Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVEs (9,674)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-43481 1Rymera 1Advanced Coupons Jun 17, 2026 Nov 8, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.
CVE-2022-41136 1Getshortcodes 1Shortcodes Ultimate Jun 17, 2026 Nov 8, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.
CVE-2022-40632 1Gvectors 1Wpforo Forum Jun 17, 2026 Nov 8, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.
CVE-2022-40128 1Algolplus 1Advanced Order Export For Woocommerce Jun 17, 2026 Nov 8, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.
CVE-2022-38137 1Analytify 1Analytify Google Analytics Dashboard Jun 17, 2026 Nov 8, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress.
CVE-2022-32587 1Codeandmore 1Wp Page Widget Jun 17, 2026 Nov 8, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change.
CVE-2022-27855 1Fatcatapps 1Analytics Cat Jun 17, 2026 Nov 8, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change.
CVE-2022-30694 1Siemens 1136ag1151 8ab01 7ab0 Firmware 6ag1151 8fb01 2ab0 Firmware6ag1314 6eh04 7ab0 Firmware+110 more Jun 17, 2026 Nov 8, 2022 N/A· v4 3.5 LOW· v3 N/A· v2 The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forge...Show more The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.Show less
CVE-2022-3537 1Addify 1Role Based Pricing For Woocommerce Jun 17, 2026 Nov 7, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upl...Show more The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHPShow less
CVE-2022-3536 1Addify 1Role Based Pricing For Woocommerce Jun 17, 2026 Nov 7, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subsc...Show more The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, and a suitable gadget chain is present on the blogShow less
CVE-2022-3489 1Weberge 1Wp Hide Jun 17, 2026 Nov 7, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauthenticated attackers to update it with a crafted request
CVE-2022-3451 1Addify 1Product Stock Manager Jun 17, 2026 Nov 7, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular...Show more The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary optionsShow less
CVE-2022-2387 1Awesomemotive 1Easy Digital Downloads Jun 17, 2026 Nov 7, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attacker...Show more The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attackShow less
CVE-2022-38660 1Hcltech 1Domino Jun 17, 2026 Nov 4, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in...Show more HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user. Show less
CVE-2022-20961 1Cisco 1Identity Services Engine Jun 17, 2026 Nov 4, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary ac...Show more A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the target user.Show less
CVE-2022-44627 1Coleds 1Simple Seo Jun 17, 2026 Nov 3, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps.
CVE-2022-40131 1A3rev 1Page View Count Jun 17, 2026 Nov 3, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset the plugin settings.
CVE-2022-36404 1Coleds 1Simple Seo Jun 17, 2026 Nov 3, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugin <= 1.8.12 versions.
CVE-2022-30608 1Ibm 1Infosphere Information Server Jun 17, 2026 Nov 3, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a "user that the website trusts. IBM X-Forc...Show more "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a "user that the website trusts. IBM X-Force ID: 227295.Show less
CVE-2022-25952 1Keywordrush 1Content Egg Jun 17, 2026 Nov 3, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress.

Previous 1...285286287...484 Next