Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3568 | imagemagick-engine (WordPress plugin) | The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up | high | 8.8 | 1% |
| CVE-2021-34636 | countdown-wpdevart-extended (WordPress plugin) | The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function | high | 8.8 | 1% |
| CVE-2021-42358 | contact-form-with-captcha (WordPress plugin) | The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-for | high | 8.8 | 1% |
| CVE-2021-42364 | stetic (WordPress plugin) | The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in | high | 8.8 | 1% |
| CVE-2019-15648 | insert-or-embed-articulate-content-into-wordpress (WordPress plugin) | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renam | medium | 6.5 | 1% |
| CVE-2021-43559 | moodle/moodle | Moodle contains CSRF vulnerability | high | 8.8 | 1% |
| CVE-2022-1611 | bulk-page-creator (WordPress plugin) | The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them v | high | 8.8 | 1% |
| CVE-2019-14327 | custom-simple-rss (WordPress plugin) | A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings. | medium | 6.5 | 1% |
| CVE-2020-36505 | delete-all-comments-easily (WordPress plugin) | The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an un | medium | 6.5 | 1% |
| CVE-2021-24704 | orange-form (WordPress plugin) | In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared | high | 8.8 | 1% |
| CVE-2017-8875 | clean-login (WordPress plugin) | CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL. | medium | 6.5 | 1% |
| CVE-2022-1912 | smartsoftbutton-widget-de-botones-de-chat (WordPress plugin) | The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This i | high | 8.8 | 1% |
| CVE-2021-4017 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2022-1765 | hot-linked-image-cacher (WordPress plugin) | The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external doma | high | 8.8 | 1% |
| CVE-2019-15062 | dolibarr/dolibarr | Dolibarr Cross-Site Request Forgery (CSRF) | high | 8.0 | 1% |
| CVE-2021-24328 | wp-login-security-and-history (WordPress plugin) | The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or val | medium | 6.2 | 1% |
| CVE-2017-6068 | intelliants/subrion | Subrion CMS vulnerable to CSRF in admin/blocks/add | high | 8.8 | 1% |
| CVE-2021-25010 | post-snippets (WordPress plugin) | The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin i | critical | 9.6 | 1% |
| CVE-2021-24879 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escapin | high | 8.8 | 1% |
| CVE-2022-0770 | translate-wordpress-with-gtranslate (WordPress plugin) | The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as u | high | 8.8 | 1% |
| CVE-2016-10962 | icegram (WordPress plugin) | The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter. | medium | 6.5 | 1% |
| CVE-2022-1589 | all-in-one-login (WordPress plugin) | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updati | high | 7.5 | 1% |
| CVE-2022-35943 | codeigniter4/shield | CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection | medium | 5.9 | 1% |
| CVE-2023-3977 | backup-migration (WordPress plugin), clone (WordPress plugin), duplicate-post (WordPress plugin) +7 more | Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missin | medium | 4.3 | 1% |
| CVE-2015-9332 | uninstall (WordPress plugin) | The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI. | medium | 6.5 | 1% |
| CVE-2022-3240 | follow-me (WordPress plugin) | The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due | high | 8.8 | 1% |
| CVE-2020-35239 | cakephp/cakephp | CakePHP allows method override parameters to bypass CSRF checks | high | 8.8 | 1% |
| CVE-2021-43353 | crisp (WordPress plugin) | The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settin | high | 8.8 | 1% |
| CVE-2018-18921 | phpservermon/phpservermon | CSRF in PHP Server Monitor before 3.3.2 | medium | 6.5 | 1% |
| CVE-2024-43434 | moodle/moodle | Moodle has CSRF risk in Feedback non-respondents report | high | 8.1 | 1% |
| CVE-2022-24879 | shopware/shopware | Malfunction of CSRF token validation in Shopware | high | 7.5 | 1% |
| CVE-2016-10883 | simple-add-pages-or-posts (WordPress plugin) | The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users. | medium | 6.5 | 1% |
| CVE-2018-5656 | pinterest-feeds (WordPress plugin) | An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php. | high | 8.8 | 1% |
| CVE-2022-0335 | moodle/moodle | Cross Site Request Forgery in Moodle | high | 8.8 | 1% |
| CVE-2019-14933 | bagisto/bagisto | Bagisto CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2022-1672 | insights-from-google-pagespeed (WordPress plugin) | The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Cust | high | 8.8 | 1% |
| CVE-2022-1758 | genki-pre-publish-reminder (WordPress plugin) | The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allo | high | 8.8 | 1% |
| CVE-2020-36174 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. | medium | 6.5 | 1% |
| CVE-2024-6317 | generate-pdf-using-contact-form-7 (WordPress plugin) | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions | high | 8.8 | 1% |
| CVE-2020-25263 | pyrocms/pyrocms | PyroCMS Vulnerable to CSRF | high | 7.1 | 1% |
| CVE-2021-24761 | error-log-viewer (WordPress plugin) | The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal pr | medium | 6.5 | 1% |
| CVE-2021-24230 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers | high | 8.1 | 1% |
| CVE-2018-6009 | yiisoft/yii2, yiisoft/yii2-dev | Yii Framework Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2021-4096 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it pos | high | 8.8 | 1% |
| CVE-2022-41996 | avada (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugi | high | 8.8 | 1% |
| CVE-2023-1509 | gmace (WordPress plugin) | The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing n | high | 8.8 | 1% |
| CVE-2021-24159 | contact-form-7-style (WordPress plugin) | Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject maliciou | high | 8.8 | 1% |
| CVE-2022-1900 | copify (WordPress plugin) | The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing | high | 8.8 | 1% |
| CVE-2018-5669 | read-and-understood (WordPress plugin) | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2018-6467 | flickrrss (WordPress plugin) | The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php. | high | 8.8 | 1% |