BIT-RCLONE-2026-116194 Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting...

CVE-2026-114719

A flaw was found in Roundcube Webmail. A remote attacker could conduct a Cross-Site Request Forgery CSRF attack to alter email classifications without user consent. By enticing an authenticated user into following a malicious link, the attacker exploits improper parameter handling in the markasju...

CVE-2026-115300

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

CVE-2026-115299

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in...

CVE-2026-110983

The WP Photo Album Plus WordPress plugin (versions before 9.3.04.004 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The software fails to verify the origin or a security token for specific comment-management requests. An attacker can exploit this by tricking a logged-in user with co...

CVE-2026-110983 WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page...

CVE-2026-110983 WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page...

EUVD-2026-112609

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

CVE-2026-115300

The Contact Form by Supsystic WordPress plugin, in versions before 1.11.1 , is vulnerable to Cross-Site Request Forgery (CSRF) . The application fails to validate CSRF tokens or request origins on two specific administrator-only actions: bulk-deleting captured form submissions and wiping form sta...

CVE-2026-115300 Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

CVE-2026-115300 Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

EUVD-2026-112608

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in...

CVE-2026-115299 Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in...

CVE-2026-115299

The Contact Form by Supsystic WordPress plugin, in versions prior to 1.11.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The issue arises because the plugin fails to verify a CSRF nonce when saving mail settings. A remote attacker can exploit this by tricking a logged-in administr...

CVE-2026-115299 Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in...

Echo Has CSRF Protection Bypass Via MethodOverride Rewriting POST To Safe Method

Summary The "MethodOverride" middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When "MethodOverride" is registered before "CSRF" in the post-routing middleware chain "e.Use", it rewrites the...

PT-2026-130651

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in...

CVE-2026-116399: InstaWP InstaWP Connect: Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request…

Cross-Site Request Forgery CSRF vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2...

PT-2026-132144

Cross-Site Request Forgery CSRF vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2...

PT-2026-132194

Cross-Site Request Forgery CSRF vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5...