CVE-2026-81426

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

CVE-2026-81432

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the editposts capability Contributor and above delete or modify custom widget skins via a crafted request, provided they can...

CVE-2026-81432 JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the editposts capability Contributor and above delete or modify custom widget skins via a crafted request, provided they can...

CVE-2026-81426 WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

CVE-2026-81426

The WC Vendors WordPress plugin, in versions prior to 2.7.2.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF protection on specific front-end order shipment status actions. This flaw could allow an attacker to force a logged-in vendor to modify the...

EUVD-2026-69856

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the editposts capability Contributor and above delete or modify custom widget skins via a crafted request, provided they can...

EUVD-2026-69853

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

CVE-2026-81426 WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

CVE-2026-81432 JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the editposts capability Contributor and above delete or modify custom widget skins via a crafted request, provided they can...

PT-2026-84699

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

PT-2026-84697

Name of the Vulnerable Software and Affected Versions Activity Log versions prior to 2.13.2 Description An unauthenticated Cross Site Request Forgery CSRF issue exists. CSRF is a flaw that allows an attacker to trick a victim into performing actions they did not intend to do on a web application...

PT-2026-84700

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

PT-2026-84682

Name of the Vulnerable Software and Affected Versions ThemeGoods Grand Tour versions prior to 5.5.2 Description A Cross-Site Request Forgery CSRF flaw exists in the ThemeGoods Grand Tour theme. This issue allows an attacker to induce a victim into performing unwanted actions on the affected syste...

PT-2026-84772

In Stapler 1839.ved17667b a eb 5 through 2107.v8dfcb e8ed317 both inclusive, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

PT-2026-84746

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

PT-2026-84636

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit posts capability Contributor and above delete or modify custom widget skins via a crafted request, provided they can...

PT-2026-84633

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

CVE-2026-84663: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...

CVE-2026-84649: Cross-Site Request Forgery (CSRF)

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

CVE-2026-8151: Cross-Site Request Forgery (CSRF)

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...