Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-10116 | favicon-by-realfavicongenerator (WordPress plugin) | A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the | medium | 4.3 | 0% |
| CVE-2021-24725 | comment-link-remove-and-other-comment-tools (WordPress plugin) | The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', whic | medium | 4.3 | 0% |
| CVE-2020-13458 | verbb/image-resizer | Image Resizer Cross-Site Request Forgery (CSRF) | high | 8.8 | 0% |
| CVE-2022-40192 | wpforo-forum (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. | high | 7.1 | 0% |
| CVE-2020-36752 | nifty-coming-soon-and-under-construction-page (WordPress plugin) | The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1 | medium | 4.3 | 0% |
| CVE-2021-24431 | language-bar-flags (WordPress plugin) | The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escap | medium | 4.3 | 0% |
| CVE-2021-24586 | per-page-add-to-head (WordPress plugin) | The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2021-24806 | wpdiscuz (WordPress plugin) | The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to mak | medium | 4.3 | 0% |
| CVE-2022-23976 | access-demo-importer (WordPress plugin) | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media) | high | 8.1 | 0% |
| CVE-2021-25092 | link-library (WordPress plugin) | The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged | medium | 6.5 | 0% |
| CVE-2020-36717 | kali-forms (WordPress plugin) | The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to inco | high | 8.8 | 0% |
| CVE-2021-4130 | snipe/snipe-it | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) | high | 8.8 | 0% |
| CVE-2022-0707 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow | medium | 4.3 | 0% |
| CVE-2020-36738 | cool-timeline (WordPress plugin) | The Cool Timeline (Horizontal & Vertical Timeline) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 0% |
| CVE-2020-36739 | feed-them-social (WordPress plugin) | The Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions u | medium | 4.3 | 0% |
| CVE-2020-36751 | coupon-creator (WordPress plugin) | The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to mi | medium | 4.3 | 0% |
| CVE-2020-36753 | hueman (WordPress theme) | The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing o | medium | 4.3 | 0% |
| CVE-2020-36754 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.2. This is | medium | 4.3 | 0% |
| CVE-2020-36755 | customizr (WordPress theme) | The Customizr theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.0. This is due to missin | medium | 4.3 | 0% |
| CVE-2020-36758 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This | medium | 4.3 | 0% |
| CVE-2020-36759 | insert-php (WordPress plugin) | The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is du | medium | 4.3 | 0% |
| CVE-2021-4391 | woo-gift-cards-lite (WordPress plugin) | The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2 | medium | 4.3 | 0% |
| CVE-2021-4392 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 0% |
| CVE-2021-4393 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 0% |
| CVE-2021-4418 | custom-css-js-php (WordPress plugin) | The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is d | medium | 4.3 | 0% |
| CVE-2021-3730 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 0% |
| CVE-2021-24133 | activecampaign (WordPress plugin) | Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make | medium | 4.3 | 0% |
| CVE-2021-24251 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request For | medium | 4.3 | 0% |
| CVE-2020-18151 | thinkcmf/thinkcmf | ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability | medium | 6.5 | 0% |
| CVE-2022-2839 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing | medium | 5.4 | 0% |
| CVE-2022-4021 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This | high | 8.8 | 0% |
| CVE-2020-36740 | radio-buttons-for-taxonomies (WordPress plugin) | The Radio Buttons for Taxonomies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. T | medium | 4.3 | 0% |
| CVE-2022-0141 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or | high | 8.1 | 0% |
| CVE-2024-11712 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access | medium | 5.3 | 0% |
| CVE-2022-0328 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to m | medium | 4.7 | 0% |
| CVE-2021-24913 | logo-showcase-with-slick-slider (WordPress plugin) | The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, al | medium | 4.3 | 0% |
| CVE-2022-0199 | coming-soon-and-maintenance-mode (WordPress plugin) | The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowi | medium | 4.3 | 0% |
| CVE-2022-0313 | float-menu (WordPress plugin) | The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a log | medium | 4.3 | 0% |
| CVE-2024-1962 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged | high | 8.8 | 0% |
| CVE-2021-24993 | ultimate-product-catalog (WordPress plugin) | The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could al | medium | 6.5 | 0% |
| CVE-2021-24572 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as | medium | 4.3 | 0% |
| CVE-2021-24799 | far-future-expiry-header (WordPress plugin) | The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2022-2986 | moodle/moodle | Moodle Cross-Site Request Forgery (CSRF) | high | 8.8 | 0% |
| CVE-2022-3911 | iubenda-cookie-law-solution (WordPress plugin) | The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options | high | 8.8 | 0% |
| CVE-2022-36373 | mp3-jplayer (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress. | medium | 5.4 | 0% |
| CVE-2020-36746 | menu-swapper (WordPress plugin) | The Menu Swapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0.2. This is due to | medium | 4.3 | 0% |
| CVE-2020-36747 | sidebar-manager (WordPress plugin) | The Lightweight Sidebar Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. Th | medium | 4.3 | 0% |
| CVE-2020-36748 | dokan-lite (WordPress plugin) | The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing o | medium | 4.3 | 0% |
| CVE-2020-36749 | easy-testimonials (WordPress plugin) | The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due | medium | 4.3 | 0% |
| CVE-2021-4389 | wp-travel (WordPress plugin) | The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missi | medium | 4.3 | 0% |