Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

2,042 results · Clear filters · Feed

  • High 8.7
    CVE-2024-6662

    CSRF in MegaBIP

    Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0" lacks protection mechanisms. A user could be tricked into visiting a malicious website, which would…

    Jan Syski MegaBIP
  • High 8.8
    CVE-2024-13284

    Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.

    Drupal Gutenberg drupal/gutenberg Packagist
  • High 8.8
    CVE-2024-13260

    Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.

    Drupal Migrate queue importer drupal/migrate_queue_importer Packagist
  • High 8.8
    CVE-2024-13250

    Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.

    Drupal Drupal Symfony Mailer Lite drupal/symfony_mailer_lite Web / CMS Packagist
  • High 8.8
    CVE-2024-13244

    Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3.

    Drupal Migrate Tools drupal/migrate_tools Packagist
  • High 7.1
    CVE-2025-22814

    WordPress Zephyr Admin Theme Plugin <= 1.4.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through <= 1.4.1.

    Dylan James Zephyr Admin Theme
  • High 7.1
    CVE-2025-22520

    WordPress Tock Widget Plugin <= 1.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tock Tock Widget tock-widget allows Cross Site Request Forgery.This issue affects Tock Widget: from n/a through <= 1.1.

    Tock Tock Widget
  • High 7.1
    CVE-2025-22538

    WordPress Virtual Bot Plugin <= 1.0.0 - CSRF Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Ofek Nakar Virtual Bot virtual-bot allows Stored XSS.This issue affects Virtual Bot: from n/a through <= 1.0.0.

    Ofek Nakar Virtual Bot
  • High 7.1
    CVE-2025-22552

    WordPress Affiliate Disclosure Statement plugin <= 0.3 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Affiliate Disclosure Statement affiliate-disclosure-statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through <= 0.3.

    bnielsen Affiliate Disclosure Statement
  • High 7.1
    CVE-2025-22555

    WordPress Smoothness Slider Shortcode plugin <= v1.2.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in njshofe Smoothness Slider Shortcode smoothness-slider-shortcode allows Cross Site Request Forgery.This issue affects Smoothness Slider Shortcode: from n/a through <= v1.2.2.

    njshofe Smoothness Slider Shortcode
  • High 7.1
    CVE-2025-22556

    WordPress Norse Rune Oracle plugin <= 1.4.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Norse Rune Oracle Plugin norse-runes-oracle allows Cross Site Request Forgery.This issue affects Norse Rune Oracle Plugin: from n/a through <= 1.4.2.

    WP CMS Ninja Norse Rune Oracle Plugin
  • High 7.1
    CVE-2025-22557

    WordPress News Publisher Autopilot plugin <= 2.1.4 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in cdowp News Publisher Autopilot wpm-news-api allows Cross Site Request Forgery.This issue affects News Publisher Autopilot: from n/a through <= 2.1.4.

    cdowp News Publisher Autopilot
  • High 7.1
    CVE-2025-22559

    WordPress TubePress.NET Plugin <= 4.0.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in tubepress TubePress.NET tubepressnet allows Cross Site Request Forgery.This issue affects TubePress.NET: from n/a through <= 4.0.1.

    tubepress TubePress.NET
  • High 7.1
    CVE-2025-22571

    WordPress Instabot plugin <= 1.10 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in instabot Instabot instabot allows Cross Site Request Forgery.This issue affects Instabot: from n/a through <= 1.10.

    instabot Instabot
  • High 7.1
    CVE-2025-22582

    WordPress Uptime Robot plugin <= 0.1.3 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through <= 0.1.3.

    Scott Nelle Uptime Robot
  • High 7.1
    CVE-2025-22589

    WordPress Quote Tweet plugin <= 0.7 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in bozdoz Quote Tweet quote-tweet allows Stored XSS.This issue affects Quote Tweet: from n/a through <= 0.7.

    bozdoz Quote Tweet
  • High 7.1
    CVE-2025-22590

    WordPress Prayer Times Anywhere plugin <= 2.0.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Prayer Times Anywhere prayer-times-anywhere allows Stored XSS.This issue affects Prayer Times Anywhere: from n/a through <= 2.0.1.

    mmrs151 Prayer Times Anywhere
  • High 7.1
    CVE-2025-22325

    WordPress Autocompleter plugin <= 1.3.5.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in nchankov Autocompleter autocompleter allows Stored XSS.This issue affects Autocompleter: from n/a through <= 1.3.5.2.

    nchankov Autocompleter
  • High 7.1
    CVE-2025-22328

    WordPress Elevio plugin <= 4.4.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Elevio by Dixa Elevio elevio allows Stored XSS.This issue affects Elevio: from n/a through <= 4.4.1.

    Elevio by Dixa Elevio
  • High 7.1
    CVE-2025-22336

    WordPress Wizhi Multi Filters by Wenprise plugin <= 1.8.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Amos Lee（一刀） Wizhi Multi Filters by Wenprise wizhi-multi-filters allows Stored XSS.This issue affects Wizhi Multi Filters by Wenprise: from n/a through <= 1.8.6.

    Amos Lee（一刀） Wizhi Multi Filters by Wenprise
  • High 7.1
    CVE-2025-22343

    WordPress wpSOL plugin <= 1.2.0 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in koter84 wpSOL wpsol allows Stored XSS.This issue affects wpSOL: from n/a through <= 1.2.0.

    koter84 wpSOL
  • High 7.1
    CVE-2025-22342

    WordPress WP Simple Sitemap plugin <= 0.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Jenst WP Simple Sitemap wp-simple-sitemap allows Stored XSS.This issue affects WP Simple Sitemap: from n/a through <= 0.2.

    Jenst WP Simple Sitemap
  • High 8.2
    CVE-2025-22347

    WordPress BSK Forms Blacklist plugin <= 3.9 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in bannersky BSK Forms Blacklist bsk-gravityforms-blacklist allows Blind SQL Injection.This issue affects BSK Forms Blacklist: from n/a through <= 3.9.

    bannersky BSK Forms Blacklist
  • High 8.8
    CVE-2024-12322

    ThePerfectWedding.nl Widget <= 2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The ThePerfectWedding.nl Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8. This is due to missing or incorrect nonce validation on the 'update_option' function. This makes it possible for unauth…

    theperfectwedding ThePerfectWedding.nl Widget Web / CMS
  • High 8.1
    CVE-2024-55076

    Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.

    Grocy project Grocy
  • High 8.8
    CVE-2024-39623

    WordPress ListingPro theme <= 2.9.4 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro listingpro allows Authentication Bypass.This issue affects ListingPro: from n/a through <= 2.9.4.

    Cridio Studio ListingPro
  • High 8.8
    CVE-2024-56207

    WordPress EditionGuard for WooCommerce – eBook Sales with DRM plugin <= 3.4.2 - CSRF to Privilege Escalation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Privilege Escalation.This issue affects EditionGuard for WooCommerce – eBook Sales wit…

    EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM Web / CMS
  • High 8.8
    CVE-2024-56206

    WordPress gap-hub-user-role. plugin <= 3.4.1 - CSRF to Broken Authentication vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in krishankakkar gap-hub-user-role gap-hub-user-role allows Authentication Bypass.This issue affects gap-hub-user-role: from n/a through <= 3.4.1.

    krishankakkar gap-hub-user-role
  • High 8.8
    CVE-2024-56204

    WordPress Sinking Dropdowns plugin <= 1.25 - CSRF to Privilege Escalation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in yonisink Sinking Dropdowns sinking-dropdowns allows Privilege Escalation.This issue affects Sinking Dropdowns: from n/a through <= 1.25.

    yonisink Sinking Dropdowns
  • High 8.8
    CVE-2024-56203

    WordPress Wayne Audio Player plugin <= 1.0 - CSRF to Privilege Escalation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in gholme4 Wayne Audio Player wayne-audio-player allows Privilege Escalation.This issue affects Wayne Audio Player: from n/a through <= 1.0.

    gholme4 Wayne Audio Player
  • High 7.1
    CVE-2024-56232

    WordPress WP Nice Loader plugin <= 0.1.0.4 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Alex Volkov WP Nice Loader wp-nice-loader allows Stored XSS.This issue affects WP Nice Loader: from n/a through <= 0.1.0.4.

    Alex Volkov WP Nice Loader
  • High 8.8
    CVE-2024-56311

    REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Reque…

  • High 8.8
    CVE-2024-56310

    REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forger…

  • High 8.8
    CVE-2024-12771

    eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Reset

    The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.43. This is due to missing or incorrect nonce validation on the 'customer_panel_password_reset' funct…

    impleCode eCommerce Product Catalog Plugin for WordPress Web / CMS
  • High 8.8
    CVE-2024-37758

    Improper access control in the endpoint /RoleMenuMapping/AddRoleMenu of Digiteam v4.21.0.0 allows authenticated attacke…

  • High 8.8
    CVE-2024-55088

    GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module.

  • High 8.8
    CVE-2024-56116 Public exploit

    A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator…

  • High 8.8
    CVE-2024-12293

    User Role Editor <= 4.64.3 - Cross-Site Request Forgery to Privilege Escalation

    The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or incorrect nonce validation on the update_roles() function. This makes it possible for unauthenticated…

    shinephp User Role Editor Web / CMS
  • High 7.1
    CVE-2024-56017

    WordPress Stop Registration Spam Plugin <= 1.23 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tom Royal Stop Registration Spam allows Stored XSS.This issue affects Stop Registration Spam: from n/a through 1.23.

    Tom Royal Stop Registration Spam
  • High 7.1
    CVE-2024-56015

    WordPress Tidy Up Plugin <= 1.3 - CSRF to Reflected Cross-Site Scripting vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in John Godley Tidy Up allows Reflected XSS.This issue affects Tidy Up: from n/a through 1.3.

    John Godley Tidy Up