Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-4402 | multiple-roles (WordPress plugin) | The Multiple Roles plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to | medium | 4.3 | 0% |
| CVE-2022-1251 | ask-me (WordPress plugin) | The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an at | medium | 4.3 | 0% |
| CVE-2023-4916 | login-with-phone-number (WordPress plugin) | The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This i | high | 8.8 | 0% |
| CVE-2022-3419 | automatic-user-roles-switcher (WordPress plugin) | The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticat | medium | 6.5 | 0% |
| CVE-2021-3932 | area17/twill | twill is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.3 | 0% |
| CVE-2021-3734 | yourls/yourls | Improper Restriction of Rendered UI Layers or Frames in yourls | medium | 6.5 | 0% |
| CVE-2022-25599 | spiffy-calendar (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4. | medium | 5.4 | 0% |
| CVE-2021-3729 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2022-3899 | 3dprint (WordPress plugin) | The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with | high | 8.1 | 0% |
| CVE-2022-29450 | admin-management-xtended (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-25576 | anchorcms/anchor-cms | Cross-Site Request Forgery in Anchor CMS | medium | 4.5 | 0% |
| CVE-2021-36852 | wp-hotel-booking (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress. | medium | 4.3 | 0% |
| CVE-2022-1418 | social-stickers (WordPress plugin) | The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does no | medium | 6.1 | 0% |
| CVE-2021-3976 | kevinpapst/kimai2 | Cross-site Scripting in kimai2 | medium | 4.3 | 0% |
| CVE-2024-34001 | moodle/moodle | Moodle CSRF risk in admin preset tool management of presets | high | 8.4 | 0% |
| CVE-2021-24703 | download-plugin (WordPress plugin) | The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowin | medium | 5.7 | 0% |
| CVE-2022-38093 | all-in-one-seo (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress. | medium | 5.4 | 0% |
| CVE-2023-2517 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including | medium | 5.4 | 0% |
| CVE-2023-5820 | wp-responsive-slider-with-lightbox (WordPress plugin) | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing o | critical | 9.6 | 0% |
| CVE-2023-2736 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to mi | high | 7.5 | 0% |
| CVE-2024-34008 | moodle/moodle | Moodle CSRF risk in analytics management of models | high | 8.8 | 0% |
| CVE-2021-24615 | wechat-reward (WordPress plugin) | The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attack | medium | 5.4 | 0% |
| CVE-2021-3963 | kevinpapst/kimai2 | Cross-site Scripting in kimai2 | medium | 4.3 | 0% |
| CVE-2021-4092 | yetiforce/yetiforce-crm | yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2021-4384 | photo-contest (WordPress plugin) | The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin | medium | 4.3 | 0% |
| CVE-2021-4411 | wp-easy-pay (WordPress plugin) | The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2 | medium | 4.3 | 0% |
| CVE-2022-29414 | subscribe-to-comments-reloaded (WordPress plugin) | Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress al | medium | 5.4 | 0% |
| CVE-2023-2416 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a mi | medium | 5.4 | 0% |
| CVE-2023-36237 | bagisto/bagisto | Bagisto Cross-Site Request Forgery vulnerability | high | 8.8 | 0% |
| CVE-2025-1305 | newsblogger (WordPress theme) | The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due t | high | 8.8 | 0% |
| CVE-2022-2146 | import-csv-files (WordPress plugin) | The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is | medium | 6.1 | 0% |
| CVE-2021-44777 | email-tracker (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress pl | medium | 5.4 | 0% |
| CVE-2020-36756 | wd-google-analytics (WordPress plugin) | The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.8. This is due to | medium | 4.3 | 0% |
| CVE-2020-36757 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due | medium | 4.3 | 0% |
| CVE-2021-4419 | wp-backgrounds-lite (WordPress plugin) | The WP-Backgrounds Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3. This is due | medium | 4.3 | 0% |
| CVE-2021-4420 | sell-media (WordPress plugin) | The Sell Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.5. This is due to miss | medium | 4.3 | 0% |
| CVE-2021-4421 | advanced-popups (WordPress plugin) | The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to | medium | 4.3 | 0% |
| CVE-2021-4423 | rays-grid (WordPress plugin) | The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missi | medium | 4.3 | 0% |
| CVE-2021-4424 | slider-hero (WordPress plugin) | The Slider Hero plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.0. This is due to mis | medium | 4.3 | 0% |
| CVE-2022-36388 | yds-support-ticket-system (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress. | medium | 5.4 | 0% |
| CVE-2021-36891 | gallery-by-supsystic (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin setti | medium | 5.4 | 0% |
| CVE-2022-29431 | remove-cpt-base (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT base plugin <= 5.8 at WordPress allows an attacker to delete the CPT base. | medium | 5.4 | 0% |
| CVE-2021-41273 | pterodactyl/panel | Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys | medium | 4.3 | 0% |
| CVE-2021-4396 | rucy (WordPress plugin) | The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or | medium | 4.3 | 0% |
| CVE-2021-4397 | staff-directory-pro (WordPress plugin) | The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6. This is d | medium | 4.3 | 0% |
| CVE-2021-4398 | amministrazione-trasparente (WordPress plugin) | The Amministrazione Trasparente plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. Thi | medium | 4.3 | 0% |
| CVE-2021-4400 | better-search (WordPress plugin) | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This is due to m | medium | 4.3 | 0% |
| CVE-2021-4403 | remove-schema (WordPress plugin) | The Remove Schema plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to mis | medium | 4.3 | 0% |
| CVE-2021-4404 | event-espresso-decaf (WordPress plugin) | The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This | medium | 4.3 | 0% |
| CVE-2021-4405 | elasticpress (WordPress plugin) | The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to mi | medium | 4.3 | 0% |