Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24688 | orange-form (WordPress plugin) | The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_ | medium | 4.3 | 0% |
| CVE-2021-4395 | woo-abandoned-cart-recovery (WordPress plugin) | The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin | medium | 4.3 | 0% |
| CVE-2022-2123 | wp-opt-in (WordPress plugin) | The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF which allows changed plugin settings and can be used for sending spam ema | medium | 4.3 | 0% |
| CVE-2018-5301 | magento/community-edition | Magento Cross-Site Request Forgery (CSRF) | medium | 6.5 | 0% |
| CVE-2022-2388 | wp-coder (WordPress plugin) | The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow att | medium | 6.5 | 0% |
| CVE-2021-25013 | qubely (WordPress plugin) | The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does n | medium | 6.5 | 0% |
| CVE-2022-1570 | files-download-delay (WordPress plugin) | The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could a | medium | 6.5 | 0% |
| CVE-2021-36890 | social-share-buttons-by-supsystic (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress. | medium | 4.3 | 0% |
| CVE-2022-0345 | customize-wordpress-emails-and-alerts (WordPress plugin) | The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users | medium | 4.3 | 0% |
| CVE-2022-0875 | google-authenticator (WordPress plugin) | The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as e | medium | 4.3 | 0% |
| CVE-2022-1092 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowi | medium | 4.3 | 0% |
| CVE-2022-1573 | html2wp (WordPress plugin) | The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make | medium | 4.3 | 0% |
| CVE-2022-1594 | hc-custom-wp-admin-url (WordPress plugin) | The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow atta | medium | 4.3 | 0% |
| CVE-2022-1603 | mail-subscribe-list (WordPress plugin) | The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow at | medium | 4.3 | 0% |
| CVE-2022-1627 | my-private-site (WordPress plugin) | The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2022-1653 | social-share-buttons (WordPress plugin) | The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, all | medium | 4.3 | 0% |
| CVE-2022-1793 | private-files (WordPress plugin) | The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a l | medium | 4.3 | 0% |
| CVE-2022-1842 | openbook-book-data (WordPress plugin) | The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attack | medium | 4.3 | 0% |
| CVE-2022-1844 | wp-sentry (WordPress plugin) | The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make | medium | 4.3 | 0% |
| CVE-2022-1845 | wp-post-styling (WordPress plugin) | The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged | medium | 4.3 | 0% |
| CVE-2022-1846 | tiny-contact-form (WordPress plugin) | The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2022-1847 | rotating-posts (WordPress plugin) | The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 4.3 | 0% |
| CVE-2022-1885 | cimy-header-image-rotator (WordPress plugin) | The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow | medium | 4.3 | 0% |
| CVE-2022-1895 | underconstruction (WordPress plugin) | The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could al | medium | 4.3 | 0% |
| CVE-2022-1913 | add-post-url (WordPress plugin) | The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2022-1914 | clean-contact (WordPress plugin) | The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2022-1957 | comment-license (WordPress plugin) | The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2022-1960 | mycss (WordPress plugin) | The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a l | medium | 4.3 | 0% |
| CVE-2022-2144 | jquery-validation-for-contact-form-7 (WordPress plugin) | The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which cou | medium | 4.3 | 0% |
| CVE-2020-13868 | verbb/comments | Comments plugin Cross-Site Request Forgery (CSRF) | medium | 6.5 | 0% |
| CVE-2022-29437 | baslider (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress. | medium | 5.4 | 0% |
| CVE-2021-24968 | ultimate-faq (WordPress plugin) | The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome | medium | 5.7 | 0% |
| CVE-2021-25011 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, | medium | 5.7 | 0% |
| CVE-2021-4417 | forminator (WordPress plugin) | The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versio | medium | 5.4 | 0% |
| CVE-2024-39678 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-39679 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up t | medium | 4.3 | 0% |
| CVE-2021-25116 | enqueue-anything (WordPress plugin) | The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does no | medium | 6.5 | 0% |
| CVE-2022-1577 | database-backup (WordPress plugin) | The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which co | medium | 5.4 | 0% |
| CVE-2022-2223 | image-slider-widget (WordPress plugin) | The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to pro | medium | 5.4 | 0% |
| CVE-2022-2224 | feed-instagram-lite (WordPress plugin) | The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to f | medium | 5.4 | 0% |
| CVE-2023-2599 | ldap-login-for-intranet-sites (WordPress plugin) | The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via th | low | 3.1 | 0% |
| CVE-2022-27846 | yoo-slider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider. | medium | 4.3 | 0% |
| CVE-2021-24752 | catch-scroll-progress-bar (WordPress plugin), catch-sticky-menu (WordPress plugin), catch-themes-demo-import (WordPress plugin) +7 more | Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any | medium | 5.7 | 0% |
| CVE-2022-4219 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to | medium | 5.4 | 0% |
| CVE-2022-4220 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to | medium | 5.4 | 0% |
| CVE-2023-43649 | baserproject/basercms | baserCMS CSRF vulnerability in Content preview Feature | medium | 4.7 | 0% |
| CVE-2022-23983 | wp-content-copy-protector (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click | medium | 4.3 | 0% |
| CVE-2022-29427 | disable-right-click-for-wp (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress. | medium | 4.3 | 0% |
| CVE-2023-2407 | event-registration-calendar-by-vcita (WordPress plugin), online-payments---get-paid-with-paypal\,-square-\&-stripe (WordPress plugin) | The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & S | medium | 6.1 | 0% |
| CVE-2024-2376 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |