CWE-352

Medium likelihood

Cross-Site Request Forgery (CSRF)

Parent: CWE-345 - Insufficient Verification of Data Authenticity

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

9,489 vulnerabilities with CWE-352
CVE-2026-12158 HIGH
RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
CVSS 8.8
CVE-2026-58518 MEDIUM
THE Wikimedia Foundation Mediawiki - RedirectManager Extension < 1.3.3 - Cross-Site Request Forgery (CSRF)
CVSS 6.3
CVE-2026-11981 MEDIUM
GiveWP <= 4.15.3 - Cross-Site Request Forgery
CVSS 4.3
CVE-2026-14016 MEDIUM
Google Chrome < 150.0.7871.47 - Cross-Origin Data Leak via SVG
CVSS 6.5
CVE-2026-13963 LOW
Google Chrome < 150.0.7871.47 - Cross-Origin Data Leak via DevTools
CVSS 3.1
CVE-2026-13952 MEDIUM
Google Chrome < 150.0.7871.47 - Cross-Origin Data Leak via PerformanceAPIs
CVSS 4.3
CVE-2026-13946 MEDIUM
Google Chrome < 150.0.7871.47 - Cross-Origin Data Leak via ScriptInjections
CVSS 4.3
CVE-2026-13944 LOW
Google Chrome < 150.0.7871.47 - Cross-Origin Data Leak via DataTransfer
CVSS 3.1
CVE-2026-13887 MEDIUM
Google Chrome < 150.0.7871.47 - Cross-Origin Data Leak via NFC Implementation
CVSS 6.5
CVE-2026-13826 MEDIUM
Google Chrome < 150.0.7871.47 - Cross-Origin Data Leak via Autofill
CVSS 6.5
CVE-2026-35096 MEDIUM
Cross-Site Request Forgery (CSRF) in KTM System e-BOK
CVE-2026-8944 MEDIUM
Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter
CVSS 4.3
CVE-2026-43735 HIGH
Apple Safari - Denial of Service
CVSS 8.1
CVE-2026-31016 MEDIUM
Squidex CMS < 7.21.0 - Cross-Site Request Forgery via IdentityServer Account Profile Endpoint
CVSS 6.5
CVE-2026-13537 MEDIUM
CodeAstro Human Resource Management System cross-site request forgery
CVSS 4.3
CVE-2026-13422 MEDIUM
HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers
CVSS 4.3
CVE-2026-50132 HIGH
Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase
CVSS 7.3
CVE-2026-52784 HIGH
OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"
CVSS 8.8
CVE-2026-57659 HIGH
WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 8.8
CVE-2026-57657 MEDIUM
WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 4.3
CVE-2026-57655 HIGH
WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 8.2
CVE-2026-57641 MEDIUM
WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 6.5
CVE-2026-57637 MEDIUM
WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 4.3
CVE-2026-57635 MEDIUM
WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 6.5
CVE-2026-52800 HIGH
Gogs: CSRF Leading to Organization Owner Takeover
CVSS 8.8
Details
Vulnerabilities 9,489
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits