Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-4390 | contact-form-7-style (WordPress plugin) | The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due | medium | 4.3 | 0% |
| CVE-2021-4394 | locations (WordPress plugin) | The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missi | medium | 4.3 | 0% |
| CVE-2021-4373 | better-search (WordPress plugin) | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it po | high | 8.8 | 0% |
| CVE-2022-3881 | wptools (WordPress plugin) | The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin b | medium | 5.7 | 0% |
| CVE-2020-12462 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS. | medium | 6.1 | 0% |
| CVE-2022-3898 | wp-affiliate-platform (WordPress plugin) | The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is | high | 8.8 | 0% |
| CVE-2021-24166 | ninja-forms (WordPress plugin) | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4 | medium | 5.4 | 0% |
| CVE-2020-36735 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross | medium | 4.3 | 0% |
| CVE-2020-36736 | cartflows (WordPress plugin) | The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, a | medium | 4.3 | 0% |
| CVE-2020-36737 | astra-import-export (WordPress plugin) | The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1 | medium | 4.3 | 0% |
| CVE-2020-13674 | drupal/core | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under som | medium | 6.5 | 0% |
| CVE-2020-36534 | noumo/easyii | Cross-Site Request Forgery in easyii CMS | medium | 4.3 | 0% |
| CVE-2024-38276 | moodle/moodle | Moodle CSRF risks due to misuse of confirm_sesskey | medium | 5.4 | 0% |
| CVE-2020-36707 | nifty-coming-soon-\&-maintenance-mode-page (WordPress plugin) | The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1 | high | 8.8 | 0% |
| CVE-2022-41685 | integration-for-szamlazz.hu-\&-woocommerce (WordPress plugin), package-points-and-shipping-labels-for-woocommerce (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and | medium | 5.4 | 0% |
| CVE-2024-1315 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all | high | 8.8 | 0% |
| CVE-2022-4218 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to | medium | 5.4 | 0% |
| CVE-2021-25108 | country-blocker (WordPress plugin) | The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX a | high | 7.1 | 0% |
| CVE-2021-34661 | wp-fusion-lite (WordPress plugin) | The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes | medium | 6.1 | 0% |
| CVE-2021-24380 | shantz-wordpress-qotd (WordPress plugin) | The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make lo | medium | 4.3 | 0% |
| CVE-2021-24668 | maz-loader (WordPress plugin) | The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary l | medium | 4.3 | 0% |
| CVE-2021-24749 | url-shortify (WordPress plugin) | The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attac | medium | 4.3 | 0% |
| CVE-2021-24776 | wp-performance-score-booster (WordPress plugin) | The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2021-24780 | single-post-exporter (WordPress plugin) | The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2021-24801 | wp-survey-plus (WordPress plugin) | The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any u | medium | 4.3 | 0% |
| CVE-2021-24818 | wp-limits (WordPress plugin) | The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin ch | medium | 4.3 | 0% |
| CVE-2021-24832 | wp-seo-redirect-301 (WordPress plugin) | The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2018-19621 | showdoc/showdoc | Showdoc CSRF Vulnerability | medium | 6.5 | 0% |
| CVE-2021-24853 | qr-redirector (WordPress plugin) | The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_sa | medium | 4.3 | 0% |
| CVE-2020-15400 | cakephp/cakephp | Cross-Site Request Forgery in CakePHP | medium | 4.3 | 0% |
| CVE-2021-4399 | edwiser-bridge (WordPress plugin) | The Edwiser Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,2.0.6. This is due to m | medium | 4.3 | 0% |
| CVE-2022-3999 | woocommerce-shipping (WordPress plugin) | The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authent | high | 8.1 | 0% |
| CVE-2022-3119 | oauth-client-single-sign-on (WordPress plugin) | The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could a | high | 7.5 | 0% |
| CVE-2021-36876 | ulisting (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugi | medium | 5.4 | 0% |
| CVE-2021-3921 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 5.4 | 0% |
| CVE-2015-10108 | inline-google-spreadsheet-viewer (WordPress plugin) | A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic. Affected | medium | 4.3 | 0% |
| CVE-2015-10109 | video-and-media-plug-in (WordPress plugin) | A vulnerability was found in Video Playlist and Gallery Plugin up to 1.136 on WordPress. It has been rated as problematic. Affected by this | medium | 4.3 | 0% |
| CVE-2015-10125 | import-all-pages\,-post-types\,-products\,-orders\,-and-users-as-xml-\&-csv (WordPress plugin) | A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part | medium | 4.3 | 0% |
| CVE-2021-3931 | snipe/snipe-it | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2021-4005 | grumpydictator/firefly-iii | Cross Site Request Forgery in firefly-iii | medium | 4.3 | 0% |
| CVE-2021-4015 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2021-4082 | pimcore/pimcore | pimcore is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2022-29453 | api-key-for-google-maps (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key updat | medium | 5.4 | 0% |
| CVE-2021-36877 | ulisting (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify u | medium | 4.3 | 0% |
| CVE-2022-2260 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters su | medium | 6.5 | 0% |
| CVE-2022-45149 | moodle/moodle | Cross-Site Request Forgery in Moodle | medium | 5.4 | 0% |
| CVE-2021-4049 | remdex/livehelperchat | Cross-Site Request Forgery in remdex/livehelperchat | low | 0.0 | 0% |
| CVE-2020-36745 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0. This is due | medium | 4.3 | 0% |
| CVE-2019-7851 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition CSRF vulnerability | medium | 6.5 | 0% |
| CVE-2019-7874 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 6.5 | 0% |