The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.0. This is due to missing nonce verification on the settings form in the func_page_main() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8. This is due to missing nonce validation in the ajax_revoke_token() function which handles the 'petjeaf_disconnect' AJAX action. The function performs destructive operations including revoking OAuth2 tokens, deleting user meta, and deleting WordPress user accounts (for users with the 'petjeaf_member' role) without verifying the request originated from a legitimate source. This makes it possible for unauthenticated attackers to force authenticated users to delete their Petje.af member user accounts via a forged request granted the victim clicks on a link or visits a malicious site.
CVE-2026-6293 is a medium severity vulnerability in the WordPress plugin 'Inquiry Form to Posts or Pages' version 1.0. It allows unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) attacks that lead to Stored Cross-Site Scripting (XSS). This occurs because the plugin lacks nonce validation on its settings update handler and does not sanitize or escape user-supplied input properly. An attacker can trick a logged-in Administrator into visiting a malicious page, causing arbitrary scripts to be injected and stored via a forged request.
The Aruba HiSpeed Cache WordPress plugin up to version 3.0.4 contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce verification in the ahsc_ajax_reset_options() function. This flaw allows an unauthenticated attacker to trick a site administrator into resetting all plugin settings to their default values by making them perform an action such as clicking a malicious link. The vulnerability has a medium severity with a CVSS score of 4.3. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vsz_cf7_save_setting_callback' function. This makes it possible for unauthenticated attackers to delete form entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_redraw_table_row() function. This makes it possible for unauthenticated attackers to update WooCommerce product data including prices, descriptions, and other product fields via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_delete_tax_term() function. This makes it possible for unauthenticated attackers to delete WooCommerce taxonomy terms (categories, tags, etc.) via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
CVE-2026-4141 is a Cross-Site Request Forgery (CSRF) vulnerability in the Quran Translations WordPress plugin up to version 1.7. The vulnerability arises from missing nonce validation in the function that handles the plugin's settings page, allowing unauthenticated attackers to modify plugin settings by tricking an administrator into performing an action such as clicking a malicious link. This can lead to unauthorized changes to display options like PDF, RSS, podcast, media player links, playlist title, and playlist code. The vulnerability has a medium severity rating with a CVSS score of 4.3.
The Product Feed PRO for WooCommerce by AdTribes plugin for WordPress versions 13.4.6 through 13.5.2.1 contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw arises from missing or incorrect nonce validation on several AJAX functions, allowing unauthenticated attackers to perform actions such as feed migration, clearing caches, rewriting URLs, toggling settings, and deleting duplicated feed posts if they can trick an administrator into clicking a malicious link. The vulnerability has a high severity score of 8.8. No official patch or remediation guidance is currently confirmed.
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
A Cross-Site Request Forgery (CSRF) vulnerability exists in RedwoodJS SDK versions from 1.0.0-beta.50 up to but not including 1.0.6. Server functions exported from "use server" files could be invoked via GET requests, bypassing intended HTTP method restrictions. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions due to browsers sending SameSite=Lax cookies on top-level GET requests. This affects all server functions, including serverAction() handlers and bare exported functions. The vulnerability is fixed in version 1.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Analytify Simple Social Media Share Buttons plugin, affecting versions up to 6.2.0. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is classified under CWE-352 and has a high severity rating with a CVSS score of 7.5. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-34896 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Analytify Under Construction, Coming Soon & Maintenance Mode plugin up to version 2.1.1. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue has a high severity score of 7.5 but currently has no publicly known exploits or official patches. Users should monitor vendor advisories for remediation updates.
CVE-2025-15611 is a medium severity vulnerability in the Popup Box WordPress plugin before version 5.5.0. It involves improper nonce validation in the add_or_edit_popupbox() function, enabling unauthenticated attackers to conduct Cross-Site Request Forgery (CSRF) attacks. If an authenticated admin visits a malicious page, attackers can create or modify popups containing arbitrary JavaScript, leading to Cross-Site Scripting (XSS) that executes in both the admin panel and frontend.
WWBN AVideo versions 26.0 and earlier contain a Cross-Site Request Forgery (CSRF) vulnerability in the player skin configuration endpoint (admin/playerUpdate.json.php). This endpoint does not validate CSRF tokens, and the plugins table is excluded from domain-based security checks, removing additional protection. Because the platform uses SameSite=None cookies, an attacker can perform a cross-origin POST request to modify the video player appearance across the platform. The vulnerability has a CVSS score of 4.3, indicating medium severity.
WWBN AVideo versions 26.0 and earlier have a Cross-Site Request Forgery (CSRF) vulnerability in the site customization endpoint admin/customize_settings_nativeUpdate.json.php. This endpoint lacks CSRF token validation and writes uploaded logo files to disk before performing domain-based security checks. Due to the platform's SameSite=None cookie policy, an attacker can perform a cross-origin POST request to overwrite the platform's logo with attacker-controlled content. The vulnerability has a CVSS score of 4.3, indicating medium severity.
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugins database table is explicitly listed in ignoreTableSecurityCheck(), which means the ORM-level Referer/Origin domain validation in ObjectYPT::save() is also bypassed. Combined with SameSite=None on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page. At time of publication, there are no publicly available patches.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets SameSite=None on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address. At time of publication, there are no publicly available patches.