Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2518 | stockists-manager (WordPress plugin) | The Stockists Manager for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0 | high | 8.8 | 1% |
| CVE-2021-3858 | snipe/snipe-it | Cross-Site Request Forgery in snipe-it | medium | 4.3 | 1% |
| CVE-2021-22954 | concrete5/concrete5 | Cross Site Request Forgery in concrete5/concrete5 | high | 0.0 | 1% |
| CVE-2022-0830 | formbuilder (WordPress plugin) | The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not san | medium | 6.5 | 1% |
| CVE-2022-1407 | hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, a | medium | 6.5 | 1% |
| CVE-2022-1422 | discy (WordPress plugin) | The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an | medium | 6.5 | 1% |
| CVE-2022-1424 | ask-me (WordPress plugin) | The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in us | medium | 6.5 | 1% |
| CVE-2021-24936 | wp-extra-file-types (WordPress plugin) | The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of the | high | 8.0 | 1% |
| CVE-2021-3819 | grumpydictator/firefly-iii | Cross-Site Request Forgery in firefly-iii | medium | 4.3 | 1% |
| CVE-2021-4422 | post-smtp (WordPress plugin) | The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due | medium | 4.3 | 1% |
| CVE-2022-2381 | e-unlocked---student-result (WordPress plugin) | The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could al | high | 8.8 | 1% |
| CVE-2021-24989 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be del | medium | 6.5 | 1% |
| CVE-2021-24636 | print-my-blog (WordPress plugin) | The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrator | high | 8.1 | 1% |
| CVE-2021-24641 | images-to-webp (WordPress plugin) | The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could r | high | 8.1 | 1% |
| CVE-2022-1572 | html2wp (WordPress plugin) | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated use | high | 8.1 | 1% |
| CVE-2021-25095 | country-blocker (WordPress plugin) | The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocke | high | 7.1 | 1% |
| CVE-2021-24914 | tawk.to-live-chat (WordPress plugin) | The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget | high | 8.0 | 1% |
| CVE-2024-13215 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13 | medium | 4.3 | 1% |
| CVE-2019-20891 | woocommerce/woocommerce | WooCommerce Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2022-1605 | email-users (WordPress plugin) | The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 6.5 | 1% |
| CVE-2022-1608 | social-locker (WordPress plugin) | The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow at | medium | 6.5 | 1% |
| CVE-2022-1610 | seamless-donations (WordPress plugin) | The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 1% |
| CVE-2022-1612 | webriti-smtp-mail (WordPress plugin) | The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 6.5 | 1% |
| CVE-2022-1624 | latest-tweets-widget (WordPress plugin) | The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow atta | medium | 6.5 | 1% |
| CVE-2022-1630 | wp-email (WordPress plugin) | The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a l | medium | 6.5 | 1% |
| CVE-2022-1694 | useful-banner-manager (WordPress plugin) | The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attack | medium | 6.5 | 1% |
| CVE-2022-1790 | new-user-email-set-up (WordPress plugin) | The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 6.5 | 1% |
| CVE-2022-1826 | cross-linker (WordPress plugin) | The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers t | medium | 6.5 | 1% |
| CVE-2022-1827 | pdf24-articles-to-pdf (WordPress plugin) | The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow atta | medium | 6.5 | 1% |
| CVE-2022-1828 | pdf24-articles-to-pdf (WordPress plugin) | The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 6.5 | 1% |
| CVE-2022-1829 | inline-google-maps (WordPress plugin) | The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 1% |
| CVE-2022-1832 | capa-protect (WordPress plugin) | The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 6.5 | 1% |
| CVE-2023-37650 | cockpit-hq/cockpit | Cockpit CMS Cross-Site Request Forgery vulnerability | high | 8.8 | 1% |
| CVE-2021-4401 | analogwp-templates (WordPress plugin) | The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to miss | high | 8.8 | 1% |
| CVE-2022-2245 | counter-box (WordPress plugin) | The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers t | high | 8.8 | 1% |
| CVE-2025-1306 | newscrunch (WordPress theme) | The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to m | high | 8.8 | 1% |
| CVE-2022-0269 | yetiforce/yetiforce-crm | Cross-Site Request Forgery in yetiforce | high | 8.0 | 1% |
| CVE-2021-24843 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make | medium | 6.5 | 1% |
| CVE-2021-25072 | social-networks-auto-poster (WordPress plugin) | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing | medium | 6.5 | 1% |
| CVE-2021-25098 | easy-pricing-tables (WordPress plugin) | The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to | medium | 6.5 | 1% |
| CVE-2022-0445 | wordpress-real-cookie-banner (WordPress plugin) | The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place w | medium | 6.5 | 1% |
| CVE-2022-0681 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attacker | medium | 6.5 | 1% |
| CVE-2022-29495 | popup-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin s | medium | 5.4 | 1% |
| CVE-2018-11632 | add-social-share-buttons (WordPress plugin) | An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user | medium | 6.5 | 1% |
| CVE-2018-11633 | woo-checkout-for-digital-goods (WordPress plugin) | An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visit | medium | 6.5 | 1% |
| CVE-2022-2353 | microweber/microweber | Microweber before v1.2.20 vulnerable to cross-site scripting | medium | 6.3 | 1% |
| CVE-2021-24978 | osmapper (WordPress plugin) | The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with | medium | 5.3 | 1% |
| CVE-2021-24595 | wp-cookie-choice (WordPress plugin) | The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputtin | medium | 6.5 | 1% |
| CVE-2019-14680 | admin-renamer-extended (WordPress plugin) | The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/a | medium | 5.7 | 1% |
| CVE-2020-25262 | pyrocms/pyrocms | PyroCMS Vulnerable to CSRF | medium | 4.3 | 1% |