EUVD-2026-81519

Unauthenticated Cross Site Request Forgery CSRF in Xagio SEO = 7.1.0.43 versions...

CVE-2026-78295 WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Xagio SEO = 7.1.0.43 versions...

CVE-2026-78295 WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Xagio SEO = 7.1.0.43 versions...

EUVD-2026-81516

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

CVE-2026-74005

CVE-2026-74005 is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in the WordPress PublishPress Series plugin (versions ≤ 3.1.3 ), discovered by researcher benzdeus . The flaw allows an attacker to forge requests on behalf of a user, with a CVSS 3.1 score of 5.4 (MEDIUM) — requ...

CVE-2026-74005 WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

CVE-2026-74005 WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

CVE-2026-66571 WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

CVE-2026-66571 WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

EUVD-2026-81492

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

CVE-2026-66571

An unauthenticated Cross Site Request Forgery (CSRF) vulnerability exists in the WordPress plugin Asset CleanUp: Page Speed Booster in versions ≤ 1.4.0.5 , as discovered by Helder Gonçalves and tracked by Patchstack. The CVSS 3.1 score is 7.1 (High) with a Changed Scope, indicating that a success...

CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

EEF-CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Summary Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-81637

CVE-2026-81637 is an insufficient session expiration flaw in AshAuthentication (team-alembic, Elixir ecosystem). In AshAuthentication.Strategy.OAuth2.Plug.callback/2, the OAuth2 CSRF state (session_params) is deleted via a rebind inside a with chain, but Elixir's else-block scoping causes every f...

WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Helder Gonçalves in WordPress Plugin Asset CleanUp: Page Speed Booster versions = 1.4.0.5...

CVE-2026-91009

The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...

EUVD-2026-81352

The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...

EUVD-2026-81279

In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...

EUVD-2026-81282

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

PT-2026-94293

Name of the Vulnerable Software and Affected Versions ash authentication versions 0.6.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description Insufficient session expiration allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sig...