Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-2084 | easy-social-icons (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack | medium | 6.8 | 3% |
| CVE-2014-4163 | featured-comments (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hij | medium | 6.8 | 3% |
| CVE-2018-15845 | gleez/cms | Gleez CMS CSRF Allows Adding of Administrator Accounts | high | 8.8 | 2% |
| CVE-2018-16854 | moodle/moodle | Moodle Login CSRF vulnerability in login form | high | 8.8 | 2% |
| CVE-2020-18326 | intelliants/subrion | Cross Site Request Forgery in intelliants/subrion | high | 8.8 | 2% |
| CVE-2017-6819 | WordPress core | In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to | medium | 6.5 | 2% |
| CVE-2013-2108 | cleanfix (WordPress plugin) | WordPress WP Cleanfix Plugin 2.4.4 has CSRF | medium | 5.4 | 2% |
| CVE-2019-11886 | yellow-pencil-visual-theme-customizer (WordPress plugin) | The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update | high | 8.8 | 2% |
| CVE-2019-1010054 | dolibarr/dolibarr | Dolibarr Cross Site Request Forgery (CSRF) | high | 8.8 | 2% |
| CVE-2024-11396 | event-monster (WordPress plugin) | The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all vers | medium | 5.3 | 2% |
| CVE-2017-6086 | opensolutions/vimbadmin | ViMbAdmin CSRF Vulnerabilities | high | 8.8 | 2% |
| CVE-2022-0088 | yourls/yourls | Cross-Site Request Forgery in YOURLS | low | 3.5 | 2% |
| CVE-2017-16244 | october/october | October CMS CSRF | high | 8.8 | 2% |
| CVE-2013-2109 | wp-cleanfix (WordPress plugin) | WordPress plugin wp-cleanfix has Remote Code Execution | high | 8.8 | 2% |
| CVE-2014-9033 | WordPress core | Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack | medium | 6.8 | 2% |
| CVE-2017-5492 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote att | high | 8.8 | 2% |
| CVE-2016-6635 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPre | high | 8.8 | 2% |
| CVE-2014-5204 | WordPress core | wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the | medium | 6.8 | 2% |
| CVE-2014-5205 | WordPress core | wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tok | medium | 6.8 | 2% |
| CVE-2019-10673 | ultimate-member (WordPress plugin) | A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to b | high | 8.8 | 2% |
| CVE-2021-24272 | fitness-calculators (WordPress plugin) | The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was | medium | 4.3 | 2% |
| CVE-2017-9062 | WordPress core | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. | high | 8.6 | 2% |
| CVE-2020-4040 | bolt/bolt | CSRF issue on preview pages in Bolt CMS | high | 8.6 | 2% |
| CVE-2017-9064 | WordPress core | In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is | high | 8.8 | 2% |
| CVE-2020-10568 | sitepress-multilingual-cms (WordPress plugin) | The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code ex | high | 8.8 | 2% |
| CVE-2021-21027 | magento/community-edition, magento/project-community-edition | Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API | medium | 4.3 | 2% |
| CVE-2021-24583 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any us | medium | 4.3 | 2% |
| CVE-2021-39864 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Cross-Site Request Forgery (CSRF) | medium | 6.5 | 2% |
| CVE-2021-3980 | elgg/elgg | Information exposure in elgg | high | 7.5 | 2% |
| CVE-2015-5483 | private-only (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack t | high | 8.8 | 2% |
| CVE-2014-2550 | disable-comments (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack | high | 8.8 | 2% |
| CVE-2020-14043 | codiad/codiad | Codiad CSRF Vulnerability | high | 8.8 | 2% |
| CVE-2014-9129 | cm-download-manager (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote at | medium | 6.8 | 2% |
| CVE-2007-4893 | WordPress core | wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_h | medium | 4.3 | 2% |
| CVE-2015-2293 | wordpress-seo (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin be | medium | 6.8 | 2% |
| CVE-2020-36836 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 du | high | 8.0 | 1% |
| CVE-2017-16653 | symfony/security, symfony/security-csrf, symfony/symfony | Symfony CSRF Vulnerability | medium | 5.9 | 1% |
| CVE-2015-1874 | contact-form-7-to-database-extension (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8 | medium | 6.8 | 1% |
| CVE-2018-20231 | two-factor-authentication (WordPress plugin) | Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA | high | 8.8 | 1% |
| CVE-2025-2907 | order-delivery-date-pro-for-woocommerce (WordPress plugin) | The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it a | critical | 9.8 | 1% |
| CVE-2015-8379 | cakephp/cakephp | CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter | high | 8.8 | 1% |
| CVE-2017-5489 | WordPress core | Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecifie | high | 8.8 | 1% |
| CVE-2020-35942 | nextgen-gallery (WordPress plugin) | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusi | high | 8.8 | 1% |
| CVE-2020-29553 | getgrav/grav | Grav CMS Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2019-7357 | intelliants/subrion | Subrion CMS CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2022-2921 | notrinos/notrinos-erp | Exposure of password hashes in notrinos/notrinos-erp | high | 8.8 | 1% |
| CVE-2017-7620 | mantisbt/mantisbt | MantisBT vulnerable to CSRF and Open Redirect attacks | medium | 6.5 | 1% |
| CVE-2014-9414 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross | medium | 6.8 | 1% |
| CVE-2008-5113 | WordPress core | WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to condu | medium | 4.0 | 1% |
| CVE-2019-12934 | wp-code-highlightjs (WordPress plugin) | An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-j | high | 8.8 | 1% |