Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24636 | print-my-blog (WordPress plugin) | The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrator | high | 8.1 | 1% |
| CVE-2021-24641 | images-to-webp (WordPress plugin) | The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could r | high | 8.1 | 1% |
| CVE-2022-1572 | html2wp (WordPress plugin) | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated use | high | 8.1 | 1% |
| CVE-2021-25095 | country-blocker (WordPress plugin) | The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocke | high | 7.1 | 1% |
| CVE-2021-24914 | tawk.to-live-chat (WordPress plugin) | The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget | high | 8.0 | 1% |
| CVE-2019-20891 | woocommerce/woocommerce | WooCommerce Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2022-1605 | email-users (WordPress plugin) | The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 6.5 | 1% |
| CVE-2022-1608 | social-locker (WordPress plugin) | The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow at | medium | 6.5 | 1% |
| CVE-2022-1610 | seamless-donations (WordPress plugin) | The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 1% |
| CVE-2022-1612 | webriti-smtp-mail (WordPress plugin) | The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 6.5 | 1% |
| CVE-2022-1624 | latest-tweets-widget (WordPress plugin) | The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow atta | medium | 6.5 | 1% |
| CVE-2022-1630 | wp-email (WordPress plugin) | The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a l | medium | 6.5 | 1% |
| CVE-2022-1694 | useful-banner-manager (WordPress plugin) | The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attack | medium | 6.5 | 1% |
| CVE-2022-1790 | new-user-email-set-up (WordPress plugin) | The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 6.5 | 1% |
| CVE-2022-1826 | cross-linker (WordPress plugin) | The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers t | medium | 6.5 | 1% |
| CVE-2022-1827 | pdf24-articles-to-pdf (WordPress plugin) | The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow atta | medium | 6.5 | 1% |
| CVE-2022-1828 | pdf24-articles-to-pdf (WordPress plugin) | The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 6.5 | 1% |
| CVE-2022-1829 | inline-google-maps (WordPress plugin) | The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 1% |
| CVE-2022-1832 | capa-protect (WordPress plugin) | The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 6.5 | 1% |
| CVE-2023-37650 | cockpit-hq/cockpit | Cockpit CMS Cross-Site Request Forgery vulnerability | high | 8.8 | 1% |
| CVE-2021-4401 | analogwp-templates (WordPress plugin) | The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to miss | high | 8.8 | 1% |
| CVE-2022-2245 | counter-box (WordPress plugin) | The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers t | high | 8.8 | 1% |
| CVE-2025-1306 | newscrunch (WordPress theme) | The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to m | high | 8.8 | 1% |
| CVE-2022-0269 | yetiforce/yetiforce-crm | Cross-Site Request Forgery in yetiforce | high | 8.0 | 1% |
| CVE-2021-24843 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make | medium | 6.5 | 1% |
| CVE-2021-25072 | social-networks-auto-poster (WordPress plugin) | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing | medium | 6.5 | 1% |
| CVE-2021-25098 | easy-pricing-tables (WordPress plugin) | The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to | medium | 6.5 | 1% |
| CVE-2022-0445 | wordpress-real-cookie-banner (WordPress plugin) | The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place w | medium | 6.5 | 1% |
| CVE-2022-0681 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attacker | medium | 6.5 | 1% |
| CVE-2022-29495 | popup-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin s | medium | 5.4 | 1% |
| CVE-2018-11632 | add-social-share-buttons (WordPress plugin) | An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user | medium | 6.5 | 1% |
| CVE-2018-11633 | woo-checkout-for-digital-goods (WordPress plugin) | An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visit | medium | 6.5 | 1% |
| CVE-2022-2353 | microweber/microweber | Microweber before v1.2.20 vulnerable to cross-site scripting | medium | 6.3 | 1% |
| CVE-2021-24978 | osmapper (WordPress plugin) | The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with | medium | 5.3 | 1% |
| CVE-2021-24595 | wp-cookie-choice (WordPress plugin) | The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputtin | medium | 6.5 | 1% |
| CVE-2019-14680 | admin-renamer-extended (WordPress plugin) | The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/a | medium | 5.7 | 1% |
| CVE-2020-25262 | pyrocms/pyrocms | PyroCMS Vulnerable to CSRF | medium | 4.3 | 1% |
| CVE-2024-13720 | wp-image-uploader (WordPress plugin) | The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_imag | high | 8.8 | 1% |
| CVE-2023-49006 | phpsysinfo/phpsysinfo | Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability | medium | 6.5 | 1% |
| CVE-2022-1576 | wp-maintenance-mode-\&-coming-soon (WordPress plugin) | The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could all | medium | 6.5 | 1% |
| CVE-2022-1761 | peter\'s-collaboration-e-mails (WordPress plugin) | The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change o | medium | 6.5 | 1% |
| CVE-2022-1843 | mailpress (WordPress plugin) | The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in ad | medium | 6.5 | 1% |
| CVE-2022-1967 | wp-championship (WordPress plugin) | The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perfo | medium | 6.5 | 1% |
| CVE-2022-2091 | cache-images (WordPress plugin) | The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any logged user upload i | medium | 6.5 | 1% |
| CVE-2022-1779 | auto-delete-posts (WordPress plugin) | The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attacke | high | 8.1 | 1% |
| CVE-2022-1791 | one-click-plugin-updater (WordPress plugin) | The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow | high | 8.1 | 1% |
| CVE-2021-3993 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2021-4033 | kevinpapst/kimai2 | Cross-Site Request Forgery in kimai2 | medium | 6.5 | 1% |
| CVE-2024-4757 | logo-manager-for-enamad (WordPress plugin) | The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as e | high | 8.1 | 1% |
| CVE-2022-3082 | discord-integration (WordPress plugin) | The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing | medium | 6.5 | 1% |