CVE Watch24 jul 2026

CVE-2026-39617

Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affect

CVSS

9.6

Crítico

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 8 abr 2026 · Última mod.: 24 jul 2026 · CWE-352

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-06-302026-07-26

Descripción técnica

Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from n/a through <= 1.7.3.

Referencias oficiales

patchstack.comhttps://patchstack.com/database/Wordpress/Theme/bluestreet/vulnerability/wordpress-bluestreet-theme-1-7-3-cross-site-request-forgery-csrf-to-arbitrary-plugin-installation-vulnerability?_s_id=cve

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-664744.3 MED

—

———Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.9h CVE-2026-664284.3 MED

—

———Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.11h CVE-2026-152128.8 ALT

5.3%

——2The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.3d CVE-2026-655407.1 ALT

0.7%

——0Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.5d CVE-2026-655397.1 ALT

0.7%

——0Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.5d CVE-2026-655366.5 MED

2.5%

——1Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.5d