Vulnerability database

3,629 results · page 2 of 73

• Sep 12, 2026Gpx2Graphics: Does not perform a CSRF checkCVE-2026-81090 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.

  Product

  Gpx2Graphics

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Gpx2Graphics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 11, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.CVE-2026-62139 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.

  Affected

  up to 1.186.0

  What to do

  Affects up to 1.186.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 11, 2026Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.CVE-2026-62133 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 9, 2026WPLP Cookie Consent: Does not have any authorisation or CSRF checksCVE-2026-82184 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data.

  Product

  WPLP Cookie Consent

  Fixed in

  4.4.2

  What to do

  Update WPLP Cookie Consent to 4.4.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 6, 2026Real Estate Papi: Does not perform capability or CSRF checks on one of its AJAX actionsCVE-2026-13159 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.

  Product

  Real Estate Papi

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Real Estate Papi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 2, 2026Simple Membership MailChimp Integration: Does not have CSRF checks in its settings pageCVE-2026-8151 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.

  Product

  Simple Membership MailChimp Integration

  Fixed in

  1.9.8

  What to do

  Update Simple Membership MailChimp Integration to 1.9.8 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Sep 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.CVE-2026-84770 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.

  Affected

  up to 2.3.8

  What to do

  Affects up to 2.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.CVE-2026-84764 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.

  Affected

  up to 1.6.12.23

  What to do

  Affects up to 1.6.12.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.CVE-2026-84759 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.

  Affected

  up to 2.13.1

  What to do

  Affects up to 2.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 2, 2026Grand Tour: Cross-Site Request Forgery (CSRF)CVE-2026-66652 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.

  Product

  Grand Tour

  Affected

  up to 5.5.1

  What to do

  Affects up to 5.5.1. Update Grand Tour to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 2, 2026JetStyleManager for Gutenberg: Does not have CSRF protection on some of its AJAX actionsCVE-2026-81432 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.

  Product

  JetStyleManager for Gutenberg

  Fixed in

  1.3.9

  What to do

  Update JetStyleManager for Gutenberg to 1.3.9 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 2, 2026WC Vendors: Does not have CSRF protection on some of its front-end order shipment status actionsCVE-2026-81426 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.

  Product

  WC Vendors

  Fixed in

  2.7.2.1

  What to do

  Update WC Vendors to 2.7.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.CVE-2026-81273 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.CVE-2026-81271 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.

  Affected

  up to 2.8.176

  What to do

  Affects up to 2.8.176. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026UpdraftPlus: WP Backup & Migration: Does not have CSRF checks in one of its backup management actionsCVE-2026-76549 · WordPress plugins & themes · reported by WPScanMedium 5.9

  The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.

  Product

  UpdraftPlus: WP Backup & Migration

  Fixed in

  1.26.7

  What to do

  Update UpdraftPlus: WP Backup & Migration to 1.26.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 24, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.CVE-2026-78280 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 24, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.CVE-2026-78279 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Easy Elementor Addons: Cross-Site Request Forgery (CSRF)CVE-2026-28164 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.

  Product

  Easy Elementor Addons

  Affected

  up to 2.3.7

  What to do

  Affects up to 2.3.7. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026HashBar – WordPress Notification Bar: Cross-Site Request Forgery (CSRF)CVE-2026-66602 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.

  Product

  HashBar – WordPress Notification Bar

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update HashBar – WordPress Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026Slider by 10Web: Cross-Site Request Forgery (CSRF)CVE-2026-66635 · WordPress plugins & themes · reported by PatchstackHigh 7.4

  Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63.

  Product

  Slider by 10Web

  Affected

  up to 1.2.63

  What to do

  Affects up to 1.2.63. Update Slider by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026ShopEngine Elementor WooCommerce Builder Addon: Does not protect one of its authentication endpoints against CSRFCVE-2026-19088 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.

  Product

  ShopEngine Elementor WooCommerce Builder Addon

  Fixed in

  4.9.3

  What to do

  Update ShopEngine Elementor WooCommerce Builder Addon to 4.9.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026WP Umbrella: Cross-Site Request Forgery (CSRF)CVE-2026-66642 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2.

  Product

  WP Umbrella

  Affected

  up to 2.26.2

  What to do

  Affects up to 2.26.2. Update WP Umbrella to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwp-umbrella.com

• Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.CVE-2026-66686 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.

  Affected

  up to 0.14

  What to do

  Affects up to 0.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.CVE-2026-66681 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.

  Affected

  up to 7.1.14

  What to do

  Affects up to 7.1.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.CVE-2026-28172 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Google Authenticator: Does not verify a CSRF nonceCVE-2026-14204 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.

  Product

  Google Authenticator

  Fixed in

  0.56

  What to do

  Update Google Authenticator to 0.56 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 5, 2026MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings: Does not have authorisation and CSRF checks in one of its AJAX actionsCVE-2026-17515 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.

  Product

  MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings

  Fixed in

  7.0.4

  What to do

  Update MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings to 7.0.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.CVE-2026-66474 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.CVE-2026-66428 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.

  Affected

  up to 18.4

  What to do

  Affects up to 18.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.CVE-2026-65540 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

  Affected

  up to 1.6.5

  What to do

  Affects up to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.CVE-2026-65539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.CVE-2026-65536 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.

  Affected

  up to 4.4.5

  What to do

  Affects up to 4.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Melapress WP Activity Log and Melapress WP Activity Log Premium: Cross-Site request forgery (CSRF)CVE-2026-65512 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4.

  Product

  Melapress WP Activity Log and Melapress WP Activity Log Premium

  Affected

  up to 5.6.4

  What to do

  Affects up to 5.6.4. Update Melapress WP Activity Log and Melapress WP Activity Log Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jul 23, 2026LA-Studio Element Kit for Elementor: Cross-Site Request Forgery (CSRF)CVE-2026-65488 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

  Product

  LA-Studio Element Kit for Elementor

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.CVE-2026-65471 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

  Affected

  up to 5.15.6

  What to do

  Affects up to 5.15.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.CVE-2026-65464 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

  Affected

  up to 4.16.3

  What to do

  Affects up to 4.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.CVE-2026-65460 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.

  Affected

  up to 5.1.0

  What to do

  Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.CVE-2026-61981 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.

  Affected

  up to 15.0.8

  What to do

  Affects up to 15.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.CVE-2026-57785 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.

  Affected

  up to 1.2.63

  What to do

  Affects up to 1.2.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.CVE-2026-57784 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

  Affected

  up to 3.3.26

  What to do

  Affects up to 3.3.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026MailPoet: Cross-Site Request Forgery (CSRF)CVE-2026-57626 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0.

  Product

  MailPoet

  Affected

  up to 5.33.0

  What to do

  Affects up to 5.33.0. Update MailPoet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.CVE-2026-24537 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.

  Affected

  up to 0.6.6

  What to do

  Affects up to 0.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2026Appointment Booking: Does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcherCVE-2026-11866 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator.

  Product

  Appointment Booking

  Fixed in

  5.6.3

  What to do

  Update Appointment Booking to 5.6.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 13, 2026ووسلام &#8211; همگام سازی ووکامرس و باسلام: Cross-Site Request Forgery (CSRF)CVE-2026-61956 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام &#8211; همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects ووسلام &#8211; همگام سازی ووکامرس و باسلام: from n/a through <= 1.9.1.

  Product

  ووسلام &#8211; همگام سازی ووکامرس و باسلام

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update ووسلام &#8211; همگام سازی ووکامرس و باسلام to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026WorkScout-Core: Cross-Site Request Forgery (CSRF)CVE-2026-57786 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: from n/a through <= 1.7.08.

  Product

  WorkScout-Core

  Affected

  up to 1.7.08

  What to do

  Affects up to 1.7.08. Update WorkScout-Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 5, 2026CrawlWP SEO: Cross-Site Request Forgery (CSRF)CVE-2026-59520 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery. This issue affects CrawlWP SEO: from n/a through 3.0.16.

  Product

  CrawlWP SEO

  Affected

  up to 3.0.16

  What to do

  Affects up to 3.0.16. Update CrawlWP SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.CVE-2026-57766 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.CVE-2026-57761 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 2, 2026ProfileGrid: Cross-Site Request Forgery (CSRF)CVE-2026-57759 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2.

  Product

  ProfileGrid

  Affected

  up to 6.0.0.2

  What to do

  Affects up to 6.0.0.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions.CVE-2026-57758 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.