Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-4386 | wp-security-questions (WordPress plugin) | The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is d | medium | 4.3 | 0% |
| CVE-2021-4407 | custom-banners (WordPress plugin) | The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to m | medium | 4.3 | 0% |
| CVE-2021-4408 | dw-question-answer (WordPress plugin) | The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is d | medium | 4.3 | 0% |
| CVE-2021-4409 | woocommerce-etsy-integration (WordPress plugin) | The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. T | medium | 4.3 | 0% |
| CVE-2021-4410 | qtranslate-slug (WordPress plugin) | The Qtranslate Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due t | medium | 4.3 | 0% |
| CVE-2021-4412 | wp-prayer (WordPress plugin) | The WP Prayer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5. This is due to missi | medium | 4.3 | 0% |
| CVE-2021-4413 | process-steps-template-designer (WordPress plugin) | The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1 | medium | 4.3 | 0% |
| CVE-2021-4414 | woocommerce-abandoned-cart (WordPress plugin) | The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5 | medium | 4.3 | 0% |
| CVE-2021-4415 | sunshine-photo-cart (WordPress plugin) | The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is du | medium | 4.3 | 0% |
| CVE-2021-4416 | wp-mpdf (WordPress plugin) | The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing | medium | 4.3 | 0% |
| CVE-2022-46862 | quiz-and-survey-master (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plug | medium | 4.3 | 0% |
| CVE-2023-47350 | swiftyedit/swiftyedit | Cross Site Request Forgery in SwiftyEdit | high | 8.8 | 0% |
| CVE-2022-3538 | webmaster-tools-verification (WordPress plugin) | The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing u | medium | 6.5 | 0% |
| CVE-2021-3957 | kevinpapst/kimai2 | Cross-site Scripting in kimai2 | medium | 4.6 | 0% |
| CVE-2021-21395 | openmage/magento-lts | magento-lts Reset Password not protected against well-timed CSRF | medium | 4.3 | 0% |
| CVE-2021-25097 | labtools (WordPress plugin) | The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing an | medium | 6.5 | 0% |
| CVE-2021-24790 | contact-form-advanced-database (WordPress plugin) | The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_d | medium | 4.3 | 0% |
| CVE-2022-1625 | new-user-approve (WordPress plugin) | The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, w | medium | 4.3 | 0% |
| CVE-2022-34347 | download-manager (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | medium | 4.2 | 0% |
| CVE-2024-3940 | recaptcha-jetpack (WordPress plugin) | The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attacke | high | 8.8 | 0% |
| CVE-2022-3489 | wp-hide (WordPress plugin) | The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settin | medium | 5.3 | 0% |
| CVE-2022-33201 | official-mailerlite-sign-up-forms (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to c | medium | 6.3 | 0% |
| CVE-2022-36292 | photoblocks-grid-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. | medium | 5.4 | 0% |
| CVE-2019-7857 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2019-7873 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 4.3 | 0% |
| CVE-2022-38470 | customer-reviews-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. | medium | 4.3 | 0% |
| CVE-2021-24173 | vm-backups (WordPress plugin) | The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as | medium | 6.1 | 0% |
| CVE-2022-36796 | callrail-phone-call-tracking (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking | medium | 6.1 | 0% |
| CVE-2021-4333 | wp-statistics (WordPress plugin) | The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to | medium | 6.5 | 0% |
| CVE-2020-5501 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2022-35277 | getresponse-integration (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress. | medium | 5.4 | 0% |
| CVE-2026-33507 | wwbn/avideo | AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload | high | 8.8 | 0% |
| CVE-2022-3632 | oauth-client (WordPress plugin) | The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to m | medium | 6.5 | 0% |
| CVE-2022-40132 | seriously-simple-podcasting (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings cha | medium | 5.4 | 0% |
| CVE-2022-38086 | shortcodes-ultimate (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings chang | medium | 5.4 | 0% |
| CVE-2022-37405 | better-font-awesome (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress. | medium | 4.3 | 0% |
| CVE-2023-0403 | social-warfare (WordPress plugin) | The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to | medium | 5.4 | 0% |
| CVE-2024-55921 | typo3/cms-extensionmanager | TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery | high | 7.5 | 0% |
| CVE-2024-0858 | innovs-hr (WordPress plugin) | The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in user | high | 8.8 | 0% |
| CVE-2024-6075 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make | high | 8.8 | 0% |
| CVE-2023-0554 | quick-restaurant-menu (WordPress plugin) | The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is | high | 8.1 | 0% |
| CVE-2022-2375 | wp-sticky-button (WordPress plugin) | The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenti | medium | 5.4 | 0% |
| CVE-2022-38085 | read-more (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-29430 | png-to-jpg (WordPress plugin) | Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable | medium | 4.7 | 0% |
| CVE-2022-2377 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated user | medium | 4.3 | 0% |
| CVE-2022-2382 | product-slider-for-woocommerce (WordPress plugin) | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, | medium | 4.3 | 0% |
| CVE-2022-2389 | funnelkit-automations (WordPress plugin) | The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before | medium | 4.3 | 0% |
| CVE-2023-4920 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |
| CVE-2023-2608 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the ord | low | 3.1 | 0% |
| CVE-2022-0638 | microweber/microweber | Cross-Site Request Forgery microweber | medium | 4.3 | 0% |