CVE-2025-10308
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This
CVSS
4.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Aug 14, 2026 · Last modified: Aug 14, 2026 · CWE-352
Not enough EPSS history yet.
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/astro-booking-engine/tags/1.3.0/includes/tabs/tab-support.php#L6
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset/3638105/astro-booking-engine
- www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/4b0b13b4-b604-4514-845e-05a3b8858c66?source=cve
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-57469——
———Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim's browser to submit crafted requests.7hCVE-2026-197864.3 MED—
———A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component.8hCVE-2026-728497.7 HIG—
———Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions.1dCVE-2026-726587.3 HIG—
———Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.18hCVE-2026-170698.1 HIG—
———IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens.10hCVE-2026-133657.1 HIG—
———IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.6h