diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
index a28727f18d..9882e5cecf 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
@@ -204,6 +204,7 @@
                 <h1>Transfer ownership of public list [% shelf.shelfname | html %]</h1>
 
                 <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="transferform" method="post">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset>
                         <input type="hidden" name="op" value="transfer" />
                         <input type="hidden" name="public" value="1" />
@@ -238,6 +239,7 @@
                     [% IF ( contents.count ) %]<p>This list contains [% contents.count | html %] titles</p>[% END %]
                     <div class="pages">[% pagination_bar | $raw %]</div>
                     <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="remove_biblios" />
                         <input type="hidden" name="referer" value="view" />
                         <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
@@ -389,6 +391,7 @@
             [% IF op == 'add_form' OR op == 'edit_form' %]
 
                 <form method="post" action="/cgi-bin/koha/virtualshelves/shelves.pl" class="validated">
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         [% IF op == 'add_form' %]
                             <legend><h1>Create a new list</h1></legend>
@@ -546,6 +549,7 @@
     <div class="modal" id="addToList" tabindex="-1" role="dialog" aria-labelledby="addToListLabel">
         <div class="modal-dialog" role="document">
             <form action="/cgi-bin/koha/virtualshelves/shelves.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-content">
                     <div class="modal-header">
                         <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
index 70bda3f595..b4ad503620 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
@@ -39,6 +39,7 @@
     [%~ public      = public | html ~%]
     [%~ IF can_manage_shelf ~%]
         [%~ action_block =                '<form action="shelves.pl" method="get">' ~%]
+        [%~ action_block = action_block _ '[% INCLUDE 'csrf-token.inc' %]' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="public" value="' _ public _ '" />' ~%]
@@ -48,6 +49,7 @@
     [%~ END ~%]
     [%~ IF can_delete_shelf ~%]
         [%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' ~%]
+        [%~ action_block = action_block _ '[% INCLUDE 'csrf-token.inc' %]' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
diff --git a/virtualshelves/shelves.pl b/virtualshelves/shelves.pl
index a7c5fcf7f0..33564f8333 100755
--- a/virtualshelves/shelves.pl
+++ b/virtualshelves/shelves.pl
@@ -29,7 +29,7 @@ use C4::Koha qw(
     GetNormalizedUPC
 );
 use C4::Members;
-use C4::Output qw( pagination_bar output_html_with_http_headers );
+use C4::Output qw( pagination_bar output_html_with_http_headers output_and_exit_if_error );
 use C4::XSLT qw( XSLTParse4Display );
 
 use Koha::Biblios;
@@ -64,6 +64,7 @@ if ( $op eq 'add_form' ) {
     # Only pass default
     $shelf = { allow_change_from_owner => 1 };
 } elsif ( $op eq 'edit_form' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     $shelfnumber = $query->param('shelfnumber');
     $shelf       = Koha::Virtualshelves->find($shelfnumber);
 
@@ -79,6 +80,7 @@ if ( $op eq 'add_form' ) {
         push @messages, { type => 'alert', code => 'does_not_exist' };
     }
 } elsif ( $op eq 'add' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     my $allow_changes_from = $query->param('allow_changes_from');
     eval {
         $shelf = Koha::Virtualshelf->new(
@@ -105,6 +107,7 @@ if ( $op eq 'add_form' ) {
         $op = 'view';
     }
 } elsif ( $op eq 'edit' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     $shelfnumber = $query->param('shelfnumber');
     $shelf       = Koha::Virtualshelves->find($shelfnumber);
 
@@ -136,6 +139,7 @@ if ( $op eq 'add_form' ) {
         push @messages, { type => 'alert', code => 'does_not_exist' };
     }
 } elsif ( $op eq 'delete' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     $shelfnumber = $query->param('shelfnumber');
     $shelf       = Koha::Virtualshelves->find($shelfnumber);
     if ($shelf) {
@@ -154,6 +158,7 @@ if ( $op eq 'add_form' ) {
     }
     $op = 'list';
 } elsif ( $op eq 'add_biblio' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     $shelfnumber = $query->param('shelfnumber');
     $shelf = Koha::Virtualshelves->find($shelfnumber);
     if ($shelf) {
@@ -210,6 +215,7 @@ if ( $op eq 'add_form' ) {
     }
     $op = $referer;
 } elsif ( $op eq 'remove_biblios' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     $shelfnumber = $query->param('shelfnumber');
     $shelf = Koha::Virtualshelves->find($shelfnumber);
     my @biblionumbers = $query->multi_param('biblionumber');