CWE-352

Medium likelihood

Cross-Site Request Forgery (CSRF)

Parent: CWE-345 - Insufficient Verification of Data Authenticity

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

9,489 vulnerabilities with CWE-352
CVE-2026-58143 HIGH
Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint
CVSS 8.8
CVE-2026-59148 HIGH
Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
CVSS 8.8
CVE-2026-4275 HIGH
Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint
CVSS 8.8
CVE-2026-5923 MEDIUM
Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack
CVE-2026-15034 MEDIUM
flask-dashboard Flask-MonitoringDashboard cross-site request forgery
CVSS 4.3
CVE-2026-12002 MEDIUM
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin < 6.11.1 - CSRF
CVSS 4.7
CVE-2026-9731 MEDIUM
Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update
CVSS 4.3
CVE-2026-49471 HIGH
Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
CVSS 8.3
CVE-2026-58315 MEDIUM
Seiko Epson Corporation Web Config - Cross-Site Request Forgery (CSRF)
CVSS 4.3
CVE-2026-34171 HIGH
Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value
CVSS 8.0
CVE-2026-59713 HIGH
Leantime - OIDC Login CSRF via Unconditional State Verification Stub
CVSS 8.1
CVE-2026-14800 MEDIUM
imhamzaazam ecommerceFlask cross-site request forgery
CVSS 4.3
CVE-2026-59520 MEDIUM
WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 4.3
CVE-2026-12746 HIGH
Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter
CVSS 8.1
CVE-2026-12740 HIGH
Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter
CVSS 8.1
CVE-2026-14620 MEDIUM
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
CVSS 4.7
CVE-2026-57766 HIGH
WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 8.8
CVE-2026-57761 HIGH
WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability
CVSS 7.1
CVE-2026-57759 HIGH
WordPress ProfileGrid plugin <= 5.9.9.7 - CSRF to Account Takeover vulnerability
CVSS 8.8
CVE-2026-57758 HIGH
WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability
CVSS 7.1
CVE-2026-57757 HIGH
WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 7.1
CVE-2026-57751 HIGH
WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 8.1
CVE-2026-57747 MEDIUM
WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 6.5
CVE-2026-57690 MEDIUM
WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 4.3
CVE-2026-57723 HIGH
WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability
CVSS 7.4
Details
Vulnerabilities 9,489
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits