Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-36753 | hueman (WordPress theme) | The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing o | medium | 4.3 | 0% |
| CVE-2020-36754 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.2. This is | medium | 4.3 | 0% |
| CVE-2020-36755 | customizr (WordPress theme) | The Customizr theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.0. This is due to missin | medium | 4.3 | 0% |
| CVE-2020-36758 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This | medium | 4.3 | 0% |
| CVE-2020-36759 | insert-php (WordPress plugin) | The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is du | medium | 4.3 | 0% |
| CVE-2021-4391 | woo-gift-cards-lite (WordPress plugin) | The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2 | medium | 4.3 | 0% |
| CVE-2021-4392 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 0% |
| CVE-2021-4393 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 0% |
| CVE-2021-4418 | custom-css-js-php (WordPress plugin) | The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is d | medium | 4.3 | 0% |
| CVE-2021-3730 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 0% |
| CVE-2021-24133 | activecampaign (WordPress plugin) | Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make | medium | 4.3 | 0% |
| CVE-2021-24251 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request For | medium | 4.3 | 0% |
| CVE-2020-18151 | thinkcmf/thinkcmf | ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability | medium | 6.5 | 0% |
| CVE-2022-2839 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing | medium | 5.4 | 0% |
| CVE-2022-4021 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This | high | 8.8 | 0% |
| CVE-2020-36740 | radio-buttons-for-taxonomies (WordPress plugin) | The Radio Buttons for Taxonomies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. T | medium | 4.3 | 0% |
| CVE-2022-0141 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or | high | 8.1 | 0% |
| CVE-2022-0328 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to m | medium | 4.7 | 0% |
| CVE-2021-24913 | logo-showcase-with-slick-slider (WordPress plugin) | The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, al | medium | 4.3 | 0% |
| CVE-2022-0199 | coming-soon-and-maintenance-mode (WordPress plugin) | The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowi | medium | 4.3 | 0% |
| CVE-2022-0313 | float-menu (WordPress plugin) | The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a log | medium | 4.3 | 0% |
| CVE-2024-1962 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged | high | 8.8 | 0% |
| CVE-2021-24993 | ultimate-product-catalog (WordPress plugin) | The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could al | medium | 6.5 | 0% |
| CVE-2021-24572 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as | medium | 4.3 | 0% |
| CVE-2021-24799 | far-future-expiry-header (WordPress plugin) | The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2022-2986 | moodle/moodle | Moodle Cross-Site Request Forgery (CSRF) | high | 8.8 | 0% |
| CVE-2022-3911 | iubenda-cookie-law-solution (WordPress plugin) | The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options | high | 8.8 | 0% |
| CVE-2022-36373 | mp3-jplayer (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress. | medium | 5.4 | 0% |
| CVE-2020-36746 | menu-swapper (WordPress plugin) | The Menu Swapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0.2. This is due to | medium | 4.3 | 0% |
| CVE-2020-36747 | sidebar-manager (WordPress plugin) | The Lightweight Sidebar Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. Th | medium | 4.3 | 0% |
| CVE-2020-36748 | dokan-lite (WordPress plugin) | The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing o | medium | 4.3 | 0% |
| CVE-2020-36749 | easy-testimonials (WordPress plugin) | The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due | medium | 4.3 | 0% |
| CVE-2021-4389 | wp-travel (WordPress plugin) | The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missi | medium | 4.3 | 0% |
| CVE-2021-4390 | contact-form-7-style (WordPress plugin) | The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due | medium | 4.3 | 0% |
| CVE-2021-4394 | locations (WordPress plugin) | The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missi | medium | 4.3 | 0% |
| CVE-2021-4373 | better-search (WordPress plugin) | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it po | high | 8.8 | 0% |
| CVE-2022-3881 | wptools (WordPress plugin) | The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin b | medium | 5.7 | 0% |
| CVE-2020-12462 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS. | medium | 6.1 | 0% |
| CVE-2022-3898 | wp-affiliate-platform (WordPress plugin) | The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is | high | 8.8 | 0% |
| CVE-2021-24166 | ninja-forms (WordPress plugin) | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4 | medium | 5.4 | 0% |
| CVE-2020-36735 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross | medium | 4.3 | 0% |
| CVE-2020-36736 | cartflows (WordPress plugin) | The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, a | medium | 4.3 | 0% |
| CVE-2020-36737 | astra-import-export (WordPress plugin) | The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1 | medium | 4.3 | 0% |
| CVE-2020-13674 | drupal/core | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under som | medium | 6.5 | 0% |
| CVE-2020-36534 | noumo/easyii | Cross-Site Request Forgery in easyii CMS | medium | 4.3 | 0% |
| CVE-2024-38276 | moodle/moodle | Moodle CSRF risks due to misuse of confirm_sesskey | medium | 5.4 | 0% |
| CVE-2020-36707 | nifty-coming-soon-\&-maintenance-mode-page (WordPress plugin) | The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1 | high | 8.8 | 0% |
| CVE-2022-41685 | integration-for-szamlazz.hu-\&-woocommerce (WordPress plugin), package-points-and-shipping-labels-for-woocommerce (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and | medium | 5.4 | 0% |
| CVE-2024-1315 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all | high | 8.8 | 0% |
| CVE-2022-4218 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to | medium | 5.4 | 0% |