Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2736 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to mi | high | 7.5 | 0% |
| CVE-2024-34008 | moodle/moodle | Moodle CSRF risk in analytics management of models | high | 8.8 | 0% |
| CVE-2021-24615 | wechat-reward (WordPress plugin) | The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attack | medium | 5.4 | 0% |
| CVE-2021-3963 | kevinpapst/kimai2 | Cross-site Scripting in kimai2 | medium | 4.3 | 0% |
| CVE-2021-4092 | yetiforce/yetiforce-crm | yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2021-4384 | photo-contest (WordPress plugin) | The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin | medium | 4.3 | 0% |
| CVE-2021-4411 | wp-easy-pay (WordPress plugin) | The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2 | medium | 4.3 | 0% |
| CVE-2022-29414 | subscribe-to-comments-reloaded (WordPress plugin) | Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress al | medium | 5.4 | 0% |
| CVE-2023-2416 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a mi | medium | 5.4 | 0% |
| CVE-2023-36237 | bagisto/bagisto | Bagisto Cross-Site Request Forgery vulnerability | high | 8.8 | 0% |
| CVE-2025-1305 | newsblogger (WordPress theme) | The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due t | high | 8.8 | 0% |
| CVE-2022-2146 | import-csv-files (WordPress plugin) | The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is | medium | 6.1 | 0% |
| CVE-2021-44777 | email-tracker (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress pl | medium | 5.4 | 0% |
| CVE-2020-36756 | wd-google-analytics (WordPress plugin) | The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.8. This is due to | medium | 4.3 | 0% |
| CVE-2020-36757 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due | medium | 4.3 | 0% |
| CVE-2021-4419 | wp-backgrounds-lite (WordPress plugin) | The WP-Backgrounds Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3. This is due | medium | 4.3 | 0% |
| CVE-2021-4420 | sell-media (WordPress plugin) | The Sell Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.5. This is due to miss | medium | 4.3 | 0% |
| CVE-2021-4421 | advanced-popups (WordPress plugin) | The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to | medium | 4.3 | 0% |
| CVE-2021-4423 | rays-grid (WordPress plugin) | The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missi | medium | 4.3 | 0% |
| CVE-2021-4424 | slider-hero (WordPress plugin) | The Slider Hero plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.0. This is due to mis | medium | 4.3 | 0% |
| CVE-2022-36388 | yds-support-ticket-system (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress. | medium | 5.4 | 0% |
| CVE-2021-36891 | gallery-by-supsystic (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin setti | medium | 5.4 | 0% |
| CVE-2022-29431 | remove-cpt-base (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT base plugin <= 5.8 at WordPress allows an attacker to delete the CPT base. | medium | 5.4 | 0% |
| CVE-2021-41273 | pterodactyl/panel | Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys | medium | 4.3 | 0% |
| CVE-2021-4396 | rucy (WordPress plugin) | The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or | medium | 4.3 | 0% |
| CVE-2021-4397 | staff-directory-pro (WordPress plugin) | The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6. This is d | medium | 4.3 | 0% |
| CVE-2021-4398 | amministrazione-trasparente (WordPress plugin) | The Amministrazione Trasparente plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. Thi | medium | 4.3 | 0% |
| CVE-2021-4400 | better-search (WordPress plugin) | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This is due to m | medium | 4.3 | 0% |
| CVE-2021-4403 | remove-schema (WordPress plugin) | The Remove Schema plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to mis | medium | 4.3 | 0% |
| CVE-2021-4404 | event-espresso-decaf (WordPress plugin) | The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This | medium | 4.3 | 0% |
| CVE-2021-4405 | elasticpress (WordPress plugin) | The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to mi | medium | 4.3 | 0% |
| CVE-2022-2172 | linkworth-wp-plugin (WordPress plugin) | The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change se | medium | 4.3 | 0% |
| CVE-2023-7038 | automad/automad | Cross-Site Request Forgery (CSRF) in automad/automad | medium | 4.3 | 0% |
| CVE-2023-3179 | post-smtp (WordPress plugin) | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to mak | high | 8.8 | 0% |
| CVE-2022-36389 | bp-better-messages (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. | medium | 4.3 | 0% |
| CVE-2020-28838 | opencart/opencart | OpenCart Cross-Site Request Forgery (CSRF) | low | 3.5 | 0% |
| CVE-2022-27860 | footer-text (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress. | medium | 6.1 | 0% |
| CVE-2022-29413 | hermit (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &ti | medium | 4.7 | 0% |
| CVE-2022-29436 | code-snippets-extended (WordPress plugin) | Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Si | medium | 4.7 | 0% |
| CVE-2023-0294 | mediamatic (WordPress plugin) | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2. | high | 8.8 | 0% |
| CVE-2021-24618 | donate-with-qrcode (WordPress plugin) | The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross- | medium | 5.4 | 0% |
| CVE-2022-2355 | easy-username-updater (WordPress plugin) | The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admi | medium | 6.5 | 0% |
| CVE-2017-20062 | elefant/cms | Cross-Site Request Forgery in Elefant CMS | high | 8.8 | 0% |
| CVE-2024-0856 | appointment-booking-calendar (WordPress plugin) | The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to mak | high | 8.8 | 0% |
| CVE-2020-36741 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. This is due to mi | medium | 4.3 | 0% |
| CVE-2020-36742 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is | medium | 4.3 | 0% |
| CVE-2020-36743 | post-type-x (WordPress plugin) | The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This i | medium | 4.3 | 0% |
| CVE-2020-36744 | notificationx (WordPress plugin) | The NotificationX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to m | medium | 4.3 | 0% |
| CVE-2020-36750 | ewww-image-optimizer (WordPress plugin) | The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is d | medium | 4.3 | 0% |
| CVE-2021-4385 | wp-private-content-plus (WordPress plugin) | The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is | medium | 4.3 | 0% |