The BLOGCHAT Chat System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the options page. This makes it possible for unauthenticated attackers to change the site's active theme by modifying the jbct_theme option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the bigfishgames_syndicate_submenu() function. This makes it possible for unauthenticated attackers to reset plugin settings and update them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the gc_crud() function which handles the delete action (action=delete) via a GET request without any wp_verify_nonce() / check_admin_referer() call. This makes it possible for unauthenticated attackers to delete arbitrary game catalog entries (including the associated WordPress post created for the game) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
A Cross-Site Request Forgery (CSRF) vulnerability exists in vercel turborepo versions prior to 2.9.14. The issue occurs in the self-hosted login and SSO browser flows where the CSRF state value on the localhost callback was not validated. This allows a malicious web page to send a request with an attacker-controlled token to the local callback server, potentially causing the CLI to complete login with incorrect credentials. Vercel-hosted login flows using device authorization are not affected. The vulnerability is fixed in version 2.9.14.
The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the _updateSettings function. This makes it possible for unauthenticated attackers to change the Notify Odoo URL to an attacker-controlled URL and modify notification, tracking image, and allowed IP address settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2. This is due to missing nonce verification on the request_cancellation() function. This makes it possible for unauthenticated attackers to cancel a logged-in customer's bookings via a forged request, granted they can trick the customer into performing an action such as clicking on a link.
MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.
A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3.
ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records, including cascaded property and record-to-property assignments. This vulnerability is fixed in 7.3.2.
ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.
The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the SkysaApps_Admin_AppPage function. This makes it possible for unauthenticated attackers to trick a site administrator into making a forged request to modify the plugin's settings, including the scrolling message text and URL, via a forged cross-site request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2026-6932 is a Cross-Site Request Forgery (CSRF) vulnerability in the Woo Commerce Minimum Weight plugin for WordPress, affecting all versions up to and including 3.0.1. The issue arises from missing nonce verification on the settings update handler in edit-weight.php, allowing unauthenticated attackers to trick site administrators into modifying the minimum order weight setting via a forged POST request. The vulnerability has a CVSS score of 4.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The Zawgyi Embed WordPress plugin versions up to and including 2.1.1 contain a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation in the zawgyi_adminpage function. This vulnerability allows an unauthenticated attacker to trick a site administrator into submitting a forged POST request that updates the plugin's zawgyi_forceCSS setting. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The Tm – WordPress Redirection plugin up to version 1.2 contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation. This flaw allows unauthenticated attackers to trick site administrators into performing unwanted actions, such as updating plugin settings or injecting malicious scripts. The vulnerability has a CVSS score of 6.1, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The WP-Redirection plugin for WordPress up to version 1.0.3 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce protection in its admin settings form. This vulnerability allows an attacker to trick a logged-in administrator into performing unintended actions such as creating, modifying, or deleting URL redirection rules without their consent. The issue arises because the plugin does not implement nonce verification functions before processing POST requests that alter redirection records.
CVE-2026-45430 is a high-severity vulnerability in the Salesforce module for Backdrop CMS contributed projects (backdrop-contrib/salesforce) prior to version 1.x-1.0.1. The module fails to properly implement a random state parameter in the OAuth authorization flow, leaving it vulnerable to Cross-Site Request Forgery (CSRF) attacks. This weakness could allow an attacker to trick a user into performing unwanted actions with high confidentiality and integrity impact, though availability impact is low. The vulnerability affects the cloud-hosted service version of the module. A patch is available to address this issue, and since it is a cloud service, the vendor typically manages remediation server-side. There are no known exploits in the wild at this time.
CVE-2026-0502 is a medium severity vulnerability in SAP BusinessObjects Business Intelligence Platform caused by insufficient Cross-Site Request Forgery (CSRF) protection. An authenticated user could be tricked into sending unintended requests to the web server. The vulnerability impacts the integrity and availability of the application to a low degree but does not affect data confidentiality. There is no known exploit in the wild and no official patch or remediation guidance has been provided yet.
CVE-2026-43877 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo versions up to and including 29.0. The vulnerability exists in the legacy endpoint objects/userSavePhoto.php, which allows a logged-in user’s profile photo to be overwritten with arbitrary data via a base64 POST parameter. This endpoint lacks CSRF protections such as tokens, Origin/Referer checks, and MIME validation. Due to the platform's cookie policy (SameSite=None; Secure on HTTPS), an attacker can exploit this by tricking a logged-in user into visiting a malicious page, causing unauthorized profile photo changes and triggering a site-wide cache clear. No official patch or remediation level is confirmed in the provided data, though a commit referenced in the description suggests a fix was made. The CVSS score is 5.4, indicating medium severity.