Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-41176 | pterodactyl/panel | pterodactyl/panel CSRF allowing an external page to trigger a user logout event | low | 0.0 | 1% |
| CVE-2024-6316 | generate-pdf-using-contact-form-7 (WordPress plugin) | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions | high | 8.8 | 1% |
| CVE-2022-2987 | ldap-wp-login-\/-active-directory-integration (WordPress plugin) | The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating | high | 7.5 | 1% |
| CVE-2017-7491 | moodle/moodle | Moodle Cross-Site Request Forgery (CSRF) | medium | 4.3 | 1% |
| CVE-2017-15063 | intelliants/subrion | Subrion CMS CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2016-10865 | lightbox-plus (WordPress plugin) | The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus | medium | 6.1 | 1% |
| CVE-2018-21037 | intelliants/subrion | Subrion CMS CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2022-0231 | remdex/livehelperchat | Cross-Site Request Forgery (CSRF) in livehelperchat | medium | 6.5 | 1% |
| CVE-2022-2933 | 0mk-shortener (WordPress plugin) | The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to mis | medium | 5.4 | 1% |
| CVE-2022-4265 | replyable (WordPress plugin) | The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the p | high | 8.8 | 1% |
| CVE-2022-38144 | wpforo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress. | high | 8.8 | 1% |
| CVE-2022-3852 | vr-calendar-sync (WordPress plugin) | The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to mis | high | 8.8 | 1% |
| CVE-2021-36887 | tarteaucitronjs (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & | medium | 6.1 | 1% |
| CVE-2021-24685 | flat-preloader (WordPress plugin) | The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and es | medium | 5.4 | 1% |
| CVE-2015-10001 | wp-stats (WordPress plugin) | The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting | medium | 4.3 | 1% |
| CVE-2022-36379 | yookassa (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. | high | 8.8 | 1% |
| CVE-2021-4123 | remdex/livehelperchat | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2021-24584 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any us | medium | 5.4 | 1% |
| CVE-2021-24570 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The | medium | 4.3 | 1% |
| CVE-2021-3728 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2024-25982 | moodle/moodle | Cross-Site Request Forgery in moodle | high | 8.8 | 0% |
| CVE-2014-10382 | feature-comments (WordPress plugin) | The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment. | medium | 4.3 | 0% |
| CVE-2018-14519 | getkirby/cms | Kirby CMS 2.5.12 Cross-site Request Forgery | medium | 4.3 | 0% |
| CVE-2019-10642 | contao/contao, contao/core-bundle | Contao CSRF Token Bypass | high | 8.8 | 0% |
| CVE-2018-16650 | thorsten/phpmyfaq | phpMyFAQ CSRF | high | 8.8 | 0% |
| CVE-2019-7865 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition CSRF Vulnerability | high | 8.8 | 0% |
| CVE-2022-2350 | disable-user-login (WordPress plugin) | The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unaut | medium | 5.3 | 0% |
| CVE-2022-23975 | access-demo-importer (WordPress plugin) | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin. | medium | 6.5 | 0% |
| CVE-2022-0833 | church-admin (WordPress plugin) | The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allo | medium | 4.3 | 0% |
| CVE-2021-38342 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_pos | high | 8.1 | 0% |
| CVE-2024-39408 | magento/community-edition | Magento Open Source Cross-Site Request Forgery vulnerability | medium | 4.3 | 0% |
| CVE-2024-39409 | magento/community-edition | Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2024-39410 | magento/community-edition | Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2022-43693 | concrete5/concrete5 | Concrete CMS vulnerable to Cross-site Request Forgery | high | 8.8 | 0% |
| CVE-2015-10116 | favicon-by-realfavicongenerator (WordPress plugin) | A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the | medium | 4.3 | 0% |
| CVE-2021-24725 | comment-link-remove-and-other-comment-tools (WordPress plugin) | The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', whic | medium | 4.3 | 0% |
| CVE-2020-13458 | verbb/image-resizer | Image Resizer Cross-Site Request Forgery (CSRF) | high | 8.8 | 0% |
| CVE-2022-40192 | wpforo-forum (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. | high | 7.1 | 0% |
| CVE-2020-36752 | nifty-coming-soon-and-under-construction-page (WordPress plugin) | The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1 | medium | 4.3 | 0% |
| CVE-2021-24431 | language-bar-flags (WordPress plugin) | The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escap | medium | 4.3 | 0% |
| CVE-2021-24586 | per-page-add-to-head (WordPress plugin) | The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2021-24806 | wpdiscuz (WordPress plugin) | The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to mak | medium | 4.3 | 0% |
| CVE-2022-23976 | access-demo-importer (WordPress plugin) | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media) | high | 8.1 | 0% |
| CVE-2021-25092 | link-library (WordPress plugin) | The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged | medium | 6.5 | 0% |
| CVE-2020-36717 | kali-forms (WordPress plugin) | The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to inco | high | 8.8 | 0% |
| CVE-2021-4130 | snipe/snipe-it | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) | high | 8.8 | 0% |
| CVE-2022-0707 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow | medium | 4.3 | 0% |
| CVE-2020-36738 | cool-timeline (WordPress plugin) | The Cool Timeline (Horizontal & Vertical Timeline) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 0% |
| CVE-2020-36739 | feed-them-social (WordPress plugin) | The Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions u | medium | 4.3 | 0% |
| CVE-2020-36751 | coupon-creator (WordPress plugin) | The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to mi | medium | 4.3 | 0% |