CVE-2026-92410
The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowi
CVSS
4.3
Medium
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Published: Sep 20, 2026 · Last modified: Sep 20, 2026 · CWE-352
Not enough EPSS history yet.
The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-938734.3 MED5.1%
——2Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox.3dCVE-2026-938704.3 MED3.4%
——1Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users.3dCVE-2026-840848.8 HIG7.9%
——2IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery (CSRF) vulnerability.3dCVE-2026-840778.1 HIG8.5%
——3IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability.3dCVE-2026-935314.3 MED12.4%
——4A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.3dCVE-2026-775684.2 MED0.9%
——0Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.3d