Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2172 | linkworth-wp-plugin (WordPress plugin) | The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change se | medium | 4.3 | 0% |
| CVE-2023-7038 | automad/automad | Cross-Site Request Forgery (CSRF) in automad/automad | medium | 4.3 | 0% |
| CVE-2023-3179 | post-smtp (WordPress plugin) | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to mak | high | 8.8 | 0% |
| CVE-2022-36389 | bp-better-messages (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. | medium | 4.3 | 0% |
| CVE-2020-28838 | opencart/opencart | OpenCart Cross-Site Request Forgery (CSRF) | low | 3.5 | 0% |
| CVE-2022-27860 | footer-text (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress. | medium | 6.1 | 0% |
| CVE-2022-29413 | hermit (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &ti | medium | 4.7 | 0% |
| CVE-2022-29436 | code-snippets-extended (WordPress plugin) | Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Si | medium | 4.7 | 0% |
| CVE-2023-0294 | mediamatic (WordPress plugin) | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2. | high | 8.8 | 0% |
| CVE-2021-24618 | donate-with-qrcode (WordPress plugin) | The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross- | medium | 5.4 | 0% |
| CVE-2022-2355 | easy-username-updater (WordPress plugin) | The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admi | medium | 6.5 | 0% |
| CVE-2017-20062 | elefant/cms | Cross-Site Request Forgery in Elefant CMS | high | 8.8 | 0% |
| CVE-2024-0856 | appointment-booking-calendar (WordPress plugin) | The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to mak | high | 8.8 | 0% |
| CVE-2020-36741 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. This is due to mi | medium | 4.3 | 0% |
| CVE-2020-36742 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is | medium | 4.3 | 0% |
| CVE-2020-36743 | post-type-x (WordPress plugin) | The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This i | medium | 4.3 | 0% |
| CVE-2020-36744 | notificationx (WordPress plugin) | The NotificationX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to m | medium | 4.3 | 0% |
| CVE-2020-36750 | ewww-image-optimizer (WordPress plugin) | The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is d | medium | 4.3 | 0% |
| CVE-2021-4385 | wp-private-content-plus (WordPress plugin) | The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is | medium | 4.3 | 0% |
| CVE-2021-4386 | wp-security-questions (WordPress plugin) | The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is d | medium | 4.3 | 0% |
| CVE-2021-4407 | custom-banners (WordPress plugin) | The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to m | medium | 4.3 | 0% |
| CVE-2021-4408 | dw-question-answer (WordPress plugin) | The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is d | medium | 4.3 | 0% |
| CVE-2021-4409 | woocommerce-etsy-integration (WordPress plugin) | The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. T | medium | 4.3 | 0% |
| CVE-2021-4410 | qtranslate-slug (WordPress plugin) | The Qtranslate Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due t | medium | 4.3 | 0% |
| CVE-2021-4412 | wp-prayer (WordPress plugin) | The WP Prayer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5. This is due to missi | medium | 4.3 | 0% |
| CVE-2021-4413 | process-steps-template-designer (WordPress plugin) | The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1 | medium | 4.3 | 0% |
| CVE-2021-4414 | woocommerce-abandoned-cart (WordPress plugin) | The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5 | medium | 4.3 | 0% |
| CVE-2021-4415 | sunshine-photo-cart (WordPress plugin) | The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is du | medium | 4.3 | 0% |
| CVE-2021-4416 | wp-mpdf (WordPress plugin) | The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing | medium | 4.3 | 0% |
| CVE-2022-46862 | quiz-and-survey-master (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plug | medium | 4.3 | 0% |
| CVE-2023-47350 | swiftyedit/swiftyedit | Cross Site Request Forgery in SwiftyEdit | high | 8.8 | 0% |
| CVE-2022-3538 | webmaster-tools-verification (WordPress plugin) | The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing u | medium | 6.5 | 0% |
| CVE-2021-3957 | kevinpapst/kimai2 | Cross-site Scripting in kimai2 | medium | 4.6 | 0% |
| CVE-2021-21395 | openmage/magento-lts | magento-lts Reset Password not protected against well-timed CSRF | medium | 4.3 | 0% |
| CVE-2021-25097 | labtools (WordPress plugin) | The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing an | medium | 6.5 | 0% |
| CVE-2021-24790 | contact-form-advanced-database (WordPress plugin) | The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_d | medium | 4.3 | 0% |
| CVE-2022-1625 | new-user-approve (WordPress plugin) | The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, w | medium | 4.3 | 0% |
| CVE-2022-34347 | download-manager (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | medium | 4.2 | 0% |
| CVE-2024-3940 | recaptcha-jetpack (WordPress plugin) | The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attacke | high | 8.8 | 0% |
| CVE-2024-13217 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via | medium | 4.3 | 0% |
| CVE-2022-3489 | wp-hide (WordPress plugin) | The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settin | medium | 5.3 | 0% |
| CVE-2022-33201 | official-mailerlite-sign-up-forms (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to c | medium | 6.3 | 0% |
| CVE-2022-36292 | photoblocks-grid-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. | medium | 5.4 | 0% |
| CVE-2019-7857 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2019-7873 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 4.3 | 0% |
| CVE-2022-38470 | customer-reviews-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. | medium | 4.3 | 0% |
| CVE-2021-24173 | vm-backups (WordPress plugin) | The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as | medium | 6.1 | 0% |
| CVE-2022-36796 | callrail-phone-call-tracking (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking | medium | 6.1 | 0% |
| CVE-2021-4333 | wp-statistics (WordPress plugin) | The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to | medium | 6.5 | 0% |
| CVE-2020-5501 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |