Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-4017 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2022-1765 | hot-linked-image-cacher (WordPress plugin) | The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external doma | high | 8.8 | 1% |
| CVE-2019-15062 | dolibarr/dolibarr | Dolibarr Cross-Site Request Forgery (CSRF) | high | 8.0 | 1% |
| CVE-2021-24328 | wp-login-security-and-history (WordPress plugin) | The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or val | medium | 6.2 | 1% |
| CVE-2017-6068 | intelliants/subrion | Subrion CMS vulnerable to CSRF in admin/blocks/add | high | 8.8 | 1% |
| CVE-2021-25010 | post-snippets (WordPress plugin) | The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin i | critical | 9.6 | 1% |
| CVE-2021-24879 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escapin | high | 8.8 | 1% |
| CVE-2022-0770 | translate-wordpress-with-gtranslate (WordPress plugin) | The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as u | high | 8.8 | 1% |
| CVE-2016-10962 | icegram (WordPress plugin) | The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter. | medium | 6.5 | 1% |
| CVE-2022-1589 | all-in-one-login (WordPress plugin) | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updati | high | 7.5 | 1% |
| CVE-2022-35943 | codeigniter4/shield | CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection | medium | 5.9 | 1% |
| CVE-2023-3977 | backup-migration (WordPress plugin), clone (WordPress plugin), duplicate-post (WordPress plugin) +7 more | Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missin | medium | 4.3 | 1% |
| CVE-2015-9332 | uninstall (WordPress plugin) | The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI. | medium | 6.5 | 1% |
| CVE-2022-3240 | follow-me (WordPress plugin) | The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due | high | 8.8 | 1% |
| CVE-2020-35239 | cakephp/cakephp | CakePHP allows method override parameters to bypass CSRF checks | high | 8.8 | 1% |
| CVE-2021-43353 | crisp (WordPress plugin) | The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settin | high | 8.8 | 1% |
| CVE-2018-18921 | phpservermon/phpservermon | CSRF in PHP Server Monitor before 3.3.2 | medium | 6.5 | 1% |
| CVE-2024-43434 | moodle/moodle | Moodle has CSRF risk in Feedback non-respondents report | high | 8.1 | 1% |
| CVE-2022-24879 | shopware/shopware | Malfunction of CSRF token validation in Shopware | high | 7.5 | 1% |
| CVE-2016-10883 | simple-add-pages-or-posts (WordPress plugin) | The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users. | medium | 6.5 | 1% |
| CVE-2018-5656 | pinterest-feeds (WordPress plugin) | An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php. | high | 8.8 | 1% |
| CVE-2022-0335 | moodle/moodle | Cross Site Request Forgery in Moodle | high | 8.8 | 1% |
| CVE-2019-14933 | bagisto/bagisto | Bagisto CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2022-1672 | insights-from-google-pagespeed (WordPress plugin) | The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Cust | high | 8.8 | 1% |
| CVE-2022-1758 | genki-pre-publish-reminder (WordPress plugin) | The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allo | high | 8.8 | 1% |
| CVE-2020-36174 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. | medium | 6.5 | 1% |
| CVE-2024-6317 | generate-pdf-using-contact-form-7 (WordPress plugin) | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions | high | 8.8 | 1% |
| CVE-2020-25263 | pyrocms/pyrocms | PyroCMS Vulnerable to CSRF | high | 7.1 | 1% |
| CVE-2021-24761 | error-log-viewer (WordPress plugin) | The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal pr | medium | 6.5 | 1% |
| CVE-2021-24230 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers | high | 8.1 | 1% |
| CVE-2018-6009 | yiisoft/yii2, yiisoft/yii2-dev | Yii Framework Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2021-4096 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it pos | high | 8.8 | 1% |
| CVE-2022-41996 | avada (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugi | high | 8.8 | 1% |
| CVE-2023-1509 | gmace (WordPress plugin) | The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing n | high | 8.8 | 1% |
| CVE-2021-24159 | contact-form-7-style (WordPress plugin) | Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject maliciou | high | 8.8 | 1% |
| CVE-2022-1900 | copify (WordPress plugin) | The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing | high | 8.8 | 1% |
| CVE-2018-5669 | read-and-understood (WordPress plugin) | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2018-6467 | flickrrss (WordPress plugin) | The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2022-2184 | captcha-4wp (WordPress plugin) | The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This c | high | 8.8 | 1% |
| CVE-2022-29451 | rara-one-click-demo-import (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress | high | 8.8 | 1% |
| CVE-2021-24890 | scripts-organizer (WordPress plugin) | The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both | high | 8.8 | 1% |
| CVE-2022-2432 | ecwid-shopping-cart (WordPress plugin) | The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23 | high | 8.8 | 1% |
| CVE-2022-0191 | ad-invalid-click-protector (WordPress plugin) | The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attack | medium | 6.5 | 1% |
| CVE-2021-4387 | opal-estate (WordPress plugin) | The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to mi | medium | 4.3 | 1% |
| CVE-2021-24945 | like-button-rating (WordPress plugin) | The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes | high | 8.0 | 1% |
| CVE-2021-24231 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers | medium | 6.5 | 1% |
| CVE-2021-24779 | wp-debugging (WordPress plugin) | The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and | medium | 6.5 | 1% |
| CVE-2021-25081 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow | medium | 6.5 | 1% |
| CVE-2021-24642 | scroll-banner (WordPress plugin) | The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, esca | medium | 6.5 | 1% |
| CVE-2021-24675 | one-user-avatar (WordPress plugin) | The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortco | medium | 6.5 | 1% |