Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-35277 | getresponse-integration (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress. | medium | 5.4 | 0% |
| CVE-2026-33507 | wwbn/avideo | AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload | high | 8.8 | 0% |
| CVE-2022-3632 | oauth-client (WordPress plugin) | The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to m | medium | 6.5 | 0% |
| CVE-2022-40132 | seriously-simple-podcasting (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings cha | medium | 5.4 | 0% |
| CVE-2022-38086 | shortcodes-ultimate (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings chang | medium | 5.4 | 0% |
| CVE-2022-37405 | better-font-awesome (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress. | medium | 4.3 | 0% |
| CVE-2023-0403 | social-warfare (WordPress plugin) | The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to | medium | 5.4 | 0% |
| CVE-2024-55921 | typo3/cms-extensionmanager | TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery | high | 7.5 | 0% |
| CVE-2024-13228 | qubely (WordPress plugin) | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | medium | 4.3 | 0% |
| CVE-2024-0858 | innovs-hr (WordPress plugin) | The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in user | high | 8.8 | 0% |
| CVE-2024-6075 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make | high | 8.8 | 0% |
| CVE-2023-0554 | quick-restaurant-menu (WordPress plugin) | The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is | high | 8.1 | 0% |
| CVE-2022-2375 | wp-sticky-button (WordPress plugin) | The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenti | medium | 5.4 | 0% |
| CVE-2022-38085 | read-more (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-29430 | png-to-jpg (WordPress plugin) | Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable | medium | 4.7 | 0% |
| CVE-2022-2377 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated user | medium | 4.3 | 0% |
| CVE-2022-2382 | product-slider-for-woocommerce (WordPress plugin) | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, | medium | 4.3 | 0% |
| CVE-2022-2389 | funnelkit-automations (WordPress plugin) | The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before | medium | 4.3 | 0% |
| CVE-2023-4920 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |
| CVE-2023-2608 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the ord | low | 3.1 | 0% |
| CVE-2022-0638 | microweber/microweber | Cross-Site Request Forgery microweber | medium | 4.3 | 0% |
| CVE-2022-37411 | captcha-code-authentication (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-38454 | kraken-image-optimizer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io Image Optimizer plugin <= 2.6.5 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-40489 | thinkcmf/thinkcmf | ThinkCMF Cross Site Request Forgery (CSRF) vulnerability | high | 8.8 | 0% |
| CVE-2022-40128 | woo-order-export-lite (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file | medium | 4.3 | 0% |
| CVE-2024-5034 | sully (WordPress plugin) | The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perfor | high | 8.8 | 0% |
| CVE-2021-24836 | temporary-login-without-password (WordPress plugin) | The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, w | medium | 4.3 | 0% |
| CVE-2022-3880 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have pr | medium | 6.5 | 0% |
| CVE-2022-36798 | mega-addons-for-visual-composer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-1956 | shortcut-macros (WordPress plugin) | The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which coul | medium | 4.3 | 0% |
| CVE-2022-4867 | froxlor/froxlor | Froxlor vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2022-4707 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This i | medium | 4.3 | 0% |
| CVE-2022-2449 | resmush.it-image-optimizer (WordPress plugin) | The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its A | medium | 6.5 | 0% |
| CVE-2024-8490 | propertyhive (WordPress plugin) | The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due | high | 8.8 | 0% |
| CVE-2024-2322 | woocommerce-cart-abandonment-recovery (WordPress plugin) | The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow att | medium | 6.8 | 0% |
| CVE-2022-3879 | car-dealer (WordPress plugin) | The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in a | medium | 6.5 | 0% |
| CVE-2024-34007 | moodle/moodle | Moodle Logout CSRF in admin/tool/mfa/auth.php | medium | 0.0 | 0% |
| CVE-2012-10017 | portfolio (WordPress plugin) | A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an un | medium | 4.3 | 0% |
| CVE-2024-0779 | enjoy-social-feed (WordPress plugin) | The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function h | high | 8.8 | 0% |
| CVE-2022-4024 | pie-register (WordPress plugin) | The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, | medium | 6.5 | 0% |
| CVE-2023-5537 | delete-usermetas (WordPress plugin) | The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to | medium | 4.3 | 0% |
| CVE-2024-3474 | wow-skype-buttons (WordPress plugin) | The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logg | high | 8.8 | 0% |
| CVE-2024-3476 | side-menu-lite (WordPress plugin) | The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged | high | 8.8 | 0% |
| CVE-2022-0164 | coming-soon-and-maintenance-mode (WordPress plugin) | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail | medium | 4.3 | 0% |
| CVE-2023-6532 | wp-blogs-planetarium (WordPress plugin) | The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attac | high | 8.8 | 0% |
| CVE-2021-24912 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could al | medium | 5.4 | 0% |
| CVE-2024-3406 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers | high | 8.8 | 0% |
| CVE-2024-3643 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in | high | 8.8 | 0% |
| CVE-2021-25025 | eventcalendar (WordPress plugin) | The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, | medium | 4.3 | 0% |
| CVE-2022-0634 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privi | medium | 4.3 | 0% |