By weakness (CWE)

CWE-352: related vulnerabilities

CVEs classified under CWE-352. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

134 published vulnerabilities · page 1 of 2

• CVE-2025-68052HIGH 8.8

  Eagle Booking versions 1.3.4.3 and earlier contain an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to trick users into performing unwanted actions within the application without their knowledge or consent. Because no authentication is required to exploit this flaw, any attacker can craft a malicious webpage or email that, when visited by a logged-in Eagle Booking user, silently executes actions like modifying bookings, changing settings, or deleting data on the victim's behalf.

• CVE-2026-12158HIGH 8.8

  The RegistrationMagic plugin for WordPress has a cross-site request forgery (CSRF) vulnerability affecting all versions through 6.0.9.1. An attacker can craft a malicious link or automation task that, when clicked by a site administrator, escalates an arbitrary user's privileges to administrator level without the admin's knowledge or consent. The attack exploits insufficient protection against forged requests in the plugin's form processing function.

• CVE-2026-15070HIGH 8.8

  The Salon Booking System plugin for WordPress contains a critical flaw that allows attackers to execute malicious code on vulnerable websites. An attacker can craft a deceptive link that, when clicked by a site administrator, injects harmful PHP code into a plugin file. This happens because the plugin fails to properly validate requests before making changes, and its input filtering doesn't block the special characters needed to break out of safe code boundaries. No authentication is required from the attacker's side—only social engineering to get an admin to click the link.

• CVE-2026-22342HIGH 8.8

  A vulnerability in WordPress Dating Theme versions 11.2.0 and earlier allows attackers to perform unwanted actions on behalf of site visitors without their knowledge or consent. An attacker can craft a malicious webpage that, when visited by an authenticated site administrator or user, triggers hidden requests that modify site settings, create accounts, or alter content. No special privileges are required to launch the attack, but it does depend on tricking a user into visiting a compromised or attacker-controlled page while logged into their WordPress site.

• CVE-2026-4275HIGH 8.8

  The Divi Torque Lite plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions through 4.2.3. An attacker can trick a logged-in WordPress administrator into visiting a malicious webpage, which silently installs arbitrary plugins on the site without the admin's knowledge or consent. The flaw exists because the plugin's REST API endpoints for installing and activating plugins rely solely on WordPress session cookies for authentication, omitting the additional CSRF token verification that WordPress normally requires. This means an attacker doesn't need to know the admin's password—they only need the admin to be logged in when they visit the attacker's page.

• CVE-2026-43985HIGH 8.8

  Tautulli, a Python-based tool that monitors and manages Plex Media Server, contains a critical flaw in how it handles administrator settings changes. In versions before 2.17.1, an attacker can trick a logged-in administrator into visiting a malicious webpage, which silently changes the Tautulli admin username and password without the administrator's knowledge or consent. Once the credentials are changed, the attacker can log in directly and gain complete control of the Tautulli interface. This is a straightforward but dangerous type of attack that exploits the trust between a user's browser and the Tautulli server.

• CVE-2026-52784HIGH 8.8

  OpenProject versions before 17.3.3 and 17.4.1 contain a Cross-Site Request Forgery (CSRF) vulnerability that allows an authenticated attacker to change a user's admin status without their knowledge or consent. The vulnerability exists in the user management endpoint and can be exploited through a malicious webpage or email that tricks an administrator into performing unintended actions. This is a serious privilege escalation risk in multi-user environments.

• CVE-2026-52800HIGH 8.8

  Gogs, a self-hosted Git service, contains a cross-site request forgery (CSRF) vulnerability in organization team management that allows an attacker to add themselves as an owner of an organization without explicit user consent. An attacker can craft a malicious link that, when clicked by a logged-in organization owner, silently grants the attacker owner-level privileges. This attack requires no special access or technical skill from the attacker—only social engineering to trick a victim into clicking a link. The vulnerability affects all versions prior to 0.14.3.

• CVE-2026-55741HIGH 8.8

  Cotonti 1.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in its administration panel configuration handler. When an authenticated administrator visits a malicious webpage, an attacker can trick the browser into sending forged requests that modify core system settings, module configurations, or plugin options without the administrator's knowledge or consent. Unlike other administrative functions in Cotonti, the configuration update handler does not validate the anti-CSRF token before processing changes, leaving it exposed to this attack vector.

• CVE-2026-57659HIGH 8.8

  A vulnerability in Paid Memberships Pro version 0.7.2 and earlier allows an attacker to trick an administrator into performing unintended actions without their knowledge or consent. By crafting a malicious webpage or email, an attacker can force a logged-in admin to unwittingly create, modify, or delete member accounts. The attack requires no special access or authentication—only that the target admin visits a compromised link while logged into the WordPress admin panel.

• CVE-2026-57766HIGH 8.8

  WPIDE – File Manager & Code Editor versions 3.5.6 and earlier contain an unauthenticated cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage or email that, when visited by a logged-in WordPress administrator, tricks their browser into performing unwanted actions within WPIDE without their knowledge or consent. Because the plugin fails to validate the source of requests, an unauthenticated attacker can leverage this to modify files, execute code, or alter plugin settings.

• CVE-2026-58143HIGH 8.8

  Cotonti Siena versions 0.9.26 and earlier contain a CSRF vulnerability in the admin configuration handler. An attacker can trick a logged-in administrator into visiting a malicious webpage or clicking a crafted link, which silently modifies admin settings. Specifically, the attacker can disable the file extension whitelist in the PFS (file upload) module, allowing any user with upload access to execute arbitrary PHP code on the server. The vulnerability exists because the admin.php config update endpoint fails to validate CSRF tokens before accepting configuration changes.

• CVE-2026-59148HIGH 8.8

  Mockoon, a tool for designing and running mock APIs, contains a critical flaw in its administrative interface that leaves it wide open to unauthorized access and manipulation. The admin API—which is enabled by default and runs on the same port as user-defined mock routes—accepts requests from any source without requiring authentication or checking the caller's identity. An attacker who can reach the mock server port can steal environment variables containing sensitive configuration data, modify how the mock API behaves by rewriting routes and responses, access transaction logs, and disrupt service availability. The vulnerability was introduced in the default configuration and is resolved in version 9.7.0.

• CVE-2026-49471HIGH 8.3

  Serena is a widely-used AI coding toolkit that includes a web dashboard for interacting with its semantic retrieval and code editing features. Before version 1.5.2, this dashboard ran an unprotected API server on a predictable port without authentication, CSRF defenses, or Host validation. An attacker can exploit this by crafting a malicious webpage; when a user visits it while Serena is running, the attacker's page can communicate directly with the local API via DNS rebinding and inject malicious commands into Serena's persistent memory. Because Serena autonomously reads and executes those commands—particularly through its shell command execution feature—the injected payload runs with the user's privileges. The attack requires only that the victim click a link; no special network position or prior compromise is needed.

• CVE-2026-57655HIGH 8.2

  Child Theme Wizard, a WordPress plugin used by developers to create custom child themes, contains an unauthenticated cross-site request forgery vulnerability affecting versions 1.4 and earlier. An attacker can trick an authenticated WordPress admin into performing unintended actions—such as modifying plugin settings, creating malicious child themes, or altering site configuration—without the admin's knowledge or consent. The attack requires no special technical skill beyond crafting a malicious link or webpage and tricking an admin into visiting it while logged into WordPress.

• CVE-2026-12740HIGH 8.1

  Plack::Middleware::OAuth versions up to 0.10 contain a critical flaw in how they handle OAuth 2.0 login flows. The middleware fails to implement the OAuth 2.0 state parameter, which is a security mechanism designed to prevent attackers from hijacking login sessions. An attacker can exploit this by completing an OAuth authorization with their own account and tricking a victim into using that authorization callback. The victim's session would then become logged in as the attacker, potentially granting the attacker permanent access to the victim's account if it becomes linked in the application.

• CVE-2026-12746HIGH 8.1

  Dancer2::Plugin::Auth::OAuth::Provider (Perl library) before version 0.23 fails to implement a critical security check during OAuth 2.0 login flows. The plugin doesn't generate or validate a 'state' parameter—a token that binds an authorization request to a specific user session. This omission allows attackers to hijack login sessions through cross-site request forgery (CSRF). An attacker can initiate an OAuth login with their own account, capture the resulting authorization code, and trick a victim into using it. The victim's session then incorrectly completes the login as the attacker, potentially granting the attacker persistent access to the victim's account if the application links OAuth identities to user profiles.

• CVE-2026-38057HIGH 8.1

  The iDirect iQ200 satellite communication device is vulnerable to cross-site request forgery (CSRF) attacks on its administrative control interface. An attacker can trick an authenticated administrator into visiting a malicious webpage that silently triggers a device reboot by exploiting the lack of CSRF token validation and improper session cookie configuration. This can lead to immediate loss of satellite connectivity and, if repeated, sustained service disruption.

• CVE-2026-43735HIGH 8.1

  A vulnerability in Apple's Safari browser and related operating systems allows attackers to steal sensitive data from users by tricking them into visiting a malicious website. The flaw bypasses security boundaries that normally prevent websites from accessing data belonging to other websites, creating a cross-origin data leakage risk. Users must visit the malicious site for the attack to work, but no other user interaction beyond clicking a link is required.

• CVE-2026-55744HIGH 8.1

  Cotonti 1.0.0 contains a cross-site request forgery (CSRF) vulnerability in its Personal File Storage module that allows an attacker to trick authenticated users into uploading files to their account without their knowledge. The vulnerability exists because the file upload function fails to validate an anti-CSRF token that should prevent such unauthorized requests. An attacker can craft a malicious webpage that, when visited by a logged-in Cotonti user, silently triggers file uploads to that user's storage.

• CVE-2026-57751HIGH 8.1

  A CSRF vulnerability in Heateor Social Login version 1.1.39 and earlier allows attackers to trick authenticated users into performing unwanted actions without their knowledge. Unlike many CSRF flaws, this one does not require the attacker to be authenticated first—any malicious actor can craft a request that, when clicked or visited by a legitimate user, will execute actions on their behalf. The vulnerability is considered high-risk because it can lead to account compromise or unauthorized changes.

• CVE-2026-59713HIGH 8.1

  Leantime's OIDC (OpenID Connect) single sign-on implementation contains a critical flaw in how it validates login callbacks. When users are redirected back from an identity provider after authentication, Leantime fails to properly verify that the response came from a legitimate request. An attacker can trick a victim into clicking a malicious link that logs them into Leantime using the attacker's own credentials, effectively hijacking the victim's session. This is a session fixation attack that requires user interaction but poses a serious risk to multi-user Leantime deployments, especially those relying on OIDC for centralized authentication.

• CVE-2026-6075HIGH 8.1

  The Media Library Assistant plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting versions up to 3.35. The flaw allows attackers to craft malicious web pages or emails that, when viewed by an administrator, can trigger unauthorized bulk operations on plugin settings and attachment metadata without the admin's knowledge or consent. An attacker doesn't need valid WordPress credentials to exploit this—only the ability to trick an admin into visiting a compromised site.

• CVE-2026-6455HIGH 8.1

  WP Contact Form 7 DB Handler, a popular WordPress plugin for managing contact form submissions, contains a critical vulnerability that allows attackers to delete arbitrary files from affected WordPress servers. An attacker can trick an administrator into visiting a malicious webpage, which silently executes commands to remove critical system files—potentially crippling the entire website. The vulnerability chains together three separate weaknesses: a bypassable security check, improper handling of user input in database queries, and unsafe processing of untrusted data. Versions 3.0 and earlier are affected.

• CVE-2026-34171HIGH 8.0

  Coolify, a self-hosted platform for managing servers and applications, contains a flaw in how it handles password reset invitations. An attacker can craft a password reset link and trick a user into clicking it, then reset that user's password to a value the attacker knows in advance. This bypasses normal authentication and gives the attacker full account access. The vulnerability affects Coolify versions before 4.0.0-beta.471 and requires user interaction (clicking a malicious link) to exploit.

• CVE-2026-46787HIGH 8.0

  A vulnerability in Oracle WebCenter Content (version 14.1.2.0.0) allows an unauthenticated attacker to compromise the system and modify or delete critical data. The attack requires tricking a legitimate user into performing an action—the attacker cannot exploit it directly. Because the vulnerability can spread its impact to other connected systems, the overall risk is rated HIGH. An attacker with network access could potentially read, modify, or delete sensitive information stored in WebCenter Content or systems that rely on it.

• CVE-2026-46894HIGH 8.0

  A vulnerability in Oracle's iSupplier Portal—a supplier management component of Oracle E-Business Suite—allows a low-privileged attacker to gain complete control over the portal through a specially crafted request. The flaw requires tricking a legitimate user into interacting with malicious content, but once successful, an attacker can read sensitive data, modify information, or disrupt service availability. Versions 12.2.3 through 12.2.15 are affected.

• CVE-2026-48612HIGH 8.0

  CVE-2026-48612 is a flaw in how OAuth authentication validates state during the login process. An attacker can exploit this by tricking a victim into linking their account to an attacker-controlled account. Once linked, the attacker gains control over the victim's account, effectively taking it over. The vulnerability requires the attacker to have some initial access or credentials and needs user interaction, but the impact—full account compromise—is severe.

• CVE-2026-35266HIGH 7.9

  Oracle REST Data Services contains a vulnerability that allows an attacker with low-level network access and user credentials to manipulate critical data or disrupt service availability. The attack requires tricking another user into taking action, making it moderately difficult to exploit in practice. Versions 24.2.0 through 26.1.0 are affected. Success can lead to unauthorized access, modification, or deletion of sensitive information, as well as partial service outages.

• CVE-2026-11265HIGH 7.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Autofill feature that can allow attackers to steal sensitive data from other websites. An attacker can craft a malicious webpage that, when visited by a user, extracts information that should have been protected by browser isolation mechanisms. The vulnerability requires no user interaction beyond visiting the page and affects confidentiality but not system integrity or availability.

• CVE-2026-46955HIGH 7.5

  A vulnerability in Oracle's Human Resources module within E-Business Suite allows an unauthenticated attacker to potentially take over the system. The attacker would need network access and would require the victim to interact with a malicious link or content—making it a social engineering vector rather than a direct attack. While exploitation is difficult to execute, successful compromise could give an attacker full control over HR data and functions.

• CVE-2026-57723HIGH 7.4

  A Cross-Site Request Forgery (CSRF) vulnerability has been identified in VikBooking Hotel Booking Engine & PMS versions up to 1.8.12. This flaw allows an attacker to manipulate a hotel staff member or administrator into unknowingly performing actions through a malicious website or email link. While the vulnerability is classified as HIGH severity, it does not enable unauthorized data access or theft; instead, it can cause denial of service or operational disruption. The attack requires user interaction and occurs over the network without requiring special access privileges.

• CVE-2026-50132HIGH 7.3

  Budibase prior to version 3.39.0 contains a critical account-linking flaw in its public chat integration endpoint. An attacker can craft a malicious link that, when clicked by an authenticated Budibase user, silently binds that user's account to the attacker's Slack, Discord, or Microsoft Teams identity—without the user's knowledge or consent. This gives the attacker the ability to impersonate the victim within chat-integrated workflows and potentially access sensitive data or perform actions on their behalf. The vulnerability requires no special privileges to exploit and succeeds through simple social engineering (tricking a user into clicking a link).

• CVE-2026-49396HIGH 7.1

  Nezha Monitoring, a self-hosted server and website monitoring tool, contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick users into executing malicious cron commands on connected agents. An attacker can craft a specially designed webpage or email that, when visited by an authenticated Nezha administrator, silently triggers unwanted scheduled tasks on monitored servers. This happens because the application doesn't properly validate requests coming from external sources. The vulnerability affects all versions from 1.0.0 through 2.0.13, and has been resolved in version 2.0.14 and later.

• CVE-2026-57757HIGH 7.1

  pCloud WP Backup versions 2.0.2 and earlier are vulnerable to unauthenticated Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious webpage or email that, when visited by a logged-in WordPress administrator, silently performs unwanted actions on their backup configuration without their knowledge or consent. Because no authentication is required at the CSRF layer, the attack succeeds against any site running the vulnerable plugin, making this a meaningful risk for WordPress installations that use pCloud for backup storage.

• CVE-2026-57758HIGH 7.1

  A cross-site request forgery (CSRF) vulnerability exists in Permalink Manager for WooCommerce versions 1.0.8.2 and earlier. An unauthenticated attacker can trick a logged-in store administrator into performing unwanted actions—such as changing URL structures, modifying settings, or altering content—by crafting a malicious link or page that the admin visits. The vulnerability requires no authentication to exploit and can affect multiple aspects of a store's configuration, making it a meaningful risk for WooCommerce site operators.

• CVE-2026-11020MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles extensions that process XML files. An attacker can craft a malicious XML file that, when processed by a vulnerable extension, leaks sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the user must open or interact with the malicious file—but does not require the attacker to have special privileges or bypass additional security controls. This is a cross-origin data leak, meaning information intended to be isolated between websites can be extracted by an attacker.

• CVE-2026-11083MEDIUM 6.5

  Google Chrome's password manager contained a flaw that could allow an attacker to trick users into leaking sensitive cross-origin data through a specially crafted webpage. The vulnerability requires user interaction—such as visiting a malicious site—but poses a meaningful risk because password managers are trusted to protect sensitive credentials and related information. An attacker exploiting this could potentially access data that should remain isolated between different websites.

• CVE-2026-11084MEDIUM 6.5

  A flaw in Google Chrome's password manager allows attackers to trick users into visiting a specially crafted website that can leak sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the victim must click on or interact with a malicious page—but once triggered, it can expose cross-site information that should normally be protected by browser security boundaries. This affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11106MEDIUM 6.5

  A flaw in Google Chrome's media handling allows attackers to trick users into visiting a malicious web page that can steal private data from other websites the user has visited. The vulnerability requires user interaction—someone must click a link or visit the crafted page—but once they do, an attacker can bypass Chrome's normal security boundaries that keep websites isolated from each other. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11129MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles extensions that could allow an attacker to steal sensitive data from websites you visit. An attacker would need to trick you into visiting a malicious webpage, but if successful, they could read information from other sites you have open—potentially including login credentials, private messages, or financial data. This is a medium-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11134MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Media component handles certain HTML content. An attacker can craft a malicious webpage that, when visited by a user, leaks sensitive data that should be restricted to one website (cross-origin data) to an attacker-controlled site. The vulnerability requires user interaction—the victim must visit the crafted page—but no special browser configuration or user privileges are needed. This is a confidentiality risk, not a data destruction or service disruption issue.

• CVE-2026-11139MEDIUM 6.5

  A flaw in Google Chrome's Paint implementation allows attackers to steal sensitive information from one website and expose it to another. An attacker can craft a specially designed web page that, when visited by a user, exploits this vulnerability to read data across security boundaries that browsers normally enforce. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction—the victim must visit the malicious page—but does not require special permissions or system access.

• CVE-2026-11148MEDIUM 6.5

  A vulnerability in Google Chrome's payment processing on Android allows a malicious website to steal sensitive information from other websites you've visited or logged into. An attacker would need you to visit their crafted webpage, but requires no special system access. The issue stems from improper handling of cross-origin security boundaries in the Payments API implementation.

• CVE-2026-11194MEDIUM 6.5

  A vulnerability in Google Chrome's network implementation could allow an attacker to trick users into visiting a specially crafted webpage that leaks sensitive data from other websites the user is logged into. The attack requires user interaction (clicking or visiting the malicious page) but does not require special browser configuration or user privileges. While the confidentiality impact is high, the vulnerability does not allow attackers to modify data or disable services.

• CVE-2026-11195MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles MHTML (MIME Encapsulation of Aggregate HTML Documents) content. An attacker can craft a malicious web page that, when visited by a user who performs specific interactions with the page (such as clicking or other UI gestures), leaks sensitive data from websites the user has visited in other browser tabs or windows. The vulnerability requires user interaction to trigger and does not allow attackers to modify data or crash the browser, but it does enable unauthorized access to cross-origin information that should remain private.

• CVE-2026-11200MEDIUM 6.5

  A flaw in Google Chrome's WebRTC implementation allows attackers to steal private data from other websites through a malicious HTML page. An attacker would need to trick a user into visiting their crafted webpage while Chrome is running, but no special technical privileges are required. The vulnerability affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11214MEDIUM 6.5

  A flaw in Google Chrome for iOS allows attackers to trick users into visiting a malicious website that can leak data from other websites the user has open in their browser. The attacker needs the victim to interact with the malicious page (such as clicking a link), but no special technical skills or authentication are required on the attacker's side. This is a cross-origin data leak vulnerability affecting Chrome on iPhones and iPads running iOS.

• CVE-2026-11270MEDIUM 6.5

  Google Chrome on Android versions before 149.0.7827.53 contain a UI implementation flaw that allows attackers to trick users into visiting specially crafted web pages, potentially exposing sensitive data from other websites the user has visited or is logged into. The vulnerability requires user interaction (clicking a link or visiting a malicious page) but poses a meaningful confidentiality risk by circumventing the browser's cross-origin protections.

• CVE-2026-13826MEDIUM 6.5

  A flaw in Chrome's autofill feature on Android could allow an attacker who has already compromised your browser's rendering process to steal sensitive data from other websites you visit. The attacker would need to trick you into visiting a specially crafted webpage, but once you do, they can extract information that should normally be hidden between different websites.

• CVE-2026-13887MEDIUM 6.5

  This vulnerability affects Google Chrome on Android devices running versions before 150.0.7871.47. An attacker who has already compromised Chrome's renderer process—the component that interprets web pages—can craft a malicious HTML page to extract sensitive data from websites the user visits, even if those sites are on different domains. The attacker cannot modify or delete data, only read it. This is a medium-severity issue that requires the user to visit a malicious page after the renderer is already compromised.

• CVE-2026-14016MEDIUM 6.5

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how SVG (Scalable Vector Graphics) content is processed that could allow an attacker to steal sensitive data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but once there, the vulnerability could be exploited to access information the user has access to on other sites—bypassing the browser's normal cross-origin security boundary.

• CVE-2026-31016MEDIUM 6.5

  Squidex CMS versions 7.21.0 and earlier contain a Cross-Site Request Forgery (CSRF) flaw that allows an unauthenticated attacker to perform unauthorized actions on behalf of authenticated users. The vulnerability specifically targets the IdentityServer account profile endpoint, enabling privilege escalation. An attacker could trick a logged-in administrator or user into unknowingly executing malicious requests that modify account settings or elevate permissions.

• CVE-2026-42073MEDIUM 6.5

  OpenClaude, an open-source command-line tool for interacting with cloud and local AI models, has a flaw in how it handles user login. When you authenticate using OAuth, the software runs a temporary web server locally to catch the login response. To prevent attackers from hijacking this process, the server checks a security token called a 'state parameter.' However, due to a bug in how the code checks this token, an attacker can bypass the security check entirely and crash the server without even knowing what the token is. This has been fixed in version 0.5.1 and later.

• CVE-2026-46869MEDIUM 6.5

  CVE-2026-46869 is a medium-severity vulnerability in Oracle MySQL Shell (versions 8.4.0–8.4.9 and 9.0.0–9.7.0) that allows an unauthenticated attacker on the network to access sensitive data stored within MySQL Shell. The attack requires a person to interact with a malicious input or link, but once triggered, an attacker can read confidential information without needing to authenticate. No integrity or availability impact occurs—this is purely a data exposure risk.

• CVE-2026-56024MEDIUM 6.5

  A cross-site request forgery (CSRF) vulnerability exists in WP EasyPay, a WordPress payment plugin by Saad Iqbal, affecting versions up to and including 4.5.0. CSRF flaws allow attackers to trick authenticated users into performing unintended actions—such as modifying settings, initiating transactions, or changing configuration—without their knowledge. Because this vulnerability requires no special privileges or authentication from the attacker's perspective, any unauthenticated user can craft a malicious link or embed it in a webpage to exploit WordPress site administrators.

• CVE-2026-57635MEDIUM 6.5

  FunnelKit Payment Gateway for Stripe, a WooCommerce plugin, contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 1.14.0.3. An attacker can trick users into performing unwanted actions—such as modifying payment settings or processing unauthorized transactions—by crafting a malicious webpage and enticing a victim to visit it while logged into their WooCommerce store. No authentication is required from the attacker, and the victim's browser automatically includes their session credentials, making the attack silent and difficult to detect.

• CVE-2026-57641MEDIUM 6.5

  Real Estate 7 versions 3.5.9 and earlier are vulnerable to cross-site request forgery (CSRF) attacks that do not require prior authentication. An attacker can trick a user into unknowingly triggering malicious actions within the application by hosting a specially crafted webpage or email. Since the vulnerability allows unauthenticated exploitation, any visitor to a compromised site or user who clicks a malicious link is at risk, regardless of whether they have an active session in Real Estate 7.

• CVE-2026-39170MEDIUM 6.3

  SemCms 5.0 contains a cross-site request forgery (CSRF) vulnerability in its user administration interface. An attacker can craft a malicious webpage or email that, when visited by a logged-in administrator, silently performs unauthorized actions on the SemCms instance—such as creating new admin accounts, modifying permissions, or deleting users. The vulnerability requires an authenticated admin to be tricked into visiting the attacker's content, but no additional user interaction (like clicking a button) is needed once they arrive.

• CVE-2026-58518MEDIUM 6.3

  A cross-site request forgery (CSRF) vulnerability exists in the Mediawiki RedirectManager Extension. This flaw allows an attacker to trick a logged-in user into performing unintended actions on a Mediawiki instance without the user's knowledge or consent. The vulnerability affects versions before 1.3.3 and can result in unauthorized changes to redirects or other modifications depending on the attacker's objectives and the target user's permissions.

• CVE-2026-8905MEDIUM 6.1

  The Osiris Signature Banner plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions up to and including 0.5. An attacker can craft a malicious link or webpage that, when clicked by a logged-in site administrator, allows the attacker to change plugin settings and inject malicious scripts into the site without the administrator's knowledge or consent. The attack requires social engineering—tricking an admin into clicking a link—but once successful, it can compromise site integrity and inject persistent malicious content.

• CVE-2026-8907MEDIUM 6.1

  WP-Ultimate-Map, a WordPress plugin for displaying maps, has a security flaw that allows attackers to secretly change plugin settings and inject malicious code. The vulnerability exists because the plugin doesn't properly verify that setting changes are legitimate (a technique called CSRF protection), and doesn't clean up user input before displaying it. An attacker can trick a site administrator into clicking a malicious link, which would silently alter map zoom levels or other settings and potentially inject JavaScript that runs when the admin visits the plugin's settings page.

• CVE-2026-8910MEDIUM 6.1

  The WP Emoticon Rating plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.0.1. An attacker can craft a malicious link or webpage that, when clicked by an authenticated site administrator, performs unauthorized actions—specifically updating plugin settings and injecting malicious scripts. The vulnerability stems from inadequate nonce validation, a WordPress security mechanism that prevents unauthorized automated requests. Exploitation requires social engineering; the attacker cannot directly attack the site but must trick an admin into visiting a crafted page.

• CVE-2026-45610MEDIUM 5.7

  WWBN AVideo, an open-source video hosting platform, contains a cross-site request forgery (CSRF) flaw that allows an attacker to disable two-factor authentication (2FA) on a victim's account without their knowledge. If a logged-in AVideo user visits a malicious website controlled by an attacker, that site can silently turn off the victim's 2FA protection in a single HTTP request. This happens because the vulnerable endpoint doesn't validate the origin of the request or require re-authentication. Once 2FA is disabled, the account becomes significantly easier to compromise if credentials are later leaked or guessed.

• CVE-2026-34460MEDIUM 5.4

  NamelessMC, a website platform for Minecraft servers, contains a vulnerability in how it handles OAuth authentication callbacks. When a user logs in via OAuth (a third-party authentication method), the application fails to verify a security token called a 'state parameter' before accepting the login. An attacker can exploit this by crafting a malicious link that tricks a victim into logging in with the attacker's own account credentials. Once clicked, the victim's session becomes authenticated as the attacker, potentially granting unauthorized access to the victim's account on that NamelessMC instance. The vulnerability affects NamelessMC versions 2.2.4 and earlier.

• CVE-2026-55745MEDIUM 5.4

  Cotonti 1.0.0 contains a cross-site request forgery (CSRF) vulnerability in its Personal File Storage module. When an authenticated user visits a malicious website, an attacker can trick their browser into sending unauthorized requests that change folder settings—such as converting a private folder to public—without the user's knowledge or consent. The vulnerability exists because the affected code path doesn't validate anti-CSRF tokens before processing folder updates.

• CVE-2026-57292MEDIUM 5.4

  Jenkins Gitee Plugin versions up to and including 1288.v18b_deb_c9069b_ contain a cross-site request forgery (CSRF) vulnerability that allows authenticated attackers to force actions on the Jenkins instance without explicit user consent. Specifically, an attacker can trick a logged-in Jenkins administrator or user into unknowingly establishing a connection to an attacker-controlled URL using credentials that the attacker has identified. The vulnerability requires the attacker to already know valid credential IDs within the target Jenkins instance, suggesting a multi-stage attack scenario.

• CVE-2026-57295MEDIUM 5.4

  Jenkins EC2 Fleet Plugin versions 4.2.3.539.v8fedff2a_81c3 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows authenticated attackers to manipulate Jenkins into connecting to attacker-controlled URLs using AWS credential IDs they've obtained through other means. This can result in the exposure of AWS credentials stored within Jenkins, compromising cloud infrastructure access.

• CVE-2026-57298MEDIUM 5.4

  The Jenkins Contrast Continuous Application Security Plugin contains a CSRF vulnerability that allows an authenticated attacker to trick Jenkins into making unauthorized connections to attacker-controlled servers using credentials of the attacker's choosing. Because Jenkins typically runs with elevated permissions in CI/CD pipelines, an attacker could abuse this to redirect security scanning traffic, exfiltrate credentials, or poison scan results—all without the Jenkins administrator's knowledge or consent.

• CVE-2026-57305MEDIUM 5.4

  Jenkins Assembla Plugin versions 1.4 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows an attacker with valid Jenkins access to trick an authenticated administrator into executing unintended actions. Specifically, an attacker can force the plugin to connect to an attacker-controlled URL using attacker-supplied credentials, potentially enabling data exfiltration, unauthorized integrations, or further compromise of connected systems.

• CVE-2016-20083MEDIUM 5.3

  The More Fields plugin for WordPress version 2.1 has a cross-site request forgery (CSRF) flaw that allows attackers to trick site administrators into unknowingly modifying custom fields and boxes. An attacker would create a malicious webpage; when an authenticated admin visits it, the attacker's site can silently submit requests to change WordPress settings on behalf of the admin, without the admin's knowledge or consent. The vulnerability stems from insufficient CSRF token validation in the plugin's code.

• CVE-2018-25387MEDIUM 5.3

  HaPe PKH 1.1 contains a cross-site request forgery (CSRF) vulnerability that enables attackers to change administrator passwords without needing to log in. An attacker can trick an authenticated administrator into visiting a malicious website or clicking a crafted link, which silently submits a forged request to modify admin credentials. This allows complete account takeover of administrative users.

• CVE-2018-25397MEDIUM 5.3

  PHP-SHOP 1.0 is vulnerable to cross-site request forgery (CSRF), a class of attack where malicious actors craft hidden web forms designed to trick authenticated administrators into unknowingly adding new admin accounts. An attacker creates a deceptive webpage containing a concealed form that automatically submits admin account creation requests when an authenticated admin visits the page. This allows the attacker to gain administrative control without needing the victim's credentials.

• CVE-2018-25435MEDIUM 5.3

  ZeusCart 4.0 is vulnerable to a cross-site request forgery (CSRF) attack that allows an attacker to trick administrators into unknowingly deactivating customer accounts. By crafting a malicious webpage or email link, an attacker can force an admin to submit a request that disables customer access without their knowledge or consent. The attack requires only that an administrator visit an attacker-controlled page while logged into their ZeusCart admin panel.

• CVE-2026-44342MEDIUM 5.3

  New API, an LLM gateway and AI asset management platform, contains a cross-site request forgery (CSRF) vulnerability in its account binding functionality. Versions before 0.12.0-alpha.1 use GET requests for sensitive operations that should require POST, allowing attackers to trick logged-in users into binding attacker-controlled email addresses or OAuth identities to their accounts without explicit consent. The vulnerability requires an attacker to craft a malicious link or webpage and relies on a user clicking it while authenticated to New API, but the impact—account takeover through OAuth binding—is significant enough to warrant immediate attention.

• CVE-2026-49433MEDIUM 5.0

  DeepAI's email change endpoint lacks CSRF (Cross-Site Request Forgery) protection, allowing attackers to hijack user accounts. An attacker who tricks a logged-in user into visiting a malicious link can silently change that user's email address, potentially locking the legitimate owner out and enabling account takeover. The vulnerability was patched on May 20, 2026.

• CVE-2026-12002MEDIUM 4.7

  A WordPress plugin called Smash Balloon Social Photo Feed contains a security flaw that allows attackers to hijack the site's connection to Instagram and Facebook. The vulnerability exists because the plugin doesn't properly verify that requests to change authentication tokens actually come from authorized administrators. An attacker can craft a malicious link that, when clicked by a site admin, silently swaps out the legitimate access tokens for attacker-controlled ones. This doesn't give immediate visibility into private data, but it severs the site's legitimate social media feeds and could allow the attacker to post content or monitor activity through those accounts.

• CVE-2026-14620MEDIUM 4.7

  webpack-dev-server, a popular development utility for JavaScript applications, contains a cross-site request forgery (CSRF) vulnerability that allows any website a developer visits to secretly perform actions on their local development server. Specifically, two internal endpoints that manage file editing and code recompilation accept requests from external sites without verification. An attacker can craft a malicious webpage that, when opened by a developer, triggers these endpoints to open arbitrary files on the developer's system in their code editor or force wasteful recompilations. The vulnerability affects webpack-dev-server version 5.2.5 and earlier.

• CVE-2026-49043MEDIUM 4.7

  WP Migrate Lite, a WordPress plugin for site migration tasks, contains a CSRF vulnerability affecting versions 2.7.8 and earlier. The flaw allows attackers to trick authenticated WordPress users into performing unintended actions without their knowledge or consent—such as initiating a migration, modifying plugin settings, or exporting site data. The attacker crafts a malicious webpage or email and waits for an admin or privileged user to visit it while logged into their WordPress site. No direct attack on the website itself is required; the vulnerability exploits the trust relationship between the user and the WordPress site.

• CVE-2022-44630MEDIUM 4.6

  A cross-site request forgery (CSRF) vulnerability exists in the YITH WooCommerce Product Slider Carousel plugin for WordPress. The flaw allows an attacker to trick an authenticated administrator into performing unwanted actions on the plugin without their knowledge—such as modifying carousel settings or configurations—by embedding malicious requests in a webpage the admin visits. The vulnerability affects all versions through 1.16.0.

• CVE-2016-20067MEDIUM 4.3

  WordPress CP Polls version 1.0.8 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick administrators into performing unintended actions on their WordPress sites. An attacker can create a malicious webpage that, when visited by a logged-in site administrator, silently executes poll-related operations without the administrator's knowledge or consent. This works because the plugin fails to validate that requests originate from legitimate sources.

• CVE-2016-20074MEDIUM 4.3

  The Lazy Content Slider WordPress plugin version 3.4 is vulnerable to cross-site request forgery (CSRF), a type of attack where an attacker tricks an authenticated site administrator into unknowingly changing the plugin's settings. An attacker would craft a malicious web page that, when visited by a logged-in WordPress admin, silently submits configuration changes to the plugin—such as altering color schemes or display counts—without the administrator's knowledge or consent. This vulnerability requires the attacker to socially engineer an admin into visiting a malicious page, but the actual attack happens without additional user interaction once the admin is tricked.

• CVE-2022-47150MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability exists in weDevs' WooCommerce Conversion Tracking plugin through version 2.0.10. This flaw allows attackers to trick site administrators into performing unintended actions—such as modifying tracking settings or disabling conversion monitoring—by crafting malicious web pages or emails. The attack requires user interaction but does not require authentication, making it a moderate-severity issue for e-commerce sites relying on this plugin.

• CVE-2024-32110MEDIUM 4.3

  The WpEvently WordPress plugin through version 4.1.2 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick authenticated users into performing unintended actions on the site without their knowledge. An attacker can craft a malicious webpage that, when visited by a logged-in WordPress administrator or user, silently executes actions on behalf of that user—such as modifying plugin settings or creating unauthorized content. The vulnerability requires user interaction (visiting a malicious link or page) but does not require the attacker to have direct access to the WordPress installation.

• CVE-2024-34810MEDIUM 4.3

  Skyline WP, a WordPress theme distributed by Extend Themes, contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to trick authenticated administrators into performing unintended actions on the site. An attacker could craft a malicious webpage or email that, when visited by a logged-in WordPress admin, would execute administrative functions without explicit user consent. The vulnerability affects all versions of Skyline WP through version 1.0.10.

• CVE-2024-35648MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability exists in Andy Moyle Emergency Password Reset versions up to and including 8.0. An attacker can craft a malicious web page or email that, when visited by an authenticated user, triggers unintended password reset actions without the user's knowledge or consent. The attack succeeds because the application does not properly validate the origin or intent of password reset requests.

• CVE-2026-10552MEDIUM 4.3

  The Blue Captcha WordPress plugin, through version 2.0.1, is vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently uninstalls the plugin, deletes security audit logs, removes IP addresses from the Hall of Shame blocklist, or adds arbitrary IPs to the banned list—all without the administrator's knowledge or consent. The vulnerability exists because the plugin does not properly validate that requests originate from the legitimate administrator and are intentional.

• CVE-2026-10553MEDIUM 4.3

  The jQuery Hover Footnotes plugin for WordPress contains a flaw that allows attackers to trick site administrators into unknowingly changing plugin settings. When an admin clicks a malicious link, the attacker can alter how the plugin displays content—including injecting malicious code that affects every visitor to the site. The vulnerability chains two separate weaknesses: the ability to forge requests without verification, followed by the ability to inject unescaped code into pages.

• CVE-2026-11155MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how CSS is processed that could allow an attacker to trick a user into visiting a malicious website where sensitive data from other sites (cross-origin data) could be leaked. The attack requires user interaction—specifically clicking a link or visiting a crafted page—but does not require the attacker to have special permissions or bypass other security controls. The leaked information would be visible only to the attacker, not modified or destroyed.

• CVE-2026-11156MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how it handles CSS styling rules that can allow an attacker to extract data from other websites you have open in your browser. An attacker would need to trick you into visiting a malicious webpage, and if successful could read sensitive information from other tabs or windows—such as content from your email, banking site, or other services—that you're simultaneously visiting. This is a cross-origin data leak vulnerability affecting the browser's CSS implementation.

• CVE-2026-11775MEDIUM 4.3

  The User Admin Simplifier WordPress plugin contains a cross-site request forgery (CSRF) flaw that allows an attacker to trick a site administrator into unwittingly resetting or deleting that administrator's saved menu and admin-bar configuration. An attacker can craft a malicious link that, when clicked by an authenticated admin, will overwrite the plugin's stored settings without the admin's knowledge or consent. This requires social engineering—the admin must click a link—but no additional authentication or exploits are needed once that happens.

• CVE-2026-11784MEDIUM 4.3

  The Optimole WordPress image optimization plugin contains a cross-site request forgery (CSRF) vulnerability in its file replacement function. An attacker can craft a malicious link that, when clicked by a site administrator or author, overwrites media files on the WordPress site without their knowledge. The vulnerability affects all versions up to 4.2.6 and requires social engineering to exploit, as the attacker must trick a user into clicking a link. The actual damage is limited to media file replacement since the plugin still checks whether the user has permission to edit the specific post or attachment being targeted.

• CVE-2026-11981MEDIUM 4.3

  The GiveWP WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to disable donation email notifications without authentication. An attacker would need to trick a WordPress site administrator into clicking a malicious link or visiting a compromised page, which would then silently disable the site's donation notification system. This affects GiveWP versions up to and including 4.15.3.

• CVE-2026-11997MEDIUM 4.3

  The Bulk SEO Image WordPress plugin versions up to 1.1 contain a Cross-Site Request Forgery (CSRF) vulnerability in its settings page. An unauthenticated attacker can craft a malicious link or page that, when clicked by a site administrator, will automatically bulk-overwrite the ALT-text metadata for all images across the WordPress site. The vulnerability exists because the plugin fails to implement proper nonce validation—a standard WordPress security mechanism that prevents requests from being executed without explicit authorization.

• CVE-2026-13422MEDIUM 4.3

  The HD Quiz plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting versions 2.2.0 and 2.2.1. The flaw exists in the hdq_validate_nonce function, which fails to properly validate security tokens. An attacker can craft a malicious link or webpage that, if clicked by a site administrator, allows the attacker to perform unauthorized actions without the administrator's knowledge—including deleting or modifying quizzes, creating new quizzes, and altering plugin settings. No special privileges or prior access are required on the attacker's side.

• CVE-2026-13537MEDIUM 4.3

  CodeAstro Human Resource Management System version 1.0 contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to trick users into performing unwanted actions within the HR system. An attacker can craft a malicious link or webpage that, when visited by a logged-in HR employee, silently executes administrative or data-modifying operations on their behalf. The vulnerability affects any network-accessible deployment and exploits have already been disclosed publicly.

• CVE-2026-13946MEDIUM 4.3

  A security flaw in Google Chrome on iOS allows attackers to steal data from different websites by tricking users into viewing a specially crafted webpage. The vulnerability stems from improper handling of script injections, which can expose information that should remain hidden between websites. An attacker needs user interaction—typically clicking a link or visiting a malicious site—to exploit this, making it a moderate rather than critical risk.

• CVE-2026-13952MEDIUM 4.3

  A flaw in Google Chrome's PerformanceAPIs allows attackers to steal data from different websites without proper authorization. An attacker can craft a malicious webpage that, when visited by a user, reads sensitive information from other sites the user has open. The vulnerability requires user interaction—the victim must visit the attacker's page—but no special browser settings or advanced technical knowledge are needed to exploit it. Google has patched this issue in Chrome version 150.0.7871.47 and later.

• CVE-2026-14800MEDIUM 4.3

  A cross-site request forgery (CSRF) flaw has been discovered in imhamzaazam ecommerceFlask, an open-source e-commerce framework. The vulnerability allows an attacker to trick authenticated users into performing unintended actions—such as modifying orders, changing account settings, or making purchases—without their knowledge. The flaw resides in an unspecified function and requires user interaction (clicking a malicious link or visiting a compromised site) to exploit. Public exploit code is available, elevating the practical risk of opportunistic attacks.

• CVE-2026-15034MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability exists in Flask-MonitoringDashboard versions up to 5.0.2. An attacker can craft a malicious web page that, when visited by an authenticated user, performs unwanted actions within the dashboard without the user's knowledge or consent. The vulnerability requires user interaction—the victim must visit the attacker's page while logged into the dashboard—but no special privileges are needed to exploit it. Public disclosure has already occurred, increasing the risk of active exploitation.