Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2184 | captcha-4wp (WordPress plugin) | The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This c | high | 8.8 | 1% |
| CVE-2022-29451 | rara-one-click-demo-import (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress | high | 8.8 | 1% |
| CVE-2021-24890 | scripts-organizer (WordPress plugin) | The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both | high | 8.8 | 1% |
| CVE-2022-2432 | ecwid-shopping-cart (WordPress plugin) | The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23 | high | 8.8 | 1% |
| CVE-2022-0191 | ad-invalid-click-protector (WordPress plugin) | The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attack | medium | 6.5 | 1% |
| CVE-2021-4387 | opal-estate (WordPress plugin) | The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to mi | medium | 4.3 | 1% |
| CVE-2021-24945 | like-button-rating (WordPress plugin) | The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes | high | 8.0 | 1% |
| CVE-2021-24231 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers | medium | 6.5 | 1% |
| CVE-2021-24779 | wp-debugging (WordPress plugin) | The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and | medium | 6.5 | 1% |
| CVE-2021-25081 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow | medium | 6.5 | 1% |
| CVE-2021-24642 | scroll-banner (WordPress plugin) | The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, esca | medium | 6.5 | 1% |
| CVE-2021-24675 | one-user-avatar (WordPress plugin) | The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortco | medium | 6.5 | 1% |
| CVE-2021-24735 | compact-wp-audio-player (WordPress plugin) | The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in a | medium | 6.5 | 1% |
| CVE-2020-13156 | nukeviet/nukeviet | NukeViet Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2020-13157 | nukeviet/nukeviet | NukeViet Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2022-23601 | symfony/framework-bundle, symfony/symfony | CSRF token missing in Symfony | high | 8.1 | 1% |
| CVE-2021-4349 | process-steps-template-designer (WordPress plugin) | The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1 | high | 8.8 | 1% |
| CVE-2022-24712 | codeigniter4/framework | Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4 | medium | 6.3 | 1% |
| CVE-2023-0088 | swifty-page-manager (WordPress plugin) | The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is du | high | 8.8 | 1% |
| CVE-2022-3536 | role-based-pricing-for-woocommerce (WordPress plugin) | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not | high | 8.8 | 1% |
| CVE-2020-36760 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to mi | medium | 4.3 | 1% |
| CVE-2020-36761 | top-10 (WordPress plugin) | The Top 10 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.4. This is due to missing | medium | 4.3 | 1% |
| CVE-2021-4425 | defender-security (WordPress plugin) | The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due | medium | 4.3 | 1% |
| CVE-2021-4426 | absolute-reviews (WordPress plugin) | The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due t | medium | 4.3 | 1% |
| CVE-2021-4427 | free-comments-for-wordpress-vuukle (WordPress plugin) | The Vuukle Comments, Reactions, Share Bar, Revenue plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 1% |
| CVE-2021-36886 | contact-form-cfdb7 (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9). | medium | 6.5 | 1% |
| CVE-2021-34631 | newsplugin (WordPress plugin) | The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.ph | high | 8.8 | 1% |
| CVE-2021-24324 | all-404-redirect-to-homepage (WordPress plugin) | The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user | medium | 6.5 | 1% |
| CVE-2021-24467 | leaflet-map (WordPress plugin) | The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logg | medium | 6.5 | 1% |
| CVE-2021-24490 | email-artillery (WordPress plugin) | The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, all | medium | 6.8 | 1% |
| CVE-2021-4131 | remdex/livehelperchat | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2019-19981 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings. | medium | 5.4 | 1% |
| CVE-2015-9418 | watupro (WordPress plugin) | The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes. | medium | 4.3 | 1% |
| CVE-2021-3901 | grumpydictator/firefly-iii | Cross-Site Request Forgery in firefly-iii | low | 3.5 | 1% |
| CVE-2022-1732 | rename-wp-login (WordPress plugin) | The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could all | medium | 6.5 | 1% |
| CVE-2021-24922 | pixel-cat (WordPress plugin) | The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some o | critical | 9.0 | 1% |
| CVE-2021-20842 | ec-cube/ec-cube | EC-CUBE Cross-site request forgery (CSRF) vulnerability | medium | 6.5 | 1% |
| CVE-2021-3900 | grumpydictator/firefly-iii | Cross-Site Request Forgery in firefly-iii | medium | 6.5 | 1% |
| CVE-2023-5882 | export-any-wordpress-data-to-xml\/csv (WordPress plugin), wp-all-export (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce | high | 8.8 | 1% |
| CVE-2023-5886 | export-any-wordpress-data-to-xml\/csv (WordPress plugin), wp-all-export (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce | high | 8.8 | 1% |
| CVE-2021-24823 | support-board (WordPress plugin) | The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could a | high | 8.1 | 1% |
| CVE-2022-3537 | role-based-pricing-for-woocommerce (WordPress plugin) | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not valida | high | 8.8 | 1% |
| CVE-2022-0229 | google-authenticator (WordPress plugin) | The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the recon | high | 8.1 | 1% |
| CVE-2021-24674 | genie-wp-favicon (WordPress plugin) | The Genie WP Favicon WordPress plugin through 0.5.2 does not have CSRF in place when updating the favicon, which could allow attackers to ma | medium | 6.5 | 1% |
| CVE-2021-24766 | 404-to-301 (WordPress plugin) | The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, | medium | 6.5 | 1% |
| CVE-2021-24767 | redirect-404-error-page-to-homepage-or-custom-page-with-logs (WordPress plugin) | The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, w | medium | 6.5 | 1% |
| CVE-2021-24784 | wp-admin-logo-changer (WordPress plugin) | The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to mak | medium | 6.5 | 1% |
| CVE-2021-24795 | filter-portfolio-gallery (WordPress plugin) | The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which | medium | 6.5 | 1% |
| CVE-2021-24802 | colorful-categories (WordPress plugin) | The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin o | medium | 6.5 | 1% |
| CVE-2021-24852 | mousewheel-smooth-scroll (WordPress plugin) | The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers | medium | 6.5 | 1% |