The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.

The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.

The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.

The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.

The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.

The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.

The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.

The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.

The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.

The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.

The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.

The wp-members plugin before 3.2.8 for WordPress has CSRF.

The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.

The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.

Discourse 2.3.2 sends the CSRF token in the query string.

MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.

openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.

The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.

The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.

FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.