Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-4417 | forminator (WordPress plugin) | The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versio | medium | 5.4 | 0% |
| CVE-2024-39678 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-39679 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up t | medium | 4.3 | 0% |
| CVE-2021-25116 | enqueue-anything (WordPress plugin) | The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does no | medium | 6.5 | 0% |
| CVE-2022-1577 | database-backup (WordPress plugin) | The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which co | medium | 5.4 | 0% |
| CVE-2022-2223 | image-slider-widget (WordPress plugin) | The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to pro | medium | 5.4 | 0% |
| CVE-2022-2224 | feed-instagram-lite (WordPress plugin) | The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to f | medium | 5.4 | 0% |
| CVE-2023-2599 | ldap-login-for-intranet-sites (WordPress plugin) | The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via th | low | 3.1 | 0% |
| CVE-2022-27846 | yoo-slider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider. | medium | 4.3 | 0% |
| CVE-2021-24752 | catch-scroll-progress-bar (WordPress plugin), catch-sticky-menu (WordPress plugin), catch-themes-demo-import (WordPress plugin) +7 more | Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any | medium | 5.7 | 0% |
| CVE-2022-4219 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to | medium | 5.4 | 0% |
| CVE-2022-4220 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to | medium | 5.4 | 0% |
| CVE-2023-43649 | baserproject/basercms | baserCMS CSRF vulnerability in Content preview Feature | medium | 4.7 | 0% |
| CVE-2022-23983 | wp-content-copy-protector (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click | medium | 4.3 | 0% |
| CVE-2022-29427 | disable-right-click-for-wp (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress. | medium | 4.3 | 0% |
| CVE-2023-2407 | event-registration-calendar-by-vcita (WordPress plugin), online-payments---get-paid-with-paypal\,-square-\&-stripe (WordPress plugin) | The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & S | medium | 6.1 | 0% |
| CVE-2024-2376 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |
| CVE-2026-35675 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration | high | 8.2 | 0% |
| CVE-2022-29412 | hermit (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow attackers to delete cache, del | medium | 5.4 | 0% |
| CVE-2022-29439 | baslider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress allows deleting slides. | medium | 5.4 | 0% |
| CVE-2022-29441 | private-messages-for-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Private Messages For WordPress plugin <= 2.1.10 at WordPress allows attackers to send mes | medium | 4.3 | 0% |
| CVE-2024-2125 | envialosimple-email-marketing-y-newsletters-gratis (WordPress plugin) | The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | high | 8.8 | 0% |
| CVE-2024-39680 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up t | medium | 5.4 | 0% |
| CVE-2024-39681 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up t | medium | 5.4 | 0% |
| CVE-2019-16107 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2022-3154 | integration-for-billingo-\&-gravity-forms (WordPress plugin), integration-for-szamlazz.hu-\&-gravity-forms (WordPress plugin), woo-billingo-plus (WordPress plugin) | The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration f | high | 7.1 | 0% |
| CVE-2021-3775 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2021-3776 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2022-2276 | wp-edit-menu (WordPress plugin) | The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated att | medium | 4.3 | 0% |
| CVE-2022-36346 | maxbuttons (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress. | medium | 4.3 | 0% |
| CVE-2021-24349 | gallery-from-files (WordPress plugin) | This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not prop | medium | 6.1 | 0% |
| CVE-2021-24410 | telugu-bible-verse-daily (WordPress plugin) | The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, and do not sanitise or | medium | 6.1 | 0% |
| CVE-2021-24411 | social-tape (WordPress plugin) | The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them | medium | 6.1 | 0% |
| CVE-2021-24434 | glass (WordPress plugin) | The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Sto | medium | 6.1 | 0% |
| CVE-2021-24466 | verse-o-matic (WordPress plugin) | The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators | medium | 6.1 | 0% |
| CVE-2021-24477 | migrate-users (WordPress plugin) | The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a | medium | 6.1 | 0% |
| CVE-2021-24535 | light-messages (WordPress plugin) | The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content | medium | 6.1 | 0% |
| CVE-2021-24536 | custom-login-redirect (WordPress plugin) | The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or | medium | 6.1 | 0% |
| CVE-2021-24543 | jquery-reply-to-comment (WordPress plugin) | The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its | medium | 6.1 | 0% |
| CVE-2021-24683 | weather-effect (WordPress plugin) | The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or esc | medium | 5.4 | 0% |
| CVE-2023-0820 | user-role (WordPress plugin) | The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to | high | 8.8 | 0% |
| CVE-2022-3208 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin c | medium | 6.5 | 0% |
| CVE-2021-3683 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 5.4 | 0% |
| CVE-2021-24172 | vm-backups (WordPress plugin) | The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as | medium | 4.3 | 0% |
| CVE-2022-1830 | amazon-einzeltitellinks (WordPress plugin) | The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow a | medium | 6.5 | 0% |
| CVE-2022-1831 | wplite (WordPress plugin) | The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make | medium | 6.5 | 0% |
| CVE-2023-28335 | moodle/moodle | Moodle vulnerable to Cross-site Request Forgery | high | 8.8 | 0% |
| CVE-2022-2762 | adminpad (WordPress plugin) | The AdminPad WordPress plugin before 2.2 does not have CSRF check when updating admin's note, allowing attackers to make a logged in admin u | medium | 6.5 | 0% |
| CVE-2024-12041 | directorist (WordPress plugin) | The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Informati | medium | 5.3 | 0% |
| CVE-2020-36669 | jetbackup (WordPress plugin) | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includi | high | 8.8 | 0% |