CVE-2026-85348 GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

CVE-2026-85348

The GDPR Data Request Form WordPress plugin (versions 1.5 through 1.7.1 ) is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists because the plugin lacks CSRF protection when updating specific settings, such as the DPO Email . An attacker can execute a forged request to modify the...

EUVD-2026-95706

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

BIT-APISIX-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-96671

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

CVE-2026-96671 WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

EUVD-2026-95611

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

CVE-2026-96671

The fifu.app Featured Image from URL WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 6.0.7 . This flaw allows an attacker to perform unauthorized actions by tricking a victim's browser into making unintended requests. The severit...

PT-2026-109306

Name of the Vulnerable Software and Affected Versions Contao versions 4.0.0 through 5.3.49 Contao versions 5.7.0 through 5.7.11 Description Cross-Site Request Forgery CSRF occurs because the RequestTokenListener function validates the REQUEST TOKEN only for POST requests. While a declarative GET...

CVE-2026-96671: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

PT-2026-109125

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

PT-2026-108863

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

PT-2026-108896

Name of the Vulnerable Software and Affected Versions Dashboard Notes versions prior to 1.0.4 Description A Cross-Site Request Forgery CSRF flaw exists in the MIGHTYminnow Dashboard Notes dashboard-notes component. This issue allows an attacker to induce a user to perform actions they did not...

PT-2026-108870

Name of the Vulnerable Software and Affected Versions GDPR Data Request Form versions prior to 1.7.2 Description The plugin lacks Cross-Site Request Forgery CSRF protection—a type of attack that forces an authenticated user to execute unwanted actions—when updating specific settings. This allows ...

CVE-2026-62026: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3...

CVE-2026-107809: Cross-Site Request Forgery (CSRF)

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-107848: Cross-Site Request Forgery (CSRF)

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

PT-2026-108963

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Nginx UI contains a cross-site request forgery CSRF flaw where the AuthRequired middleware accepts a browser-managed cookie named token as a valid API credential. Because management endpoints d...

CVE-2026-107831

The software Jivejdon (through version 5.0 ) is vulnerable to a cross-site request forgery (CSRF) vulnerability. The root cause is the presence of GET endpoints that lack anti-CSRF tokens, allowing remote attackers to perform state-changing actions. By luring authenticated users into clicking cra...

CVE-2026-107831 Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...