 1 Wordpress 2025-07-13 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Patrick Lumumba Mobilize allows Stored XSS.This issue affects Mobilize: from n/a through 3.0.7.
CVE-2025-2935 1 Wordpress 1 Wordpress 2025-07-13 5.4 Medium
The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ss_option_maint.php' and 'ss_user_filter_list' files. This makes it possible for unauthenticated attackers to delete pending comments, and re-enable a previously blocked user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2025-31458 1 Wordpress 1 Wordpress 2025-07-13 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in forsgren Video Embedder allows Stored XSS. This issue affects Video Embedder: from n/a through 1.7.1.
CVE-2025-23560 1 Wordpress 1 Wordpress 2025-07-13 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Elke Hinze, Plumeria Web Design Web Testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through 1.2.
CVE-2025-25088 1 Wordpress 1 Wordpress 2025-07-13 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor allows Stored XSS. This issue affects WP Keyword Monitor: from n/a through 1.0.5.
CVE-2025-23471 1 Wordpress 1 Wordpress 2025-07-13 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Andy Chapman ECT Add to Cart Button allows Stored XSS.This issue affects ECT Add to Cart Button: from n/a through 1.4.
CVE-2025-23797 1 Wordpress 1 Wordpress 2025-07-13 9.8 Critical
Cross-Site Request Forgery (CSRF) vulnerability in Mike Selander WP Options Editor allows Privilege Escalation.This issue affects WP Options Editor: from n/a through 1.1.
CVE-2025-32482 1 Wordpress 1 Wordpress 2025-07-13 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in quanganhdo Custom Smilies allows Stored XSS. This issue affects Custom Smilies: from n/a through 1.2.