CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- metagauss profilegridWordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- berocket permalink manager for woocommerceWordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability7.1 High
- ploudapp pcloud wp backupWordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- heateor support social loginWordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability8.1 High
- themerex bookedWordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- fuelthemes werkstattWordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- e4jvikwp vikbooking hotel booking engine & pmsWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability7.4 High
- metagauss registrationmagic – custom registration forms, user registration, payment, and user loginRegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter8.8 High
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.15.3 - Cross-Site Request Forgery4.3 Medium
- mediawiki, the wikimedia foundation mediawiki - redirectmanager extension +1 moreCross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki -...6.9 Medium
- google chromeInappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote...3.1 Low
- google chromeInappropriate implementation in PerformanceAPIs in Google Chrome prior to 150.0.7871.47 allowed a...4.3 Medium
- google chromeInappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47...4.3 Medium
- google chromeInappropriate implementation in DataTransfer in Google Chrome on Mac prior to 150.0.7871.47...3.1 Low
- google chromeInappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeInappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47...6.5 Medium
- ktm system e-bokCross-Site Request Forgery (CSRF) in KTM System e-BOK5.1 Medium
- engagementanalytics plugin for google analytics by io technologiesPlugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter4.3 Medium
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2...8.1 High
- codeastro human resource management systemCodeAstro Human Resource Management System cross-site request forgery5.3 Medium
- No product listedCross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a...6.5 Medium
- harmonic design hd quizHD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers4.3 Medium
- opf openprojectOpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"8.8 High
- stranger studios paid memberships pro - add member from adminWordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- noor alam gmail smtpWordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- jay versluis child theme wizardWordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability8.2 High
- contempo themes real estate 7WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- tyche softwares abandoned cart lite for woocommerceWordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- funnelkit payment gateway for stripe woocommerceWordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- eagle-themes eagle bookingWordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- drupal salesforce suiteSalesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-0634.8 Medium
- payara serverPayara Server Full has a Cross-Site Request Forgery vulnerability7.3 High
- jenkins zowe zdevops, jenkins project zowe zdevops plugin +1 moreJenkins Zowe zDevOps Plugin has a CSRF vulnerability4.2 Medium
- jenkins assembla, jenkins project assembla plugin +1 moreJenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability5.4 Medium
- jenkins project contrast continuous application security pluginJenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability5.4 Medium
- jenkins ec2 fleet, jenkins project ec2 fleet plugin +1 moreJenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability5.4 Medium
- jenkins project gitee pluginJenkins Gitee Plugin has a cross-site request forgery vulnerability5.4 Medium
- jenkins priority sorter, jenkins project priority sorter plugin +1 moreJenkins Priority Sorter Plugin has a CSRF vulnerability4.3 Medium
- jenkins project pipeline: groovy plugin, jenkins pipeline\ +1 moreJenkins Pipeline: Groovy Plugin has a CSRF vulnerability4.3 Medium
- seo tools bulk seo imageBulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- manuelpadillac mp customize login pageMP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- jotis blue captchaBlue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter4.3 Medium
- motordeskMotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- chuhpl book a room event calendarBook a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Update4.3 Medium
- osiris8 osiris signature bannerOsiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter6.1 Medium
- gogsGogs: CSRF Leading to Organization Owner Takeover8.8 High
- budibaseBudibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase7.3 High
- olo-dot-io uni-cliUni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests8.6 High
- jovancoding network-aiNetwork-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions5.9 Medium
- Show moreLoading…