Skip to content
Laskyr
Free scan
Scan my site free

Read-only. Nothing on your site is changed.

Cross-site request forgery (CSRF) in WordPress plugins

Cross-site request forgery tricks a logged-in admin into doing something without knowing it. The attacker sends a link or a page that quietly submits a request to your site. Because the admin’s browser is logged in, the plugin accepts it, unless it checks a nonce (a one-time token WordPress provides for this).

The attacker cannot see your site’s data this way, but they can make the admin’s browser change settings, add content or, in the worst cases, install code. It only works if an admin falls for the link while logged in.

What to do: update the plugin. Log out of wp-admin when you are done, and be wary of unexpected links that arrive while you are logged in.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest Cross-site request forgery (CSRF) records

1,613 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Other types

Cross-site scripting (XSS) · Missing authorization · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

← Check a plugin · Free hacked-site scan

First hour checklist

If the site was just hacked, read the emergency kit before you delete files. The page is free. Email is optional.

Read the emergency kit