VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (9,622)

page 255 of 482
  • CVE-2023-22673MedJul 10, 2023
    Magenet
    Website Monetization
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <= 1.0.29.1 versions.

  • CVE-2023-3427MedJun 28, 2023
    WordPress
    Salon Booking System
    risk 0.35cvss 5.4epss 0.00

    The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function. This makes it possible for unauthenticated attackers to change…

  • CVE-2023-34373MedJun 19, 2023
    Dylan James
    Zephyr Project Manager
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.

  • CVE-2023-25450MedJun 15, 2023
    Givewp
    Givewp
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions.

  • CVE-2023-2892MedJun 9, 2023
    WordPress
    Wp Easycart
    risk 0.35cvss 6.5epss 0.00

    The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_bulk_delete_product function. This makes it possible for unauthenticated attackers to…

  • CVE-2023-2891MedJun 9, 2023
    WordPress
    Wp Easycart
    risk 0.35cvss 6.5epss 0.00

    The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_delete_product function. This makes it possible for unauthenticated attackers to delete…

  • CVE-2023-0729MedJun 9, 2023
    WordPress
    Wicked Folders
    risk 0.35cvss 5.4epss 0.00

    The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_sort_order function. This makes it possible for unauthenticated attackers to…

  • CVE-2022-33974MedMay 29, 2023
    Smashballoon
    Custom Twitter Feeds
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions.

  • CVE-2023-33316MedMay 28, 2023
    WooCommerce
    Automatewoo
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.

  • CVE-2023-33315MedMay 28, 2023
    Wandlesoftware
    Smart App Banner
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin <= 1.1.2 versions.

  • CVE-2023-25467MedMay 26, 2023
    Resize At Upload Plus Project
    Resize At Upload Plus
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Daniel Mores, A. Huizinga Resize at Upload Plus plugin <= 1.3 versions.

  • CVE-2022-46856MedMay 25, 2023
    Orionserver
    Woocommerce Products Designer
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in ORION Woocommerce Products Designer plugin <= 4.3.3 versions.

  • CVE-2022-46820MedMay 25, 2023
    Wpjoli
    Joli Table Of Contents
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in WPJoli Joli Table Of Contents plugin <= 1.3.9 versions.

  • CVE-2022-45371MedMay 25, 2023
    Wpmet
    Shopengine
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Wpmet ShopEngine plugin <= 4.1.1 versions.

  • CVE-2022-43490MedMay 25, 2023
    Xwp
    Stream
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in XWP Stream plugin <= 3.9.2 versions.

  • CVE-2022-38716MedMay 25, 2023
    Stellarwp
    Motors – Car Dealer, Classifieds & Listing
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.

  • CVE-2022-38356MedMay 25, 2023
    WordPress
    Pearl Header Builder
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.

  • CVE-2022-47139MedMay 25, 2023
    Wp Basic Elements Project
    Wp Basic Elements
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <= 5.2.15 versions.

  • CVE-2022-46800MedMay 25, 2023
    Litespeedtech
    LiteSpeed Cache
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache plugin <= 5.3 versions.

  • CVE-2022-47448MedMay 24, 2023
    Xiligroup
    Xili Tidy Tags
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in dev.Xiligroup.Com - MS plugin <= 1.12.03 versions.