CVE-2026-74005

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

CVE-2026-66571

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

EUVD-2026-81516

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

CVE-2026-74005

CVE-2026-74005 is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in the WordPress PublishPress Series plugin (versions ≤ 3.1.3 ), discovered by researcher benzdeus . The flaw allows an attacker to forge requests on behalf of a user, with a CVSS 3.1 score of 5.4 (MEDIUM) — requ...

CVE-2026-81271: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in GeoDirectory = 2.8.176 versions...

CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to version 4.6.58 , the MCP HTTP Stream _validate_origin function uses request_origin.startswith(allowed), which allows an attacker-controlled origin such as localhost.attacker.com to satisfy a localhost allowlist entry. This enables an unauthenticat...

CVE-2026-66686

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

CVE-2026-66474

Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...

CVE-2026-65539

Unauthenticated Cross Site Request Forgery CSRF in Kwayy HTML Sitemap = 4.0 versions...

CVE-2026-65536

CVE-2026-65536 affects the WordPress WooCommerce shipping plugin (Persian: افزونه حمل و نقل ووکامرس) for fast/custom delivery and courier options,

EUVD-2026-48137

Unauthenticated Cross Site Request Forgery CSRF in افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری = 4.4.5 versions...

CVE-2026-57784

CVE-2026-57784 : Unauthenticated Cross Site Request Forgery (CSRF) in the WordPress plugin Ninja Forms File Uploads Extension

CVE-2026-57757

Unauthenticated Cross Site Request Forgery CSRF in pCloud WP Backup = 2.0.2 versions...

CVE-2026-57758 WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Permalink Manager for WooCommerce = 1.0.8.2 versions...

CVE-2026-57751

The CVE-2026-57751 entry concerns the WordPress plugin Heateor Social Login (versions

GHSA-6M68-R693-78QX Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream

Summary The Tilt HUD WebSocket /ws/view is gated by a CSRF token, but the token is served by an unauthenticated endpoint and the upgrader accepts any client that omits an Origin header. When the HUD is network-exposed, an attacker can open the HUD stream and read the developer's session state...

Vulnerabilities are handled in GitLab through GitLab Inc.

GitLab Inc. has addressed several vulnerabilities in GitLab Community Edition CE and Enterprise Edition EE in various versions, particularly in releases from version 8.3 to 18.11.3. These vulnerabilities concern various components and functions within GitLab, including Jira integration, container...

WordPress WP Flashy Marketing Automation plugin <= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin WP Flashy Marketing Automation versions = 2.0.8...

CVE-2025-12130 WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendordashboard/product/delete/ endpoint...

WordPress Torod plugin <= 1.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Torod versions = 1.9...