The DX Unanswered Comments WordPress plugin up to version 1.7 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation on its settings form. This vulnerability allows unauthenticated attackers to modify plugin settings by tricking a site administrator into performing an action such as clicking a malicious link. The vulnerability does not impact confidentiality or availability but can lead to unauthorized modification of plugin configuration.
CVE-2026-6294 is a Cross-Site Request Forgery (CSRF) vulnerability in the Google PageRank Display WordPress plugin by byybora, affecting versions up to and including 1.4. The vulnerability arises because the plugin's settings page lacks nonce validation, allowing an attacker to trick a logged-in administrator into submitting a crafted request that changes plugin settings without proper authorization. This can lead to unauthorized modification of display options for the PageRank badge. The vulnerability has a medium severity with a CVSS score of 4.3. No official patch or remediation guidance is currently available from the vendor.
The Kcaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.1. This is due to missing nonce validation in the plugin's settings page handler (admin/setting.php). The settings form does not include a wp_nonce_field() and the form processing code does not call wp_verify_nonce() or check_admin_referer() before saving settings to the database via $wpdb->update(). This makes it possible for unauthenticated attackers to modify the plugin's CAPTCHA settings (enabling or disabling CAPTCHA on login, registration, lost password, and comment forms) via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
The Inquiry Cart plugin for WordPress versions up to and including 3.4.2 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce verification in the settings form processing function. This vulnerability allows unauthenticated attackers to trick administrators into submitting forged requests that update plugin settings, potentially injecting malicious scripts that execute in the admin area. The CVSS score is 6.1, indicating a medium severity risk. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-4118 is a Cross-Site Request Forgery (CSRF) vulnerability in the tmarek Call To Action Plugin for WordPress, affecting all versions up to 3.1.3. The vulnerability arises because the plugin's settings page lacks nonce validation, allowing unauthenticated attackers to modify plugin settings if they can trick an administrator into performing an action such as clicking a malicious link. This can lead to unauthorized changes to call-to-action box title, content, link URL, image URL, colors, and other configuration options. The CVSS score is 4.3, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.
The mCatFilter WordPress plugin up to version 0.5.2 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce verification and capability checks in its compute_post() function. This function processes POST requests to update plugin settings without validating CSRF tokens, allowing an attacker to trick an administrator into submitting a forged request that modifies plugin settings such as category and feed exclusion rules. The vulnerability has a medium severity with a CVSS score of 4.3. No official patch or remediation guidance is currently available.
The Fast & Fancy Filter – 3F WordPress plugin versions up to 1.2.2 contain a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce verification in the saveFields() function. This flaw allows unauthenticated attackers to modify plugin filter settings, update arbitrary options, or create new filter posts if they can trick a site administrator into performing an action such as clicking a malicious link. The vulnerability has a CVSS score of 4.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-4140 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ni WooCommerce Order Export WordPress plugin versions up to 3.1.6. The vulnerability arises from missing nonce validation in the AJAX handler that processes settings updates, allowing unauthenticated attackers to modify plugin settings if they can trick an administrator into performing an action such as clicking a malicious link. This vulnerability has a medium severity rating with a CVSS score of 4.3.
The TextP2P Texting Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.7. This is due to missing nonce validation in the imTextP2POptionPage() function which processes settings updates. The form at line 314 does not include a wp_nonce_field(), and the POST handler at line 7 does not call check_admin_referer() or wp_verify_nonce() before processing settings changes. This makes it possible for unauthenticated attackers to update all plugin settings including chat widget titles, messages, API credentials, colors, and reCAPTCHA configuration via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
CVE-2026-4131 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Responsive Popup + Optin WordPress plugin up to version 1.4. The vulnerability arises because the plugin's admin settings page does not implement nonce generation or verification, allowing attackers to trick administrators into submitting forged requests. This can lead to unauthorized modification of plugin settings, including the 'wpo_image_url' parameter. The vulnerability has a CVSS score of 6.1, indicating medium severity. There is no official patch or vendor advisory available at this time.
WWBN AVideo versions 29.0 and prior contain a Cross-Site Request Forgery (CSRF) vulnerability in the comment deletion endpoint. The endpoint 'objects/commentDelete.json.php' allows authenticated users with deletion privileges to delete comments without any CSRF protections such as token validation or origin checks. Because the platform sets session cookies with SameSite=None, cross-origin requests automatically include the session cookie, enabling attackers to trick authorized users into deleting comments by visiting malicious pages. A fix for this vulnerability is referenced in a specific commit but no official patch release information is provided.
WWBN AVideo versions 29.0 and earlier contain multiple JSON endpoints vulnerable to Cross-Site Request Forgery (CSRF). These endpoints accept state-changing requests without anti-CSRF protections such as tokens or origin checks. An attacker can cause a logged-in user to perform actions like liking/disliking comments, posting comments with attacker-chosen text, or deleting assets if the user has category management rights, simply by having the user load a malicious webpage. A fix has been committed but no official patch release information is provided.
WWBN AVideo versions 29.0 and earlier contain a Cross-Site Request Forgery (CSRF) vulnerability in three admin-only JSON endpoints that modify categories and run plugin update scripts. These endpoints enforce only role checks without validating CSRF tokens, allowing an attacker to perform unauthorized state-changing actions if an admin visits a malicious page. A fix has been committed but no official patch release or advisory is confirmed yet. The vulnerability has a CVSS score of 7.1, indicating high severity due to the potential for unauthorized modification of categories and plugin execution.
WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site settings from `$_POST` but protects the endpoint only with `User::isAdmin()`. It does not call `forbidIfIsUntrustedRequest()`, does not verify a `globalToken`, and does not validate the Origin/Referer header. Because AVideo intentionally sets `session.cookie_samesite=None` to support cross-origin iframe embedding, a logged-in administrator who visits an attacker-controlled page will have the browser auto-submit a cross-origin POST that rewrites the site's encoder URL, SMTP credentials, site `<head>` HTML, logo, favicon, contact email, and more in a single request. Commit f9492f5e6123dff0292d5bb3164fde7665dc36b4 contains a fix.
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.
FreeScout versions prior to 1.8.215 contain a Cross-Site Request Forgery (CSRF) vulnerability in the mailbox OAuth disconnect functionality. The affected endpoint uses a GET request without requiring a CSRF token, allowing an attacker to trigger the OAuth disconnect action cross-site against a logged-in mailbox admin. This vulnerability was fixed in version 1.8.215.
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0.
The tholstkabelbwde WordPress plugin 'CMS für Motorrad Werkstätten' versions up to 1.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability. This arises from missing nonce validation and lack of capability checks on eight AJAX deletion handlers. An attacker can exploit this by tricking a logged-in user into submitting a malicious request, potentially causing deletion of various data such as vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, or entire supplier catalogs. The vulnerability has a CVSS score of 4.3, indicating medium severity. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the updateLabel() and remove() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages or delete pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.