Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

6,781 results · Feed

  • Medium 4.3
    CVE-2021-4408

    DW Question & Answer <= 1.5.8 - Cross-Site Request Forgery Bypass

    The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is due to missing or incorrect nonce validation on the update_answer() function. This makes it possible for unauthenticated…

    designwall DW Question & Answer Web / CMS
  • Medium 4.3
    CVE-2020-36750

    EWWW Image Optimizer <= 5.8.1 - Cross-Site Request Forgery Bypass

    The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewww_ngg_bulk_init() function. This makes it possible for unauthenti…

    nosilver4u EWWW Image Optimizer Web / CMS
  • Medium 4.3
    CVE-2021-4407

    Custom Banners <= 3.2.2 - Cross-Site Request Forgery Bypass

    The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated att…

    ghuger Custom Banners Web / CMS
  • High 8.1
    CVE-2023-3627

    Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core

    Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.

    salesagility salesagility/suitecrm-core
  • Critical 9.6
    CVE-2023-2746

    Rockwell Automation Enhanced HIM Vulnerable to Cross-Site Request Forgery Attack

    The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) …

    Rockwell Automation Enhanced HIM ICS / OT
  • Medium 4.3
    CVE-2023-32104

    WordPress MyCurator Content Curation Plugin <= 3.74 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mark Tilly MyCurator Content Curation plugin <= 3.74 versions.

    Mark Tilly MyCurator Content Curation
  • Medium 4.3
    CVE-2023-35091

    WordPress WooCommerce Stock Manager Plugin <= 2.10.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StoreApps Stock Manager for WooCommerce plugin <= 2.10.0 versions.

    StoreApps Stock Manager for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-35773

    WordPress Template Debugger Plugin <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Danny Hearnah - ChubbyNinjaa Template Debugger plugin <= 3.1.2 versions.

    Danny Hearnah - ChubbyNinjaa Template Debugger
  • Medium 4.3
    CVE-2023-24417

    WordPress Worthy – VG WORT Integration für WordPress Plugin <= 1.6.5-6497609 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in tiggersWelt.Net Worthy plugin <= 1.6.5-6497609 versions.

    tiggersWelt.net Worthy Web / CMS
  • Medium 4.3
    CVE-2023-36522

    WordPress Quiz Expert – Easy Quiz Maker, Exam and Test Manager Plugin <= 1.5.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WePupil Quiz Expert plugin <= 1.5.0 versions.

    WePupil Quiz Expert
  • Medium 4.3
    CVE-2023-25443

    WordPress Button Generator – easily Button Builder Plugin <= 2.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.5 versions.

    Wow-Company Button Generator – easily Button Builder
  • Medium 4.3
    CVE-2023-34029

    WordPress Disable WordPress Update Notifications Plugin <= 2.3.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <= 2.3.3 versions.

    Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications Web / CMS
  • Medium 5.4
    CVE-2023-25706

    WordPress Robots.txt optimization plugin <= 1.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pagup WordPress Robots.Txt optimization plugin <= 1.4.5 versions.

    pagup WordPress Robots.txt optimization Web / CMS
  • Medium 4.3
    CVE-2023-35044

    WordPress Securimage-WP Plugin <= 3.6.16 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Drew Phillips Securimage-WP plugin <= 3.6.16 versions.

    Drew Phillips Securimage-WP
  • High 8.1
    CVE-2023-36690

    WordPress WPLMS Theme < 4.900 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions.

    VibeThemes WPLMS
  • High 7.1
    CVE-2023-23671

    WordPress Layer Slider Plugin <= 1.1.9.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions.

    Muneeb Layer Slider
  • Medium 4.3
    CVE-2023-34185

    WordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions.

    John Brien WordPress NextGen GalleryView Web / CMS
  • Medium 4.3
    CVE-2023-35047

    WordPress All Bootstrap Blocks Plugin <= 1.3.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in AREOI All Bootstrap Blocks plugin <= 1.3.6 versions.

    AREOI All Bootstrap Blocks
  • Medium 4.3
    CVE-2023-35778

    WordPress Recent Posts Slider Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Neha Goel Recent Posts Slider plugin <= 1.1 versions.

    Neha Goel Recent Posts Slider
  • Medium 4.3
    CVE-2023-35780

    WordPress Galleria Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Andy Whalen Galleria plugin <= 1.0.3 versions.

    Andy Whalen Galleria
  • Medium 5.4
    CVE-2023-36687

    WordPress Menubar Plugin <= 5.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Andrea Tarantini Menubar plugin <= 5.8.2 versions.

    Andrea Tarantini Menubar
  • Medium 4.3
    CVE-2023-36693

    WordPress WP RSS Images Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez WP RSS Images plugin <= 1.1 versions.

    Alain Gonzalez WP RSS Images
  • Medium 5.4
    CVE-2023-37391

    WordPress WordPress Mobile Pack Plugin <= 3.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <= 3.4.1 versions.

    WPMobilePack.com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps Web / CMS
  • High 7.5
    CVE-2022-29561

    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

    Siemens RUGGEDCOM ROX RX1500 RUGGEDCOM ROX RX1510 RUGGEDCOM ROX RX1512 ICS / OT
  • Medium 5.4
    CVE-2023-34015

    WordPress Advanced Flat rate shipping Woocommerce Plugin <= 1.6.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin <= 1.6.4.4 versions.

    PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping Web / CMS
  • Medium 4.3
    CVE-2023-35913

    WordPress OOPSpam Anti-Spam Plugin <= 1.1.44 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.44 versions.

    OOPSpam Team OOPSpam Anti-Spam
  • Medium 5.4
    CVE-2023-35774

    WordPress LWS Tools Plugin <= 2.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.4.1 versions.

    LWS LWS Tools
  • Medium 4.3
    CVE-2023-36517

    WordPress WP Abstracts Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.2 versions.

    Kevon Adonis WP Abstracts
  • Medium 5.4
    CVE-2023-35781

    WordPress LWS Cleaner Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LWS Cleaner plugin <= 2.3.0 versions.

    LWS LWS Cleaner
  • Medium 4.3
    CVE-2022-45823

    WordPress Video Contest WordPress Plugin Plugin <= 3.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in GalleryPlugins Video Contest WordPress plugin <= 3.2 versions.

    GalleryPlugins Video Contest WordPress Plugin Web / CMS
  • Medium 4.3
    CVE-2023-25468

    WordPress Reservation.Studio widget Plugin <= 1.0.11 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions.

    Reservation.Studio Reservation.Studio widget
  • Medium 4.3
    CVE-2023-23997

    WordPress Database Collation Fix Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions.

    Dave Jesch Database Collation Fix
  • Medium 4.3
    CVE-2023-23704

    WordPress Comments Ratings Plugin <= 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions.

    pixelgrade Comments Ratings
  • Medium 4.3
    CVE-2023-25487

    WordPress PixTypes Plugin <= 1.4.14 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade PixTypes plugin <= 1.4.14 versions.

    pixelgrade PixTypes
  • Medium 5.4
    CVE-2023-24421

    WordPress PHP Compatibility Checker Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions.

    WP Engine PHP Compatibility Checker
  • Medium 4.3
    CVE-2023-25051

    WordPress Comment Reply Notification Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Denishua Comment Reply Notification plugin <= 1.4 versions.

    denishua Comment Reply Notification
  • Medium 4.3
    CVE-2023-23731

    WordPress WishSuite Plugin <= 1.3.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <= 1.3.3 versions.

    HasTheme WishSuite
  • Medium 4.3
    CVE-2023-23791

    WordPress HT Menu Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Menu plugin <= 1.2.1 versions.

    HasThemes HT Menu
  • Medium 4.3
    CVE-2023-23803

    WordPress JustTables – WooCommerce Product Table Plugin <= 1.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasThemes JustTables plugin <= 1.4.9 versions.

    HasThemes JustTables
  • Medium 4.3
    CVE-2023-23792

    WordPress Swatchly – WooCommerce Variation Swatches for Products Plugin <= 1.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Swatchly plugin <= 1.2.0 versions.

    HasThemes Swatchly