Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVEs (9,674)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-36292 1Wpchill 1Gallery Photoblocks Jun 17, 2026 Aug 23, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress.
CVE-2022-36288 1W3eden 1Download Manager Jun 17, 2026 Aug 23, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.
CVE-2022-29468 1Wwbn 1Avideo Jun 17, 2026 Aug 22, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to...Show more A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.Show less
CVE-2022-36346 1Maxfoundry 1Maxbuttons Jun 17, 2026 Aug 22, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress.
CVE-2022-35656 1Pega 1Pega Platform Jun 17, 2026 Aug 22, 2022 N/A· v4 4.5 MEDIUM· v3 N/A· v2 Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.
CVE-2022-34347 1W3eden 1Download Manager Jun 17, 2026 Aug 22, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.
CVE-2022-2555 1Yotpo Reviews For Woocommerce Project 1Yotpo Reviews For Woocommerce Jun 17, 2026 Aug 22, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to make a logged in admin change them via a CSRF attack.
CVE-2022-2389 1Funnelkit 1Funnelkit Automations Jun 17, 2026 Aug 22, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, al...Show more The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automationsShow less
CVE-2022-2388 1Wow Company 1Wp Coder Jun 17, 2026 Aug 22, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack
CVE-2022-2382 1Shapedplugin 1Product Slider For Woocommerce Jun 17, 2026 Aug 22, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in partic...Show more The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.Show less
CVE-2022-2377 1Wpwax 1Directorist Jun 17, 2026 Aug 22, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog
CVE-2022-2375 1Okapitech 1Wp Sticky Button Jun 17, 2026 Aug 22, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of...Show more The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issuesShow less
CVE-2022-2312 1Student Result Or Employee Database Project 1Student Result Or Employee Database Jun 17, 2026 Aug 22, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a role as low as contributor to add/edit and delete students vi...Show more The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a role as low as contributor to add/edit and delete students via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site scriptingShow less
CVE-2022-2276 1Wp Edit Menu Project 1Wp Edit Menu Jun 17, 2026 Aug 22, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts/pages from the blog
CVE-2022-2275 1Wp Edit Menu Project 1Wp Edit Menu Jun 17, 2026 Aug 22, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary posts/pages from the blog via a CSRF attack
CVE-2022-2172 1Linkworth 1Linkworth Jun 17, 2026 Aug 22, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change settings via a CSRF attack.
CVE-2022-1251 1Inkthemes 1Ask Me Jun 17, 2026 Aug 22, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a user to change their profile information by sending a crafted...Show more The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a user to change their profile information by sending a crafted request.Show less
CVE-2021-36852 1Thimpress 1Wp Hotel Booking Jun 17, 2026 Aug 22, 2022 N/A· v4 8.0 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress.
CVE-2021-24912 1Transposh 1Transposh Wordpress Translation Jun 17, 2026 Aug 22, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sani...Show more The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a logged in adminShow less
CVE-2022-36579 1Wellcms 1Wellcms Jun 17, 2026 Aug 19, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF).

Previous 1...292293294...484 Next