CVE Watch23 jul 2026

CVE-2026-8910

The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is

CVSS

6.1

Medio

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 9 jun 2026 · Última mod.: 23 jul 2026 · CWE-352

EPSS · 30d

0.1%EPSS · 30 días0.2%

2026-10-052026-11-02

Descripción técnica

The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-103420—

—

——0Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.51d CVE-2026-1202496.5 MED

3.6%

——1Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.22h CVE-2026-1202077.1 ALT

10.3%

——3Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.22h CVE-2026-1202065.9 MED

4.1%

——1Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.22h CVE-2026-655668.8 ALT

5.8%

——2Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8.4d CVE-2026-6182610.0 CRÍ

18.2%

——5Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin/<pin_id>/check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.4d