By weakness (CWE)

CWE-352: related vulnerabilities

CVEs classified under CWE-352. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

134 published vulnerabilities · page 2 of 2

• CVE-2026-4071MEDIUM 4.3

  The BirdSeed WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to change the plugin's authentication token without the site administrator's knowledge. An attacker can craft a malicious link or webpage that, when clicked by an admin, silently modifies the BirdSeed token stored in the site's database. This breaks the trust chain between your WordPress site and the BirdSeed service. The vulnerability affects all versions up to and including 2.2.0 and requires social engineering—tricking an administrator into clicking a link—but no authentication or special privileges are needed from the attacker's side.

• CVE-2026-48518MEDIUM 4.3

  MultiJuicer, a platform for running isolated Juice Shop instances on Kubernetes clusters, contains a cross-site request forgery (CSRF) vulnerability in its team join endpoint. Versions 8.0.0 through 10.0.0 accept requests regardless of content type, allowing attackers to craft web pages that silently add victims to attacker-controlled teams. When a victim visits an attacker's page, their browser automatically submits a form to the vulnerable endpoint, enrolling them in the attacker's team without their knowledge. This causes victims to unknowingly solve security challenges under the attacker's identity, inflating scores and exposing any sensitive data entered during exercises. The attack requires no prior authentication and bypasses standard CORS protections and SameSite cookie policies.

• CVE-2026-53736MEDIUM 4.3

  Easy Twitter Feeds versions before 1.2.13 have a cross-site request forgery (CSRF) vulnerability in their post duplication feature. An attacker can craft a malicious link that, when clicked by a logged-in user, will automatically duplicate posts without the user's knowledge or consent. The vulnerability exists because the plugin fails to validate that duplication requests actually came from the user, making it trivial for attackers to abuse the feature via social engineering or injected links.

• CVE-2026-53739MEDIUM 4.3

  Yoast Duplicate Post, a popular WordPress plugin for content management, contains a cross-site request forgery (CSRF) flaw in versions through 4.6. The vulnerability allows an attacker to craft a malicious webpage or email that, when visited by a logged-in WordPress administrator, automatically suppresses admin notices across the entire network without the admin's knowledge or consent. No special technical skill is required to exploit this—only the ability to trick an admin into clicking a link or visiting a page.

• CVE-2026-57283MEDIUM 4.3

  A CSRF vulnerability in Jenkins Pipeline: Groovy Plugin allows authenticated attackers to manipulate job or system configuration through the Pipeline Snippet Generator without requiring user interaction. An attacker with valid Jenkins credentials can craft malicious requests that, when processed by a targeted Jenkins administrator or user, result in unintended configuration changes. This is a cross-site request forgery issue, meaning the attack leverages the trust relationship between a user and Jenkins to perform unauthorized actions.

• CVE-2026-57290MEDIUM 4.3

  A cross-site request forgery (CSRF) flaw in the Jenkins Priority Sorter Plugin versions 936.v2c01c6b_84449 and earlier allows attackers to trick administrators into unknowingly changing the plugin's job priority settings. An attacker can craft a malicious link or webpage that, when visited by a logged-in Jenkins administrator, silently modifies how jobs are prioritized in the queue—potentially disrupting workflow fairness or enabling job manipulation for malicious purposes.

• CVE-2026-57637MEDIUM 4.3

  The Abandoned Cart Lite for WooCommerce plugin up to version 6.8.0 contains a Cross Site Request Forgery (CSRF) vulnerability that does not require authentication. This means an attacker can craft a malicious webpage or email that, when visited by a logged-in WordPress administrator or user with relevant permissions, triggers unintended actions within the plugin without the user's knowledge or consent. The attacker cannot steal data directly, but can manipulate the plugin's behavior—such as modifying cart recovery settings or email configurations—by leveraging the user's existing session.

• CVE-2026-57657MEDIUM 4.3

  Gmail SMTP versions 1.2.3.19 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user without their knowledge or consent. An attacker can craft a malicious webpage or email that, when visited by a Gmail SMTP user, silently executes unwanted commands in their email session. This attack requires user interaction (visiting a malicious link or page) but does not require the attacker to authenticate.

• CVE-2026-58315MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability in SEIKO EPSON Web Config allows an attacker to trick a logged-in user into unknowingly performing unintended operations. An attacker could craft a malicious webpage that, when viewed by someone authenticated to the Web Config interface, silently executes administrative commands on their behalf. The vulnerability requires user interaction—the victim must actively visit the attacker's page while already logged in—but does not require the attacker to know or steal credentials.

• CVE-2026-59520MEDIUM 4.3

  CrawlWP SEO, a WordPress plugin for SEO crawling and analysis, contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. An attacker can craft a malicious webpage or email that, when visited by a logged-in administrator or user with relevant permissions, triggers unintended changes to the plugin's settings or configuration without the user's knowledge or consent. The vulnerability affects CrawlWP SEO versions up to and including 3.0.16.

• CVE-2026-6292MEDIUM 4.3

  The MP Customize Login Page WordPress plugin contains a CSRF vulnerability affecting all versions up to 1.0. An attacker can trick an administrator into visiting a malicious website that submits a forged request to change plugin settings—such as the login page background, logo, colors, and messages. The vulnerability exists because the plugin's nonce validation is inverted (it rejects valid requests instead of invalid ones) and missing a required parameter, making the security check completely ineffective. Unauthenticated attackers can exploit this without needing any special privileges.

• CVE-2026-6440MEDIUM 4.3

  The GoodMeet plugin for WordPress, which integrates Google Meet into sites, has a security flaw in versions 1.1.8 and earlier. An attacker can trick a site administrator into visiting a malicious link, which would silently delete the plugin's Google Meet API credentials. This doesn't directly expose sensitive data or let attackers log in, but it disables the Google Meet feature on the affected site and forces administrators to reconfigure it. The vulnerability exists because the plugin fails to use a security token (nonce) to verify that credential-reset requests are legitimate.

• CVE-2026-7047MEDIUM 4.3

  The Frontend User Notes plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions through 2.1.1. An attacker can craft a malicious webpage that, when visited by a logged-in WordPress user, silently overwrites that user's own notes without their knowledge or consent. The attack requires social engineering—tricking the victim into clicking a link or visiting a malicious site—but once successful, allows unauthorized modification of the victim's note content. Importantly, the vulnerability is self-contained: attackers cannot use it to tamper with other users' notes, only those belonging to the person they've tricked.

• CVE-2026-7533MEDIUM 4.3

  The Easy Digital Downloads plugin for WordPress contains a security flaw that allows attackers to hijack a store's Square payment processing account. An attacker can send a malicious link to a WordPress administrator; if clicked while logged in, the link silently changes the store's Square payment credentials to attacker-controlled ones, redirecting future payments to the attacker. The vulnerability exists because the plugin does not verify that payment configuration requests come from legitimate, authorized actions—a standard web security practice called CSRF protection.

• CVE-2026-8422MEDIUM 4.3

  The Remove meta boxes per user role WordPress plugin contains a security flaw that allows attackers to change how meta boxes (content panels) are hidden or shown for different user roles on a WordPress site. An attacker can't do this directly, but by tricking a site administrator into clicking a malicious link, the attacker can force the admin's browser to make unauthorized changes to these visibility settings. The vulnerability affects all versions up to and including 1.01.

• CVE-2026-8902MEDIUM 4.3

  The AJAX Report Comments plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 2.0.4. An attacker can trick a WordPress site administrator into unknowingly changing critical plugin settings—such as notification email addresses, comment thresholds, success messages, and cookie durations—by crafting a malicious link or webpage. The attack requires social engineering to get an admin to click a link, but once successful, the attacker can alter how the plugin behaves without any authentication.

• CVE-2026-8904MEDIUM 4.3

  The FastPicker plugin for WordPress, which integrates order picking and management capabilities with WooCommerce, contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.0.2. An attacker cannot exploit this vulnerability directly; instead, they must trick a WordPress site administrator into clicking a malicious link while logged in. If successful, the attacker can alter critical plugin settings—including webhook toggles and API endpoint URLs for FastPicker and KDZ services—without the administrator's knowledge or consent. This is a configuration-tampering risk rather than a direct data breach vector.

• CVE-2026-8909MEDIUM 4.3

  The WpMobi WordPress plugin contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick administrators into modifying plugin settings and injecting malicious scripts. An unauthenticated attacker can craft a malicious link or webpage that, when clicked by a site admin, silently changes the plugin's General Settings without the admin's knowledge or consent. The vulnerability is particularly concerning because the injected script executes in the admin's browser even when the malicious input fails validation, meaning the attack works regardless of server-side data checks.

• CVE-2026-8940MEDIUM 4.3

  The WP Meta Sort Posts WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 0.9. An attacker can craft a malicious link or webpage that, when clicked by an administrator, silently changes plugin settings without their knowledge or consent. Specifically, the vulnerability allows modification of the msp_loop_file and msp_nav_location settings. This is possible because the plugin fails to properly validate security tokens (nonces) on the options page. The attack requires social engineering to trick an admin into clicking a link, but once successful, can alter how the plugin sorts and displays posts on the website.

• CVE-2026-8944MEDIUM 4.3

  A WordPress plugin called 'Plugin for Google Analytics by IO technologies' (versions 1.1 and earlier) fails to properly validate requests made to its settings page. This allows an attacker to trick a site administrator into clicking a malicious link that would change the plugin's Google Analytics tracking ID without the admin's knowledge or consent. The attacker cannot see sensitive data or crash the site, but can redirect analytics to their own account, potentially allowing them to spy on site traffic.

• CVE-2026-9599MEDIUM 4.3

  The Tectite Forms plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.3. An attacker can trick a site administrator into clicking a malicious link, which then allows the attacker to change the plugin's settings without the administrator's knowledge. This could include modifying the tectite_forms_button option or other plugin configurations. The vulnerability requires social engineering but poses a real risk to WordPress sites using this plugin.

• CVE-2026-9618MEDIUM 4.3

  The PeachPay plugin for WordPress, which integrates payment processing for Stripe, PayPal, Square, and other providers, contains a cross-site request forgery (CSRF) vulnerability in all versions up to 1.120.46. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently deletes all stored Stripe credentials from the site's database without the administrator's knowledge or consent. This disables Stripe payments immediately and requires the administrator to reconfigure the integration. The attack requires social engineering to trick an admin into clicking the link, but requires no special authentication or technical sophistication once the admin takes the bait.

• CVE-2026-9719MEDIUM 4.3

  The LatePoint WordPress plugin, which handles calendar booking and appointment scheduling, contains a security flaw that allows attackers to manipulate invoice statuses without proper authorization. An attacker can craft a malicious link or webpage and, if they trick a WordPress administrator into clicking it, change the status of any invoice—including fraudulently marking unpaid invoices as paid. This works because the plugin fails to properly validate requests before processing status changes.

• CVE-2026-9721MEDIUM 4.3

  The Book a Room Event Calendar WordPress plugin fails to protect its settings page against Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious webpage or email that, when clicked by a site administrator, silently changes critical plugin configuration—including database host, credentials, encryption keys, and registration URLs—without the administrator's knowledge or consent. All versions up to 1.9 are affected. The vulnerability requires social engineering (tricking an admin to click a link) but carries no additional barriers once that click happens.

• CVE-2026-9722MEDIUM 4.3

  The Laiser Tag plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions through 1.2.5. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently modifies critical plugin settings without the administrator's knowledge or consent. This includes changes to API keys, tag filtering rules, and tagging behavior—settings that directly control how the plugin functions across the site.

• CVE-2026-9723MEDIUM 4.3

  The Google Plus One Bottom plugin for WordPress contains a cross-site request forgery (CSRF) flaw that allows attackers to manipulate plugin settings without proper authorization. An attacker can craft a malicious link or web page that, when clicked by a site administrator, will change critical plugin configuration options—such as language preferences, callback functions, and URLs—without the administrator's knowledge or consent. This attack requires social engineering to trick an admin into clicking the malicious link, but requires no authentication or technical exploit code to execute.

• CVE-2026-9724MEDIUM 4.3

  The MotorDesk plugin for WordPress has a cross-site request forgery (CSRF) vulnerability that allows an attacker to trick a site administrator into unwittingly changing the plugin's settings. By crafting a malicious link or webpage, an unauthenticated attacker can alter critical configuration like the search page URI and custom template directory path if they can convince an admin to click a link while logged in. The vulnerability affects all versions up to and including 1.1.2 and requires social engineering but poses a real risk to site integrity and functionality.

• CVE-2026-9730MEDIUM 4.3

  The Remove NoFollow Commenter URL plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows unauthenticated attackers to change how the plugin displays comments. An attacker can craft a malicious link or webpage that, when clicked by a WordPress site administrator, silently modifies the plugin's comment settings without the administrator's knowledge or consent. This requires social engineering to trick an admin into visiting the attacker's content, but requires no special technical skills to exploit once that condition is met.

• CVE-2026-9731MEDIUM 4.3

  The Wp Js Detect plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows attackers to manipulate plugin settings without proper authorization. By tricking a site administrator into clicking a malicious link, an attacker can change the plugin's notification text and CSS settings, then inject harmful content that appears on the website to visitors. The vulnerability affects all versions up to 1.0.9 and requires no special privileges or technical sophistication to exploit.

• CVE-2026-9732MEDIUM 4.3

  The EmergencyWP plugin for WordPress has a security flaw that allows attackers to change important plugin settings without authorization. An attacker would need to trick a WordPress site administrator into clicking a malicious link, but if successful, they could alter access controls, email addresses, and other critical configurations. This is a cross-site request forgery (CSRF) vulnerability caused by the plugin failing to properly validate requests before processing them.

• CVE-2026-57306MEDIUM 4.2

  A CSRF vulnerability in the Jenkins Zowe zDevOps Plugin allows an attacker with login access to Jenkins to trick an authenticated user into performing actions that connect to attacker-controlled systems. By exploiting this flaw, an attacker can force Jenkins to use stored credentials to establish connections to malicious endpoints, potentially exposing those credentials to capture. The vulnerability requires an attacker to already know or obtain valid credential IDs from Jenkins, limiting the immediate exposure scope but creating a clear escalation path for authenticated threats.

• CVE-2026-13944LOW 3.1

  Google Chrome on macOS contains a flaw in how it handles data transfers that could allow an attacker to trick users into exposing information across website boundaries. The vulnerability requires the attacker to convince the user to perform specific interactions with a malicious webpage. This is a low-severity issue affecting Chrome versions before 150.0.7871.47 on Mac systems.

• CVE-2026-13963LOW 3.1

  A vulnerability in Google Chrome's developer tools allows an attacker to trick users into revealing sensitive information from other websites through a specially crafted web page. The attack requires the user to perform specific interactions with Chrome's UI, such as clicking or dragging elements in a particular way. While the risk is considered low due to these interaction requirements and the limited scope of data exposure, organizations should still apply the patch to eliminate the attack surface.

• CVE-2026-53663LOW 3.1

  React Router versions 7.12.0 through 7.15.0 had incomplete cross-site request forgery (CSRF) protections in Framework Mode. The framework checked for CSRF tokens on POST requests but skipped this validation entirely for PUT, PATCH, and DELETE requests. However, the practical risk is limited because modern browsers already enforce CORS preflight checks and SameSite cookie policies that prevent most cross-origin attacks. The issue is resolved in React Router 7.15.1.