CWE-352

Medium likelihood

Cross-Site Request Forgery (CSRF)

Parent: CWE-345 - Insufficient Verification of Data Authenticity

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

9,488 vulnerabilities with CWE-352
CVE-2026-66416 HIGH
Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
CVSS 8.8
CVE-2026-44613 ANALYSIS PENDING
Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
CVE-2026-28813 ANALYSIS PENDING
Apache JSPWiki: JSPWiki vulnerable to JSON hijacking
CVE-2026-5219 HIGH
CSRF in Softtr's E-Commerce Pack
CVSS 8.3
CVE-2026-5582 MEDIUM
FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
CVSS 4.3
CVE-2026-17936 MEDIUM
Google Chrome < 151.0.7922.72 - Navigation Restriction Bypass via DevTools UI Gestures
CVSS 6.5
CVE-2026-2482 LOW
IBM WebSphere Application Server Liberty is affected by a cross-site request forgery
CVSS 3.1
CVE-2026-65947 HIGH
Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
CVSS 7.3
CVE-2026-65944 HIGH
Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0
CVSS 8.8
CVE-2026-9720 MEDIUM
Facturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update
CVSS 4.3
CVE-2026-14234 HIGH
WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
CVSS 7.1
CVE-2026-47725 MEDIUM
nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints
CVE-2026-15136 MEDIUM
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries
CVSS 4.3
CVE-2026-66474 MEDIUM
WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 4.3
CVE-2026-66428 MEDIUM
WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 4.3
CVE-2026-15212 HIGH
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update
CVSS 8.8
CVE-2026-65540 HIGH
WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 7.1
CVE-2026-65539 HIGH
WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability
CVSS 7.1
CVE-2026-65536 MEDIUM
Mahdi Yousefi Persian WooCommerce Shipping <= 4.4.5 - Cross-Site Request Forgery
CVSS 6.5
CVE-2026-65512 MEDIUM
WordPress WP Activity Log plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 5.4
CVE-2026-65488 HIGH
WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
CVSS 7.1
CVE-2026-65471 CRITICAL
WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 9.6
CVE-2026-65464 MEDIUM
WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 5.4
CVE-2026-65460 MEDIUM
WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 4.3
CVE-2026-61981 MEDIUM
WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 5.4
Details
Vulnerabilities 9,488
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits