CVE-2023-39311

Cross-Site Request Forgery CSRF vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1...

CVE-2024-23515 WordPress Cincopa video and media plugin <= 1.159 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Cincopa Post Video Players.This issue affects Post Video Players: from n/a through 1.159...

PT-2024-11724 · WordPress · Wordpress Countdown Widget

Name of the Vulnerable Software and Affected Versions: WordPress Countdown Widget versions 3.1.9.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows Cross-Site Scripting XSS. This means an attacker could potentially trick a user into...

CVE-2024-29684

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF via the component /src/dede/makehtmlhomepage.php allowing a remote attacker to execute arbitrary code...

CVE-2024-29684

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF via the component /src/dede/makehtmlhomepage.php allowing a remote attacker to execute arbitrary code...

CVE-2024-1231

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack...

WordPress Shortlinks by Pretty Links Plugin <= 3.6.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Shortlinks by Pretty Links Type Plugin Vulnerable versions = 3.6.3 Fixed in 3.6.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2326 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 02d57a965c0b Credits Webbernau...

NPS computy < 2.7.6 - Results Deletion via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks PoC Make a logged in admin open the following: The result is that all existing poll responses are deleted...

CVE-2024-25808

Cross-site Request Forgery CSRF vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function...

CVE-2024-29338

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery CSRF via /anchor/admin/categories/delete/2...

CVE-2024-1727 CSRF Vulnerability in gradio-app/gradio

A Cross-Site Request Forgery CSRF vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the victim's server, an attacker can deplete...

CVE-2024-0779

The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admininit, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example...

PT-2024-15812 · WordPress · Enjoy Social Feed

Name of the Vulnerable Software and Affected Versions: Enjoy Social Feed plugin for WordPress website versions through 6.2.2 Description: The issue concerns a lack of authorization and CSRF protection in various functions hooked to admin init, allowing unauthenticated users to call them and unlin...

CVE-2023-51486

Cross-Site Request Forgery CSRF vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101...

CVE-2023-51407

Cross-Site Request Forgery CSRF vulnerability in Rocket Elements Split Test For Elementor.This issue affects Split Test For Elementor: from n/a through 1.6.9...

CVE-2023-51487

CVE-2023-51487 is a CSRF vulnerability in the ARI Stream Quiz WordPress plugin, affecting ARI Stream Quiz versions up to 1.2.32. The connected documents confirm the issue exists and reference CSRF as the vulnerability type, but do not provide an explicit fixed version or patch details. Affected p...

PT-2024-14146 · Unknown · Ari Stream Quiz

Name of the Vulnerable Software and Affected Versions: ARI Stream Quiz versions 1.2.32 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue occurs when an application does not properly validate requests, allowing an attacker to trick a user into...

PT-2024-14168 · Wbw · Product Table By Wbw

Name of the Vulnerable Software and Affected Versions: Product Table by WBW versions 1.8.6 and earlier Description: A Cross Site Request Forgery CSRF issue affects the Product Table by WBW. This type of issue allows an attacker to trick a user into performing unintended actions on a web applicati...

CVE-2024-1642

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'postingbulk' function. This makes it possible for...

CVE-2024-1489

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction function. This makes it possible for unauthenticated attacker...