Nezha Monitoring versions from 1.0.0 up to but not including 2.0.14 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This vulnerability allows a cross-site GET request to trigger stored cron commands on a victim's agents. The issue has been fixed in version 2.0.14.
Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery.
This issue affects WpEvently: from n/a through 4.1.2.
Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicate_post_show_notice site option, suppressing admin notices network-wide.
A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to gain privileges or hijack user identities.
We have already fixed the vulnerability in the following version:
Notification Center 1.10.0.3291 and later
FastPicker, a WooCommerce order management plugin by yuluma, is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0.2. The vulnerability arises from missing or incorrect nonce validation in the settingsPage function, allowing unauthenticated attackers to modify plugin settings if they can trick an administrator into clicking a malicious link. This includes toggling webhook integration and changing API URLs. The CVSS score is 4.3, indicating medium severity.
The jQuery Hover Footnotes WordPress plugin versions up to and including 1.4 contain a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation. This flaw allows unauthenticated attackers to update plugin settings with arbitrary values via a forged request. Because these settings are output unescaped on the frontend, successful exploitation can lead to persistent Cross-Site Scripting (XSS) affecting all site visitors if an administrator is tricked into performing an action like clicking a malicious link.
The WP Emoticon Rating WordPress plugin versions up to and including 1.0.1 contain a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation. This vulnerability allows unauthenticated attackers to trick site administrators into performing unintended actions, such as updating settings or injecting malicious scripts via forged requests. The vulnerability has a CVSS 3.1 score of 6.1, indicating a medium severity level. No official patch or remediation has been confirmed yet.
The AJAX Report Comments plugin for WordPress up to and including version 2.0.4 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation in the rc_options_page function. This vulnerability allows unauthenticated attackers to modify various plugin settings by tricking an administrator into performing an action such as clicking a malicious link. The affected settings include link text and markup, messages shown to users, comment thresholds, cookie duration, toggles for reporter comments, and notification email details. The vulnerability has a medium severity score of 4.3 and does not have a confirmed patch or official remediation at this time.
WpMobi plugin for WordPress versions up to and including 0.0.3 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing or incorrect nonce validation in the handleSaveGeneralSettings function. This vulnerability allows unauthenticated attackers to trick site administrators into executing forged requests that modify the plugin's General Settings and inject arbitrary scripts into the administrator's browser. The injected script executes even if the malicious input fails validation and is not saved to the database because the form re-renders with the attacker-supplied value in memory.
WP-Ultimate-Map plugin for WordPress versions up to and including 1.1 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing nonce validation in the process_init() function. This vulnerability allows unauthenticated attackers to change plugin settings by tricking an administrator into performing an action, such as clicking a malicious link. Additionally, some settings are stored without sanitization and later output without escaping, enabling injection of arbitrary web scripts. The vulnerability has a medium severity with a CVSS score of 6.1.
The WP Meta Sort Posts WordPress plugin up to and including version 0.9 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing or incorrect nonce validation in the msp-options.php script. This vulnerability allows an unauthenticated attacker to trick a site administrator into performing actions that change plugin settings such as msp_loop_file and msp_nav_location via a forged request. The vulnerability has a medium severity rating with a CVSS score of 4.3.
LatePoint – Calendar Booking Plugin for WordPress versions up to and including 5.6.0 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing or incorrect nonce validation on the change_status function. This vulnerability allows unauthenticated attackers to change the status of arbitrary invoices, including marking unpaid invoices as paid, by tricking a site administrator into performing an action such as clicking a malicious link.
The Frontend User Notes plugin for WordPress up to version 2.1.1 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing or incorrect nonce validation in the funp_ajax_modify_notes function. This vulnerability allows an attacker to trick a logged-in user, such as a site administrator, into performing unauthorized modifications to their own note content via a forged request. The attack is limited to notes owned by the victim user and cannot affect notes belonging to other users.
The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the form_settings_ui (settings save handler, procedural include scope) function. This makes it possible for unauthenticated attackers to modify plugin settings including the minimum access role (altering WordPress role capabilities via add_cap/remove_cap), the data-erasure-on-uninstall flag, life-check timing values, the mandator email address, the confirmation page ID, and date/time formats via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down — without knowing the state value at all. This issue has been patched in version 0.5.1.
NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.
The Laiser Tag WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.2.5. The vulnerability arises from missing or incorrect nonce validation in the addOptionsPageFields function, allowing an attacker to trick a site administrator into performing unintended actions. This can lead to unauthorized modification of plugin settings such as the API key, tag blacklist, relevance threshold, batch size, and tagging toggles. The CVSS score is 4.3, indicating a medium severity risk.
The Remove meta boxes per user role WordPress plugin up to version 1.01 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing or incorrect nonce validation on its settings page. This vulnerability allows unauthenticated attackers to trick site administrators into modifying or resetting meta box visibility settings for user roles via forged requests. The vulnerability has a medium severity rating with a CVSS score of 4.3.
The Remove NoFollow Commenter URL WordPress plugin up to and including version 1.0 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing or incorrect nonce validation in the gmz_comment_settings_save function. This vulnerability allows an unauthenticated attacker to modify the plugin's comment-display settings if a site administrator is tricked into clicking a malicious link. The vulnerability has a medium severity rating with a CVSS score of 4.3.
The Tectite Forms plugin for WordPress is vulnerable to a Cross-Site Request Forgery (CSRF) attack in all versions up to and including 1.3. This vulnerability arises from missing or incorrect nonce validation in the admin_init function, allowing unauthenticated attackers to modify plugin settings by tricking an administrator into performing an action such as clicking a malicious link. The vulnerability has a CVSS score of 4.3, indicating medium severity.