Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13720 | wp-image-uploader (WordPress plugin) | The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_imag | high | 8.8 | 1% |
| CVE-2023-49006 | phpsysinfo/phpsysinfo | Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability | medium | 6.5 | 1% |
| CVE-2022-1576 | wp-maintenance-mode-\&-coming-soon (WordPress plugin) | The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could all | medium | 6.5 | 1% |
| CVE-2022-1761 | peter\'s-collaboration-e-mails (WordPress plugin) | The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change o | medium | 6.5 | 1% |
| CVE-2022-1843 | mailpress (WordPress plugin) | The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in ad | medium | 6.5 | 1% |
| CVE-2022-1967 | wp-championship (WordPress plugin) | The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perfo | medium | 6.5 | 1% |
| CVE-2022-2091 | cache-images (WordPress plugin) | The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any logged user upload i | medium | 6.5 | 1% |
| CVE-2022-1779 | auto-delete-posts (WordPress plugin) | The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attacke | high | 8.1 | 1% |
| CVE-2022-1791 | one-click-plugin-updater (WordPress plugin) | The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow | high | 8.1 | 1% |
| CVE-2021-3993 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2021-4033 | kevinpapst/kimai2 | Cross-Site Request Forgery in kimai2 | medium | 6.5 | 1% |
| CVE-2024-4757 | logo-manager-for-enamad (WordPress plugin) | The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as e | high | 8.1 | 1% |
| CVE-2022-3082 | discord-integration (WordPress plugin) | The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing | medium | 6.5 | 1% |
| CVE-2021-41176 | pterodactyl/panel | pterodactyl/panel CSRF allowing an external page to trigger a user logout event | low | 0.0 | 1% |
| CVE-2024-6316 | generate-pdf-using-contact-form-7 (WordPress plugin) | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions | high | 8.8 | 1% |
| CVE-2022-2987 | ldap-wp-login-\/-active-directory-integration (WordPress plugin) | The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating | high | 7.5 | 1% |
| CVE-2017-7491 | moodle/moodle | Moodle Cross-Site Request Forgery (CSRF) | medium | 4.3 | 1% |
| CVE-2017-15063 | intelliants/subrion | Subrion CMS CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2016-10865 | lightbox-plus (WordPress plugin) | The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus | medium | 6.1 | 1% |
| CVE-2018-21037 | intelliants/subrion | Subrion CMS CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2022-0231 | remdex/livehelperchat | Cross-Site Request Forgery (CSRF) in livehelperchat | medium | 6.5 | 1% |
| CVE-2022-2933 | 0mk-shortener (WordPress plugin) | The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to mis | medium | 5.4 | 1% |
| CVE-2022-4265 | replyable (WordPress plugin) | The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the p | high | 8.8 | 1% |
| CVE-2022-38144 | wpforo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress. | high | 8.8 | 1% |
| CVE-2022-3852 | vr-calendar-sync (WordPress plugin) | The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to mis | high | 8.8 | 1% |
| CVE-2025-53625 | universal-omega/dynamic-page-list3 | DynamicPageList3 vulnerability exposes hidden/suppressed usernames | high | 0.0 | 1% |
| CVE-2021-36887 | tarteaucitronjs (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & | medium | 6.1 | 1% |
| CVE-2021-24685 | flat-preloader (WordPress plugin) | The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and es | medium | 5.4 | 1% |
| CVE-2015-10001 | wp-stats (WordPress plugin) | The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting | medium | 4.3 | 1% |
| CVE-2022-36379 | yookassa (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. | high | 8.8 | 1% |
| CVE-2021-4123 | remdex/livehelperchat | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2021-24584 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any us | medium | 5.4 | 1% |
| CVE-2023-2239 | microweber/microweber | Information exposure in microweber | medium | 6.5 | 1% |
| CVE-2021-24570 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The | medium | 4.3 | 1% |
| CVE-2021-3728 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2024-25982 | moodle/moodle | Cross-Site Request Forgery in moodle | high | 8.8 | 0% |
| CVE-2014-10382 | feature-comments (WordPress plugin) | The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment. | medium | 4.3 | 0% |
| CVE-2018-14519 | getkirby/cms | Kirby CMS 2.5.12 Cross-site Request Forgery | medium | 4.3 | 0% |
| CVE-2019-10642 | contao/contao, contao/core-bundle | Contao CSRF Token Bypass | high | 8.8 | 0% |
| CVE-2026-40597 | mantisbt/mantisbt | MantisBT has a Content Security Policy bypass via attachments | high | 0.0 | 0% |
| CVE-2018-16650 | thorsten/phpmyfaq | phpMyFAQ CSRF | high | 8.8 | 0% |
| CVE-2019-7865 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition CSRF Vulnerability | high | 8.8 | 0% |
| CVE-2022-2350 | disable-user-login (WordPress plugin) | The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unaut | medium | 5.3 | 0% |
| CVE-2022-23975 | access-demo-importer (WordPress plugin) | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin. | medium | 6.5 | 0% |
| CVE-2022-0833 | church-admin (WordPress plugin) | The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allo | medium | 4.3 | 0% |
| CVE-2021-38342 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_pos | high | 8.1 | 0% |
| CVE-2024-39408 | magento/community-edition | Magento Open Source Cross-Site Request Forgery vulnerability | medium | 4.3 | 0% |
| CVE-2024-39409 | magento/community-edition | Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2024-39410 | magento/community-edition | Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2022-43693 | concrete5/concrete5 | Concrete CMS vulnerable to Cross-site Request Forgery | high | 8.8 | 0% |