CWE-352— Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.— MITRE CWE catalog

9,686 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-352page 17 of 194

CVE-2023-47666HIGHCVSS 8.8EG 8.8
2023-11-18
Cross-Site Request Forgery (CSRF) vulnerability in Code Snippets Pro Code Snippets.This issue affects Code Snippets: from n/a through 3.5.0.
CVE-2023-47664HIGHCVSS 8.8EG 8.8
2023-11-18
Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview Plainview Protect Passwords.This issue affects Plainview Protect Passwords: from n/a through 1.4.
CVE-2023-48017HIGHCVSS 8.8EG 8.8
2023-11-18
Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management.
CVE-2023-47757HIGHCVSS 8.8EG 8.8
2023-11-17
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Const…
CVE-2023-47687HIGHCVSS 8.8EG 8.8
2023-11-16
Cross-Site Request Forgery (CSRF) vulnerability in VJInfotech Woo Custom and Sequential Order Number plugin <= 2.6.0 versions.
CVE-2023-47686HIGHCVSS 8.8EG 8.8
2023-11-16
Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.2.2 versions.
CVE-2023-47688HIGHCVSS 8.8EG 8.8
2023-11-16
Cross-Site Request Forgery (CSRF) vulnerability in Alexufo Youtube SpeedLoad plugin <= 0.6.3 versions.
CVE-2023-6022HIGHCVSS 8.8EG 8.8
2023-11-16
Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5.
CVE-2023-43275HIGHCVSS 8.8EG 8.8
2023-11-16
Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form.
CVE-2023-48021HIGHCVSS 8.8EG 8.8
2023-11-14
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.
CVE-2023-48020HIGHCVSS 8.8EG 8.8
2023-11-14
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus.
CVE-2023-48060HIGHCVSS 8.8EG 8.8
2023-11-13
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add
CVE-2023-48058HIGHCVSS 8.8EG 8.8
2023-11-13
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run
CVE-2023-35041HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability leading to Local File Inclusion (LF) in Webpushr Web Push Notifications Web Push Notifications – Webpushr plugin <= 4.34.0 versions.
CVE-2023-47669HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 3.10.3 versions.
CVE-2023-47230HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions.
CVE-2023-46638HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability in Webcodin WCP OpenWeather plugin <= 2.5.0 versions.
CVE-2023-46636HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability in David Stöckl Custom Header Images plugin <= 1.2.1 versions.
CVE-2023-46629HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability in themelocation Remove Add to Cart WooCommerce plugin <= 1.4.4.
CVE-2023-46625HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Autolinks Manager plugin <= 1.10.04 versions.
CVE-2023-46620HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.3.9.1 versions.
CVE-2023-46619HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.
CVE-2023-46618HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin <= 2.5 versions.
CVE-2023-26516HIGHCVSS 8.8EG 8.8
2023-11-13
Cross-Site Request Forgery (CSRF) vulnerability in WPIndeed Debug Assistant plugin <= 1.4 versions.
CVE-2023-47238HIGHCVSS 8.8EG 8.8
2023-11-09
Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions.
CVE-2023-47237HIGHCVSS 8.8EG 8.8
2023-11-09
Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson Auto Publish for Google My Business plugin <= 3.7 versions.
CVE-2023-46614HIGHCVSS 8.8EG 8.8
2023-11-09
Cross-Site Request Forgery (CSRF) vulnerability in Mat Bao Corp WP Helper Premium plugin <= 4.5.1 versions.
CVE-2023-46242HIGHCVSS 8.8EG 8.8
2023-11-07
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to execute a content with the right of any user via a crafted URL. A user must have `programming` p…
CVE-2023-5823HIGHCVSS 8.8EG 8.8
2023-11-06
Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.
CVE-2023-47186HIGHCVSS 8.8EG 8.8
2023-11-06
Cross-Site Request Forgery (CSRF) vulnerability in Kadence WP Kadence WooCommerce Email Designer plugin <= 1.5.11 versions.
CVE-2023-46781HIGHCVSS 8.8EG 8.8
2023-11-06
Cross-Site Request Forgery (CSRF) vulnerability in Roland Murg Current Menu Item for Custom Post Types plugin <= 1.5 versions.
CVE-2023-46780HIGHCVSS 8.8EG 8.8
2023-11-06
Cross-Site Request Forgery (CSRF) vulnerability in Alter plugin <= 1.0 versions.
CVE-2023-46779HIGHCVSS 8.8EG 8.8
2023-11-06
Cross-Site Request Forgery (CSRF) vulnerability in EasyRecipe plugin <= 3.5.3251 versions.
CVE-2023-46778HIGHCVSS 8.8EG 8.8
2023-11-06
Cross-Site Request Forgery (CSRF) vulnerability in TheFreeWindows Auto Limit Posts Reloaded plugin <= 2.5 versions.
CVE-2023-46777HIGHCVSS 8.8EG 8.8
2023-11-06
Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.
CVE-2023-46776HIGHCVSS 8.8EG 8.8
2023-11-06
Cross-Site Request Forgery (CSRF) vulnerability in Serena Villa Auto Excerpt everywhere plugin <= 1.5 versions.
CVE-2023-46775HIGHCVSS 8.8EG 8.8
2023-11-06
Cross-Site Request Forgery (CSRF) vulnerability in Djo Original texts Yandex WebMaster plugin <= 1.18 versions.
CVE-2023-47182HIGHCVSS 8.8EG 8.8
2023-11-06
Cross-Site Request Forgery (CSRF) leading to a Stored Cross-Site Scripting (XSS) vulnerability in Nazmul Hossain Nihal Login Screen Manager plugin <= 3.5.2 versions.
CVE-2023-42027HIGHCVSS 8.8EG 8.8
2023-11-03
IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user …
CVE-2023-5899HIGHCVSS 8.8EG 8.8
2023-11-01
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5898HIGHCVSS 8.8EG 8.8
2023-11-01
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5897HIGHCVSS 8.8EG 8.8
2023-11-01
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.
CVE-2023-5893HIGHCVSS 8.8EG 8.8
2023-11-01
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-42323HIGHCVSS 8.8EG 8.8
2023-10-30
Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file.
CVE-2023-46375HIGHCVSS 8.8EG 8.8
2023-10-27
ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).
CVE-2023-45317HIGHCVSS 8.8EG 8.8
2023-10-26
The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a log…
CVE-2023-5802HIGHCVSS 8.8EG 8.8
2023-10-26
Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions.
CVE-2023-46204HIGHCVSS 8.8EG 8.8
2023-10-25
Cross-Site Request Forgery (CSRF) vulnerability in Muller Digital Inc. Duplicate Theme plugin <= 0.1.6 versions.
CVE-2023-46202HIGHCVSS 8.8EG 8.8
2023-10-25
Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Auto Login New User After Registration plugin <= 1.9.6 versions.
CVE-2023-46198HIGHCVSS 8.8EG 8.8
2023-10-25
Cross-Site Request Forgery (CSRF) vulnerability in Scientech It Solution Appointment Calendar plugin <= 2.9.6 versions.

Map vulnerabilities like CWE-352 to your infrastructure

EchelonGraph correlates every CVE — across CWE-352 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →