Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9536 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-6503 1 Paulgriffinpetty 1 Wp Plugin Lister 2026-01-09 5.4 Medium
The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2021-24870 1 Wpfastestcache 1 Wp Fastest Cache 2026-01-09 6.1 Medium
The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitise and escape some the options available via the action, which could allow attackers to make logged in high privilege users call it and set a Cross-Site Scripting payload
CVE-2023-6845 1 Theresehansen 1 Commenttweets 2026-01-09 8.8 High
The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVE-2025-10684 1 Wordpress 1 Wordpress 2026-01-09 4.3 Medium
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
CVE-2024-27783 1 Fortinet 1 Fortiaiops 2026-01-09 7.2 High
Multiple cross-site request forgery (CSRF) weaknesses [CWE-352] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user via tricking the victim to execute malicious GET requests.
CVE-2024-37413 1 Rarathemes 1 Preschool And Kindergarten 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Preschool and Kindergarten allows Cross Site Request Forgery.This issue affects Preschool and Kindergarten: from n/a through 1.2.1.
CVE-2024-37421 2 Rarathemes, Wordpress 2 Jobscout, Wordpress 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme JobScout allows Cross Site Request Forgery.This issue affects JobScout: from n/a through 1.1.4.
CVE-2024-37426 1 Rarathemes 1 Elegant Pink 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Elegant Pink allows Cross Site Request Forgery.This issue affects Elegant Pink: from n/a through 1.3.0.
CVE-2023-28688 2 Themehunk, Wordpress 2 Variation Swatches, Wordpress 2026-01-09 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.
CVE-2024-31428 2 Rarathemes, Wordpress 2 The Conference, Wordpress 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme The Conference.This issue affects The Conference: from n/a through 1.2.0.
CVE-2024-31384 2 Rarathemes, Wordpress 2 Spa And Salon, Wordpress 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Spa and Salon.This issue affects Spa and Salon: from n/a through 1.2.7.
CVE-2024-34379 1 Rarathemes 1 Restaurant And Cafe 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Restaurant and Cafe.This issue affects Restaurant and Cafe: from n/a through 1.2.1.
CVE-2024-47255 1 2n 1 Access Commander 2026-01-09 4.7 Medium
In 2N Access Commander versions 3.1.1.2 and prior, a local attacker can escalate their privileges in the system which could allow for arbitrary code execution with root permissions.
CVE-2024-23554 1 Hcltech 1 Bigfix Platform 2026-01-08 5.7 Medium
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).
CVE-2019-25259 2026-01-08 5.3 Medium
Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can trick logged-in users into executing unauthorized actions by crafting malicious web pages that submit requests to the application.
CVE-2024-2904 2 Extendthemes, Wordpress 2 Calliope, Wordpress 2026-01-08 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.This issue affects Calliope: from n/a through 1.0.33.
CVE-2024-29888 1 Saleor 1 Saleor 2026-01-08 4.2 Medium
Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.
CVE-2023-52212 2 Automattic, Wordpress 2 Wp Job Manager, Wordpress 2026-01-08 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0.
CVE-2025-15364 2 Codename065, Wordpress 2 Download Manager Plugin, Wordpress 2026-01-08 7.3 High
The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.
CVE-2020-36918 2026-01-08 4.3 Medium
iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft malicious web pages to trick logged-in administrators into adding unauthorized users by exploiting the lack of CSRF protections.