← Back
CWE-352

9,349 CVEs • Abstraction: Compound • Likelihood of Exploit: Medium

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

JSON object

Loading...

CVEs (9,349)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-10883
1Mijnpress
1Simple Add Pages Or Posts
Nov 21, 2024
Aug 14, 2019
N/A· v4
6.5 MEDIUM· v3
5.8 MEDIUM· v2
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
CVE-2016-10882
1Google Doc Embedder Project
1Google Doc Embedder
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
CVE-2015-9309
1Weplugins
1Wp Maps
May 7, 2025
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
CVE-2015-9308
1Weplugins
1Wp Maps
May 7, 2025
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
CVE-2015-9307
1Weplugins
1Wp Maps
May 7, 2025
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
CVE-2013-7476
1Simple Fields Project
1Simple Fields
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
CVE-2019-11207
1Tibco
22Loglogic Enterprise Virtual Appliance
Loglogic Log Management IntelligenceLoglogic Lx1025 Firmware+19 more
Jun 17, 2026
Aug 13, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and refl...Show more
The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and reflected cross-site scripting (XSS) attacks, as well as cross-site request forgery (CSRF) attacks. This issue affects: TIBCO Software Inc. TIBCO LogLogic Enterprise Virtual Appliance version 6.2.1 and prior versions. TIBCO Software Inc. TIBCO LogLogic Log Management Intelligence 6.2.1. TIBCO LogLogic LX825 Appliance 0.0.004, TIBCO LogLogic LX1025 Appliance 0.0.004, TIBCO LogLogic LX4025 Appliance 0.0.004, TIBCO LogLogic MX3025 Appliance 0.0.004, TIBCO LogLogic MX4025 Appliance 0.0.004, TIBCO LogLogic ST1025 Appliance 0.0.004, TIBCO LogLogic ST2025-SAN Appliance 0.0.004, and TIBCO LogLogic ST4025 Appliance 0.0.004 using TIBCO LogLogic Log Management Intelligence versions 6.2.1 and below. TIBCO LogLogic LX1035 Appliance 0.0.005, TIBCO LogLogic LX1025R1 Appliance 0.0.004, TIBCO LogLogic LX1025R2 Appliance 0.0.004, TIBCO LogLogic LX4025R1 Appliance 0.0.004, TIBCO LogLogic LX4025R2 Appliance 0.0.004, TIBCO LogLogic LX4035 Appliance 0.0.005, TIBCO LogLogic ST2025-SANR1 Appliance 0.0.004, TIBCO LogLogic ST2025-SANR2 Appliance 0.0.004, TIBCO LogLogic ST2035-SAN Appliance 0.0.005, TIBCO LogLogic ST4025R1 Appliance 0.0.004, TIBCO LogLogic ST4025R2 Appliance 0.0.004, and TIBCO LogLogic ST4035 Appliance 0.0.005 using TIBCO LogLogic Log Management Intelligence versions 6.2.1 and below.Show less
CVE-2018-20964
1Codepeople
1Contact Form Email
Nov 21, 2024
Aug 13, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
CVE-2017-18504
1Wpdeveloper
1Twitter Cards Meta
Nov 21, 2024
Aug 12, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.
CVE-2016-10876
1Wpseeds
1Wp Database Backup
Nov 21, 2024
Aug 12, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
CVE-2016-10874
1Wpseeds
1Wp Database Backup
Nov 21, 2024
Aug 12, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
CVE-2019-14933
1Webkul
1Bagisto
Jun 17, 2026
Aug 11, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Bagisto 0.1.5 allows CSRF under /admin URIs.
CVE-2016-10865
123systems
1Lightbox Plus Colorbox
Nov 21, 2024
Aug 9, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
CVE-2017-18485
1Elementalpath
1Cognitoys Dino Firmware
Nov 21, 2024
Aug 8, 2019
N/A· v4
5.4 MEDIUM· v3
5.8 MEDIUM· v2
Cognitoys Dino devices allow profiles_add.html CSRF.
CVE-2016-10863
1Edimax
27237rpd Firmware
Ew 7438rpn Mini Firmware
Nov 21, 2024
Aug 8, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
CVE-2016-10862
1Neetcables
1Airstream Nas Firmware
Nov 21, 2024
Aug 8, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.
CVE-2015-9292
16kbbs
16kbbs
Nov 21, 2024
Aug 8, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).
CVE-2019-14683
1Codection
1Import Users From Csv With Meta
Jun 17, 2026
Aug 8, 2019
N/A· v4
5.7 MEDIUM· v3
4.9 MEDIUM· v2
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
CVE-2019-14682
1Acf\
1 Better Search Project
Jun 17, 2026
Aug 8, 2019
N/A· v4
4.3 MEDIUM· v3
4.3 MEDIUM· v2
The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
CVE-2019-14681
1Deny All Firewall Project
1Deny All Firewall
Jun 17, 2026
Aug 8, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.