Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24735 | compact-wp-audio-player (WordPress plugin) | The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in a | medium | 6.5 | 1% |
| CVE-2020-13156 | nukeviet/nukeviet | NukeViet Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2020-13157 | nukeviet/nukeviet | NukeViet Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2022-23601 | symfony/framework-bundle, symfony/symfony | CSRF token missing in Symfony | high | 8.1 | 1% |
| CVE-2021-4349 | process-steps-template-designer (WordPress plugin) | The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1 | high | 8.8 | 1% |
| CVE-2022-24712 | codeigniter4/framework | Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4 | medium | 6.3 | 1% |
| CVE-2023-0088 | swifty-page-manager (WordPress plugin) | The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is du | high | 8.8 | 1% |
| CVE-2022-3536 | role-based-pricing-for-woocommerce (WordPress plugin) | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not | high | 8.8 | 1% |
| CVE-2020-36760 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to mi | medium | 4.3 | 1% |
| CVE-2020-36761 | top-10 (WordPress plugin) | The Top 10 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.4. This is due to missing | medium | 4.3 | 1% |
| CVE-2021-4425 | defender-security (WordPress plugin) | The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due | medium | 4.3 | 1% |
| CVE-2021-4426 | absolute-reviews (WordPress plugin) | The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due t | medium | 4.3 | 1% |
| CVE-2021-4427 | free-comments-for-wordpress-vuukle (WordPress plugin) | The Vuukle Comments, Reactions, Share Bar, Revenue plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 1% |
| CVE-2021-36886 | contact-form-cfdb7 (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9). | medium | 6.5 | 1% |
| CVE-2021-34631 | newsplugin (WordPress plugin) | The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.ph | high | 8.8 | 1% |
| CVE-2021-24324 | all-404-redirect-to-homepage (WordPress plugin) | The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user | medium | 6.5 | 1% |
| CVE-2021-24467 | leaflet-map (WordPress plugin) | The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logg | medium | 6.5 | 1% |
| CVE-2021-24490 | email-artillery (WordPress plugin) | The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, all | medium | 6.8 | 1% |
| CVE-2021-4131 | remdex/livehelperchat | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2019-19981 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings. | medium | 5.4 | 1% |
| CVE-2015-9418 | watupro (WordPress plugin) | The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes. | medium | 4.3 | 1% |
| CVE-2021-3901 | grumpydictator/firefly-iii | Cross-Site Request Forgery in firefly-iii | low | 3.5 | 1% |
| CVE-2022-1732 | rename-wp-login (WordPress plugin) | The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could all | medium | 6.5 | 1% |
| CVE-2021-24922 | pixel-cat (WordPress plugin) | The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some o | critical | 9.0 | 1% |
| CVE-2021-20842 | ec-cube/ec-cube | EC-CUBE Cross-site request forgery (CSRF) vulnerability | medium | 6.5 | 1% |
| CVE-2021-3900 | grumpydictator/firefly-iii | Cross-Site Request Forgery in firefly-iii | medium | 6.5 | 1% |
| CVE-2023-5882 | export-any-wordpress-data-to-xml\/csv (WordPress plugin), wp-all-export (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce | high | 8.8 | 1% |
| CVE-2023-5886 | export-any-wordpress-data-to-xml\/csv (WordPress plugin), wp-all-export (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce | high | 8.8 | 1% |
| CVE-2021-24823 | support-board (WordPress plugin) | The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could a | high | 8.1 | 1% |
| CVE-2022-3537 | role-based-pricing-for-woocommerce (WordPress plugin) | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not valida | high | 8.8 | 1% |
| CVE-2022-0229 | google-authenticator (WordPress plugin) | The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the recon | high | 8.1 | 1% |
| CVE-2021-24674 | genie-wp-favicon (WordPress plugin) | The Genie WP Favicon WordPress plugin through 0.5.2 does not have CSRF in place when updating the favicon, which could allow attackers to ma | medium | 6.5 | 1% |
| CVE-2021-24766 | 404-to-301 (WordPress plugin) | The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, | medium | 6.5 | 1% |
| CVE-2021-24767 | redirect-404-error-page-to-homepage-or-custom-page-with-logs (WordPress plugin) | The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, w | medium | 6.5 | 1% |
| CVE-2021-24784 | wp-admin-logo-changer (WordPress plugin) | The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to mak | medium | 6.5 | 1% |
| CVE-2021-24795 | filter-portfolio-gallery (WordPress plugin) | The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which | medium | 6.5 | 1% |
| CVE-2021-24802 | colorful-categories (WordPress plugin) | The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin o | medium | 6.5 | 1% |
| CVE-2021-24852 | mousewheel-smooth-scroll (WordPress plugin) | The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers | medium | 6.5 | 1% |
| CVE-2022-2518 | stockists-manager (WordPress plugin) | The Stockists Manager for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0 | high | 8.8 | 1% |
| CVE-2021-3858 | snipe/snipe-it | Cross-Site Request Forgery in snipe-it | medium | 4.3 | 1% |
| CVE-2021-22954 | concrete5/concrete5 | Cross Site Request Forgery in concrete5/concrete5 | high | 0.0 | 1% |
| CVE-2022-0830 | formbuilder (WordPress plugin) | The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not san | medium | 6.5 | 1% |
| CVE-2022-1407 | hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, a | medium | 6.5 | 1% |
| CVE-2022-1422 | discy (WordPress plugin) | The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an | medium | 6.5 | 1% |
| CVE-2022-1424 | ask-me (WordPress plugin) | The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in us | medium | 6.5 | 1% |
| CVE-2021-24936 | wp-extra-file-types (WordPress plugin) | The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of the | high | 8.0 | 1% |
| CVE-2021-3819 | grumpydictator/firefly-iii | Cross-Site Request Forgery in firefly-iii | medium | 4.3 | 1% |
| CVE-2021-4422 | post-smtp (WordPress plugin) | The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due | medium | 4.3 | 1% |
| CVE-2022-2381 | e-unlocked---student-result (WordPress plugin) | The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could al | high | 8.8 | 1% |
| CVE-2021-24989 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be del | medium | 6.5 | 1% |