Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9528 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-22359 2 Aa-team, Wordpress 2 Wordpress Movies Bulk Importer, Wordpress 2026-01-26 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in AA-Team Wordpress Movies Bulk Importer movies importer allows Cross Site Request Forgery.This issue affects Wordpress Movies Bulk Importer: from n/a through <= 1.0.
CVE-2026-24384 1 Wordpress 1 Wordpress 2026-01-26 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in launchinteractive Merge + Minify + Refresh merge-minify-refresh allows Cross Site Request Forgery.This issue affects Merge + Minify + Refresh: from n/a through <= 2.14.
CVE-2026-24374 2 Metagauss, Wordpress 2 Registrationmagic, Wordpress 2026-01-26 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Request Forgery.This issue affects RegistrationMagic: from n/a through <= 6.0.6.9.
CVE-2026-24365 2 Storeapps, Wordpress 2 Stock Manager For Woocommerce, Wordpress 2026-01-26 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager allows Cross Site Request Forgery.This issue affects Stock Manager for WooCommerce: from n/a through < 3.6.0.
CVE-2025-3839 1 Gnome 1 Epiphany 2026-01-26 8 High
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this action, resulting in potential code execution on the client device via trusted UI behavior.
CVE-2026-24596 2 Marynixie, Wordpress 2 Related Posts Thumbnails Plugin For Wordpress, Wordpress 2026-01-26 4.7 Medium
Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request Forgery.This issue affects Related Posts Thumbnails Plugin for WordPress: from n/a through <= 4.3.1.
CVE-2024-33680 1 Mainwp 1 Mainwp Child Reports 2026-01-23 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in MainWP MainWP Child Reports.This issue affects MainWP Child Reports: from n/a through 2.1.1.
CVE-2024-31272 1 Reputeinfosystems 1 Arforms Form Builder 2026-01-23 6.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.
CVE-2024-9450 1 Syntacticsinc 1 Easync 2026-01-23 6.5 Medium
The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack
CVE-2021-24767 1 Wpvibes 1 Redirect 404 Error Page To Homepage Or Custom Page With Logs 2026-01-23 6.5 Medium
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
CVE-2024-8047 2 Freakingwildchild, Visual Sound 2 Visual Sound, Visual Sound 2026-01-23 5.7 Medium
The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-7859 2 Freakingwildchild, Visual Sound 2 Visual Sound, Visual Sound 2026-01-23 6.5 Medium
The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2023-28749 1 Cminds 1 Cm Search And Replace 2026-01-23 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.
CVE-2025-58576 1 Groupsession 3 Groupsession, Groupsession Bycloud, Groupsession Zion 2026-01-23 N/A
Cross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If a user accesses a malicious page while logged in, unintended operations may be performed.
CVE-2025-39351 1 Themegoods 1 Grand Restaurant 2026-01-22 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Restaurant WordPress allows Cross Site Request Forgery.This issue affects Grand Restaurant WordPress: from n/a through 7.0.
CVE-2024-32107 1 Xlplugins 1 Finale 2026-01-22 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in XLPlugins Finale Lite.This issue affects Finale Lite: from n/a through 2.18.0.
CVE-2024-32104 1 Xlplugins 1 Nextmove 2026-01-22 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.18.1.
CVE-2024-54216 1 Reputeinfosystems 1 Arforms 2026-01-22 7.7 High
Path Traversal: '.../...//' vulnerability in Repute InfoSystems ARForms allows Path Traversal.This issue affects ARForms: from n/a through 6.4.1.
CVE-2021-41074 1 Webkul 1 Qloapps 2026-01-22 5.4 Medium
A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.
CVE-2025-68158 1 Authlib 1 Authlib 2026-01-22 5.7 Medium
Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.