Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-37411 | captcha-code-authentication (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-38454 | kraken-image-optimizer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io Image Optimizer plugin <= 2.6.5 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-40489 | thinkcmf/thinkcmf | ThinkCMF Cross Site Request Forgery (CSRF) vulnerability | high | 8.8 | 0% |
| CVE-2022-40128 | woo-order-export-lite (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file | medium | 4.3 | 0% |
| CVE-2024-5034 | sully (WordPress plugin) | The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perfor | high | 8.8 | 0% |
| CVE-2021-24836 | temporary-login-without-password (WordPress plugin) | The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, w | medium | 4.3 | 0% |
| CVE-2022-3880 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have pr | medium | 6.5 | 0% |
| CVE-2022-36798 | mega-addons-for-visual-composer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-1956 | shortcut-macros (WordPress plugin) | The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which coul | medium | 4.3 | 0% |
| CVE-2022-4867 | froxlor/froxlor | Froxlor vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2022-4707 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This i | medium | 4.3 | 0% |
| CVE-2022-2449 | resmush.it-image-optimizer (WordPress plugin) | The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its A | medium | 6.5 | 0% |
| CVE-2024-8490 | propertyhive (WordPress plugin) | The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due | high | 8.8 | 0% |
| CVE-2024-2322 | woocommerce-cart-abandonment-recovery (WordPress plugin) | The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow att | medium | 6.8 | 0% |
| CVE-2022-3879 | car-dealer (WordPress plugin) | The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in a | medium | 6.5 | 0% |
| CVE-2024-34007 | moodle/moodle | Moodle Logout CSRF in admin/tool/mfa/auth.php | medium | 0.0 | 0% |
| CVE-2012-10017 | portfolio (WordPress plugin) | A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an un | medium | 4.3 | 0% |
| CVE-2024-0779 | enjoy-social-feed (WordPress plugin) | The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function h | high | 8.8 | 0% |
| CVE-2022-4024 | pie-register (WordPress plugin) | The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, | medium | 6.5 | 0% |
| CVE-2023-5537 | delete-usermetas (WordPress plugin) | The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to | medium | 4.3 | 0% |
| CVE-2024-3474 | wow-skype-buttons (WordPress plugin) | The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logg | high | 8.8 | 0% |
| CVE-2024-3476 | side-menu-lite (WordPress plugin) | The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged | high | 8.8 | 0% |
| CVE-2022-0164 | coming-soon-and-maintenance-mode (WordPress plugin) | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail | medium | 4.3 | 0% |
| CVE-2023-6532 | wp-blogs-planetarium (WordPress plugin) | The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attac | high | 8.8 | 0% |
| CVE-2021-24912 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could al | medium | 5.4 | 0% |
| CVE-2024-3406 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers | high | 8.8 | 0% |
| CVE-2024-3643 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in | high | 8.8 | 0% |
| CVE-2021-25025 | eventcalendar (WordPress plugin) | The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, | medium | 4.3 | 0% |
| CVE-2022-0634 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privi | medium | 4.3 | 0% |
| CVE-2023-6946 | autotitle (WordPress plugin) | The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers t | high | 8.8 | 0% |
| CVE-2023-0086 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This | medium | 5.4 | 0% |
| CVE-2024-5767 | sitetweet (WordPress plugin) | The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | high | 8.8 | 0% |
| CVE-2022-3946 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to | medium | 6.5 | 0% |
| CVE-2022-2275 | wp-edit-menu (WordPress plugin) | The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin d | medium | 4.3 | 0% |
| CVE-2023-1330 | redirection (WordPress plugin) | The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers | medium | 6.5 | 0% |
| CVE-2022-1757 | pagebar (WordPress plugin) | The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a | medium | 5.4 | 0% |
| CVE-2022-36288 | download-manager (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | medium | 5.4 | 0% |
| CVE-2021-24730 | logo-showcase-with-slick-slider (WordPress plugin) | The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_d | medium | 4.3 | 0% |
| CVE-2022-0363 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, al | medium | 4.3 | 0% |
| CVE-2022-3882 | wp-memory (WordPress plugin) | The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authoris | medium | 6.5 | 0% |
| CVE-2022-3883 | stopbadbots (WordPress plugin) | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authori | medium | 6.5 | 0% |
| CVE-2022-3926 | wp-oauth-server (WordPress plugin) | The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could all | medium | 6.5 | 0% |
| CVE-2022-38059 | access-code-feeder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress. | medium | 5.5 | 0% |
| CVE-2024-8520 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | 0% |
| CVE-2022-1591 | wordpress-ping-optimizer (WordPress plugin) | The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could al | medium | 4.3 | 0% |
| CVE-2022-38137 | wp-analytify (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-25985 | wordpress-tooltips (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Tomas | Docs | FAQ | Premium Support WordPress Tooltips.This issue affects WordPress Tool | medium | 4.3 | 0% |
| CVE-2024-11641 | vikbooking (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ | high | 8.8 | 0% |
| CVE-2022-2071 | name-directory (WordPress plugin) | The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as | medium | 6.1 | 0% |
| CVE-2023-46152 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 | medium | 4.3 | 0% |