CVE-2026-93549 is a high-severity cross-site request forgery (CSRF) vulnerability in the CoCart WordPress plugin versions 4.9.0 through 4.9.6. The plugin improperly scopes its REST API authentication filter, disabling WordPress core's REST nonce protection for all routes. This flaw allows an attacker to exploit a logged-in administrator's session to create a new administrator account via CSRF.
Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX.
An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work the user then performs in that session, including uploads, form submissions, and account bindings, lands in the attacker's account. This issue affects Apache APISIX: from 3.17.0 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Launch of phishing attacks, and Protection mechanism bypass.
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password.
This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable.
This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request. No optional feature or non-default configuration is required; any logged-in author or administrator is affected when induced to visit a crafted page. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates only the submitted salt and applies the same check to multipart forms.
CVE-2026-100748 is a Cross-Site Request Forgery (CSRF) vulnerability in the Event Gallery extension for Joomla by svenbluege.de. It affects versions 1.0.0 through 6.0.0 and allows unauthorized commands to be transmitted from a trusted user. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9. No official patch or vendor advisory is currently available.
CVE-2026-100747 is a medium severity Cross-Site Request Forgery (CSRF) vulnerability in the Event Gallery extension for Joomla by svenbluege.de. It affects versions 1.0.0 through 6.0.0. The vulnerability occurs due to the lack of a CSRF token check in the image upload functionality, allowing an attacker to upload files to an event and potentially overwrite existing files with the same name.
CVE-2026-100749 is a Cross-Site Request Forgery (CSRF) vulnerability in the backend cleanup actions of the Event Gallery extension for Joomla by svenbluege.de. This issue affects versions from 1.0.0 up to 6.0.0. The vulnerability allows unauthorized requests to trigger deletion of orphaned file entries and shopping carts older than 30 days. The CVSS 4.0 base score is 5.1, indicating a medium severity level.
CVE-2026-96524 is a Cross-Site Request Forgery (CSRF) vulnerability in the MCP Server for WordPress plugin versions before 1.8.2. The plugin fails to properly verify the WordPress REST API nonce for cookie-authenticated requests under certain attacker-influenced conditions. This flaw allows unauthenticated attackers to trick logged-in administrators into performing administrator-only actions, such as creating new administrator accounts, by visiting crafted pages.
Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_validated, is_validate_request_approved, approved_by, and related pending-request state through an HTTP GET before calling attendance.save(), so Django does not require CSRF validation for the action. An unauthenticated attacker can cause a logged-in manager with attendance.change_attendance to make a top-level request that carries the manager's SameSite=Lax session cookie, silently approving attendance with the victim's privileges and attributing the approval to the victim in the audit trail. This issue is fixed in version 2.0.0.
Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery.
This issue affects Elementor Website Builder: from n/a through 4.3.1.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the LoginRadius backend of python-social-auth's social-core component prior to version 5.0.0. This flaw allows an attacker to trick a victim's browser into completing an authentication process using an attacker-controlled LoginRadius token, effectively logging the victim in as the attacker. The vulnerability is fixed in version 5.0.0 by enabling OAuth state validation during the authentication flow.
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products() action. All other administrative AJAX endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, and collections) accepted state-changing requests without checking anti-CSRF tokens. An attacker could trick a logged-in administrator into triggering unauthorized state modifications across the store backend. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods (POST, PUT, PATCH, DELETE) via Session::checkToken().
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site's sender name and email address via forged requests from an admin's browser. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') and adding explicit administrative authorization verification via AccessControl::create()->canAdmin().