Cross-Site Request Forgery

Every one of the 23 is a mark on the map. Named now: 1 to 23, most at risk first.

1. WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF pro…CVE-2019-9787Wordpress · 39% likely

   CWE-352

2. Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hija…CVE-2016-6897Wordpress · 29% likely

   CWE-352

3. Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the…CVE-2013-7233Wordpress · 3.8% likely

   CWE-352

4. Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests…CVE-2015-5731Wordpress · 3.4% likely

   CWE-352

5. The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easi…CVE-2012-1936Wordpress · 3.3% likely

   CWE-352

6. WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.CVE-2019-17675Wordpress · 2.8% likely

   CWE-352

7. In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The…CVE-2017-6819Wordpress · 2.2% likely

   CWE-352

8. Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users f…CVE-2014-9033Wordpress · 2.0% likely

   CWE-352

9. Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of…CVE-2017-5492Wordpress · 1.9% likely

   CWE-352

10. Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers t…CVE-2016-6635Wordpress · 1.9% likely

    CWE-352

11. wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it ea…CVE-2014-5204Wordpress · 1.8% likely

    CWE-352

12. wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote a…CVE-2014-5205Wordpress · 1.8% likely

    CWE-352

13. In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.CVE-2017-9064Wordpress · 1.7% likely

    CWE-352

14. wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote atta…CVE-2007-4893Wordpress · 1.5% likely

    CWE-352

15. Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash…CVE-2017-5489Wordpress · 1.4% likely

    CWE-352

16. WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site re…CVE-2008-5113Wordpress · 1.4% likely

    CWE-352

17. Cross-site request forgery (CSRF) vulnerability in deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for WordPress allows remote attackers to modify the…CVE-2008-0508Wordpress · 1.3% likely

    CWE-352

18. Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown…CVE-2012-3384Wordpress · 1.2% likely

    CWE-352

19. Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that m…CVE-2012-4448Wordpress · 1.1% likely

    CWE-352

20. WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.CVE-2020-28040Wordpress · 1.1% likely

    CWE-352

21. Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary user…CVE-2013-3250Wordpress · 1.0% likely

    CWE-352

22. Cross-site scripting (XSS) vulnerability in wp-newblog.php in WordPress multi-user (MU) 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the webl…CVE-2007-4544Wordpress · 0.9% likely

    CWE-352

23. Blogger Importer Plugin blogger-importer.php restart cross-site request forgeryCVE-2013-10027Wordpress · CVSS 4.3 · 0.4% likely

    CWE-352

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.