Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVEs (9,697)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-1416 - - Jun 17, 2026 May 2, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on several functions in all versions up to, and in...Show more The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on several functions in all versions up to, and including, 1.8.9. This makes it possible for unauthenticated attackers to invoke those functions.Show less
CVE-2024-1415 - - Jun 17, 2026 May 2, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.9. This is due to missing or incorrect nonce validat...Show more The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.9. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. These actions may result in form deletion, and lead signup as well as file upload.Show less
CVE-2024-0847 - - Jun 17, 2026 May 2, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in class-sbmm-list-ta...Show more The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in class-sbmm-list-table.php. This makes it possible for unauthenticated attackers to bulk delete messages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.Show less
CVE-2024-0613 - - Jun 17, 2026 May 2, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The Delete Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.1. This is due to missing or incorrect nonce validation on the ajax_delete_field() funct...Show more The Delete Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.1. This is due to missing or incorrect nonce validation on the ajax_delete_field() function. This makes it possible for unauthenticated attackers to delete arbitrary post meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.Show less
CVE-2024-4128 1Google 1Firebase Command Line Interface Jun 17, 2026 May 2, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and na...Show more This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit 068a2b08dc308c7ab4b569617f5fc8821237e3a0 https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0 Show less
CVE-2024-33913 - - Jun 17, 2026 May 2, 2024 N/A· v4 9.6 CRITICAL· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload in Xserver Migrator.This issue affects Xserver Migrator: from n/a through 1.6.1.
CVE-2024-3481 1Wow Company 1Counter Box Jun 17, 2026 May 2, 2024 N/A· v4 5.2 MEDIUM· v3 N/A· v2 The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such deleting counters via CSRF attacks
CVE-2024-3478 1Wow Company 1Herd Effects Jun 17, 2026 May 2, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks
CVE-2024-3477 1Wow Company 1Popup Box Jun 17, 2026 May 2, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting popups via CSRF attacks
CVE-2024-3476 1Wow Company 1Side Menu Lite Jun 17, 2026 May 2, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
CVE-2024-3475 1Wow Company 1Sticky Buttons Jun 17, 2026 May 2, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
CVE-2024-3474 1Wow Company 1Wow Skype Buttons Jun 17, 2026 May 2, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
CVE-2024-3472 1Wow Company 1Modal Window Jun 17, 2026 May 2, 2024 N/A· v4 5.9 MEDIUM· v3 N/A· v2 The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack
CVE-2024-3471 1Wow Company 1Button Generator Jun 17, 2026 May 2, 2024 N/A· v4 3.4 LOW· v3 N/A· v2 The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin delete buttons via a CSRF attack
CVE-2024-2405 1Wow Company 1Float Menu Jun 17, 2026 May 2, 2024 N/A· v4 4.5 MEDIUM· v3 N/A· v2 The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.
CVE-2024-23597 - - Jun 17, 2026 May 1, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Cross-site request forgery (CSRF) vulnerability exists in TvRock 0.9t8a. If a logged-in user of TVRock accesses a specially crafted page, unintended operations may be performed. Note that the developer was unreachable, t...Show more Cross-site request forgery (CSRF) vulnerability exists in TvRock 0.9t8a. If a logged-in user of TVRock accesses a specially crafted page, unintended operations may be performed. Note that the developer was unreachable, therefore, users should consider stop using TvRock 0.9t8a.Show less
CVE-2024-33449 - - Jun 17, 2026 Apr 29, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An SSRF issue in the PDFMyURL service allows a remote attacker to obtain sensitive information and execute arbitrary code via a POST request in the url parameter
CVE-2024-33681 - - Jun 17, 2026 Apr 29, 2024 N/A· v4 7.1 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Regenerate post permalink allows Cross-Site Scripting (XSS).This issue affects Regenerate post permalink: from n/a through 1.0.3.
CVE-2024-33632 - - Jun 17, 2026 Apr 29, 2024 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.
CVE-2024-33646 - - Jun 17, 2026 Apr 29, 2024 N/A· v4 7.1 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Sticky Anything allows Cross-Site Scripting (XSS).This issue affects Sticky Anything: from n/a through 2.1.5.

Previous 1...185186187...485 Next