CVE-2026-28281 HIGH

CVE-2026-28281: InstantCMS has Multiple CSRF Vulnerabilities

Vendor Instantsoft

Product icms2

Weakness CWE-352 · CSRF

Published March 9, 2026

Last update March 10, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

What the vulnerability does

01Description

InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.

Key dates

02Disclosure timeline

March 9, 2026 CVE published

March 10, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-28281 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities

04Related CVE

CVE-2024-2115 LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation CVE-2023-46620 WordPress DeepL Pro API translation Plugin <= 2.3.9.1 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2025-25154 WordPress Custom Comment Notifications plugin <= 1.0.8 - CSRF to Stored XSS vulnerability CVE-2025-67598 WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability CVE-2022-4219 Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletion