Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

5106 matches found

Positive Technologies
Positive Technologies•added 2026/02/19 12:00 a.m.•12 views

PT-2026-20598

Name of the Vulnerable Software and Affected Versions Country Blocker for AdSense plugin for WordPress versions prior to 1.1 Description The software is susceptible to Cross-Site Request Forgery CSRF due to the absence of nonce validation in the CBFA guardar cbfa function. This allows...

4.3CVSS5.1AI score0.00173EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies•added 2026/02/19 12:00 a.m.•16 views

PT-2026-20586

Name of the Vulnerable Software and Affected Versions NewsBlogger versions 0.2.5.6 through 0.2.6.1 Description The NewsBlogger WordPress theme is susceptible to Cross-Site Request Forgery due to inadequate nonce validation within the newsblogger install and activate plugin function. This allows...

8.8CVSS6.1AI score0.00286EPSS
SaveExploits0References6
NVD
NVD•added 2026/02/18 6:16 a.m.•11 views

CVE-2026-2023

The WP Plugin Info Card plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0. This is due to missing nonce validation in the ajaxsavecustomplugin function, which is disabled by prefixing the check with 'false &&'. This makes it possible for...

4.3CVSS0.00156EPSS
SaveExploits0References5
NVD
NVD•added 2026/02/18 6:16 a.m.•14 views

CVE-2026-1072

The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missing nonce validation when updating plugin settings. This makes it possible for unauthenticated attackers to update the Keybase verification...

4.3CVSS0.00156EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment•added 2026/02/18 5:29 a.m.•7 views

CVE-2026-1072 Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update

The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missing nonce validation when updating plugin settings. This makes it possible for unauthenticated attackers to update the Keybase verification...

4.3CVSS5.3AI score0.00156EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB•added 2026/02/18 5:29 a.m.•5 views

CVE-2026-1072

The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missing nonce validation when updating plugin settings. This makes it possible for unauthenticated attackers to update the Keybase verification...

4.3CVSS5.3AI score0.00156EPSS
SaveExploits0References5
CVE
CVE•added 2026/02/18 5:29 a.m.•32 views

CVE-2026-1072

CVE-2026-1072 concerns the WordPress Keybase.io Verification plugin (versions

4.3CVSS5.3AI score0.00156EPSS
SaveExploits0References4
Cvelist
Cvelist•added 2026/02/18 5:29 a.m.•43 views

CVE-2026-1072 Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update

The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missing nonce validation when updating plugin settings. This makes it possible for unauthenticated attackers to update the Keybase verification...

4.3CVSS0.00156EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment•added 2026/02/18 5:29 a.m.•3 views

CVE-2026-2023 WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation

The WP Plugin Info Card plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0. This is due to missing nonce validation in the ajaxsavecustomplugin function, which is disabled by prefixing the check with 'false &&'. This makes it possible for...

4.3CVSS5.4AI score0.00156EPSS
SaveExploits0References5
OSV
OSV•added 2026/02/18 5:29 a.m.•8 views

CVE-2026-2023 WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation

The WP Plugin Info Card plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0. This is due to missing nonce validation in the ajaxsavecustomplugin function, which is disabled by prefixing the check with 'false &&'. This makes it possible for...

4.3CVSS5.8AI score
SaveExploits0References7
ATTACKERKB
ATTACKERKB•added 2026/02/18 5:29 a.m.•11 views

CVE-2026-2023

The WP Plugin Info Card plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0. This is due to missing nonce validation in the ajaxsavecustomplugin function, which is disabled by prefixing the check with 'false &&'. This makes it possible for...

4.3CVSS5.4AI score0.00156EPSS
SaveExploits0References6
CVE
CVE•added 2026/02/18 5:29 a.m.•42 views

CVE-2026-2023

CVE-2026-2023: WP Plugin Info Card for WordPress was affected by a CSRF vulnerability up to version 6.2.0 due to missing nonce validation in ajax_save_custom_plugin(), allowing unauthenticated attackers to forge requests that create or modify custom plugin entries if a site admin is enticed to pe...

4.3CVSS5.4AI score0.00156EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies•added 2026/02/18 12:00 a.m.•17 views

PT-2026-20272

The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missing nonce validation when updating plugin settings. This makes it possible for unauthenticated attackers to update the Keybase verification...

4.3CVSS5.3AI score0.00156EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE•added 2026/02/15 7:10 a.m.•18 views

CVE-2026-1983

The SEATT: Simple Event Attendance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing nonce validation on the event deletion functionality. This makes it possible for unauthenticated attackers to delete arbitrary...

4.3CVSS5.7AI score0.00124EPSS
SaveExploits0References1
CVE
CVE•added 2026/02/14 6:42 a.m.•24 views

CVE-2026-1394

The CVE-2026-1394 entry concerns the WordPress plugin WP Quick Contact Us. Public details in the initial description state a Cross-Site Request Forgery vulnerability in versions up to 1.0 due to missing nonce validation on the settings update function, enabling unauthenticated attackers to trigge...

4.3CVSS5.4AI score0.00153EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2026/02/14 6:42 a.m.•4 views

CVE-2026-1394 WP Quick Contact Us <= 1.0 - Cross-Site Request Forgery to Settings Update

The WP Quick Contact Us plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings vi...

4.3CVSS5.4AI score0.00153EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2026/02/14 4:35 a.m.•6 views

CVE-2026-1983 SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion

The SEATT: Simple Event Attendance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing nonce validation on the event deletion functionality. This makes it possible for unauthenticated attackers to delete arbitrary...

4.3CVSS5.7AI score0.00124EPSS
SaveExploits0References3
CVE
CVE•added 2026/02/14 4:35 a.m.•33 views

CVE-2026-1983

CVE-2026-1983 concerns the SEATT: Simple Event Attendance plugin for WordPress. The Wordfence entry states this vuln is a Cross-Site Request Forgery (CSRF) flaw present in all versions up to 1.5.0, caused by missing nonce validation on event deletion. This enables unauthenticated attackers to tri...

4.3CVSS5.7AI score0.00124EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE•added 2026/02/12 1:43 p.m.•10 views

CVE-2026-1215

The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.15. This is due to missing nonce validation when saving plugin configuration on the mmacalltrackingmenu admin page. This makes it possible for unauthenticated attackers...

4.3CVSS5.4AI score0.0016EPSS
SaveExploits0References1
NVD
NVD•added 2026/02/11 9:15 a.m.•10 views

CVE-2026-1215

The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.15. This is due to missing nonce validation when saving plugin configuration on the mmacalltrackingmenu admin page. This makes it possible for unauthenticated attackers...

4.3CVSS0.0016EPSS
SaveExploits0References5
Rows per page
Query Builder