Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6946 | autotitle (WordPress plugin) | The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers t | high | 8.8 | 0% |
| CVE-2023-0086 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This | medium | 5.4 | 0% |
| CVE-2023-6630 | contact-form-7-dynamic-text-extension (WordPress plugin) | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an | medium | 4.3 | 0% |
| CVE-2024-5767 | sitetweet (WordPress plugin) | The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | high | 8.8 | 0% |
| CVE-2022-3946 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to | medium | 6.5 | 0% |
| CVE-2022-2275 | wp-edit-menu (WordPress plugin) | The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin d | medium | 4.3 | 0% |
| CVE-2023-1330 | redirection (WordPress plugin) | The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers | medium | 6.5 | 0% |
| CVE-2022-1757 | pagebar (WordPress plugin) | The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a | medium | 5.4 | 0% |
| CVE-2022-36288 | download-manager (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | medium | 5.4 | 0% |
| CVE-2021-24730 | logo-showcase-with-slick-slider (WordPress plugin) | The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_d | medium | 4.3 | 0% |
| CVE-2022-0363 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, al | medium | 4.3 | 0% |
| CVE-2022-3882 | wp-memory (WordPress plugin) | The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authoris | medium | 6.5 | 0% |
| CVE-2022-3883 | stopbadbots (WordPress plugin) | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authori | medium | 6.5 | 0% |
| CVE-2022-3926 | wp-oauth-server (WordPress plugin) | The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could all | medium | 6.5 | 0% |
| CVE-2022-38059 | access-code-feeder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress. | medium | 5.5 | 0% |
| CVE-2024-8520 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | 0% |
| CVE-2022-1591 | wordpress-ping-optimizer (WordPress plugin) | The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could al | medium | 4.3 | 0% |
| CVE-2022-38137 | wp-analytify (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-25985 | wordpress-tooltips (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Tomas | Docs | FAQ | Premium Support WordPress Tooltips.This issue affects WordPress Tool | medium | 4.3 | 0% |
| CVE-2024-11641 | vikbooking (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ | high | 8.8 | 0% |
| CVE-2022-2071 | name-directory (WordPress plugin) | The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as | medium | 6.1 | 0% |
| CVE-2023-46152 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 | medium | 4.3 | 0% |
| CVE-2023-2079 | buymeacoffee (WordPress plugin) | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce valid | high | 7.1 | 0% |
| CVE-2023-2277 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due t | medium | 6.1 | 0% |
| CVE-2022-29489 | sucuri-scanner (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin <= 1.8.33 at WordPress leading to Event log entry creation. | medium | 4.3 | 0% |
| CVE-2021-36854 | booking-ultra-pro (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress. | medium | 5.4 | 0% |
| CVE-2024-2739 | advanced-search (WordPress plugin) | The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in u | high | 8.7 | 0% |
| CVE-2023-2405 | crm-customer-relationship-management-by-vcita (WordPress plugin) | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7. | medium | 6.1 | 0% |
| CVE-2023-6196 | audio-merchant (WordPress plugin) | The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due | high | 8.8 | 0% |
| CVE-2022-38139 | rd-station (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-4548 | optimize-images-alt-text-\(alt-tag\)-\&-names-for-seo-using-ai (WordPress plugin) | The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its sett | medium | 6.5 | 0% |
| CVE-2023-2549 | feather-login-page (WordPress plugin) | The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including | high | 8.8 | 0% |
| CVE-2023-4276 | absolute-privacy (WordPress plugin) | The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to | high | 8.8 | 0% |
| CVE-2022-41136 | shortcodes-ultimate (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugi | medium | 6.1 | 0% |
| CVE-2022-44741 | testimonial-slider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 o | medium | 6.1 | 0% |
| CVE-2022-30337 | wp-meta-seo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin <= 4.4.8 at WordPress allows an attacker to update the soci | medium | 5.4 | 0% |
| CVE-2022-32289 | popup-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change. | medium | 5.4 | 0% |
| CVE-2022-45071 | wpml (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. | medium | 5.4 | 0% |
| CVE-2023-0385 | custom-404-pro (WordPress plugin) | The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to | medium | 4.3 | 0% |
| CVE-2024-7423 | stream (WordPress plugin) | The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to miss | high | 8.8 | 0% |
| CVE-2024-11601 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Vide | high | 8.1 | 0% |
| CVE-2023-6390 | wordpress-users (WordPress plugin) | The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers t | high | 8.8 | 0% |
| CVE-2023-7074 | wp-social-bookmark-menu (WordPress plugin) | The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow att | high | 8.8 | 0% |
| CVE-2024-11640 | vikrentcar (WordPress plugin) | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl | high | 8.8 | 0% |
| CVE-2024-3632 | smart-image-gallery (WordPress plugin) | The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attac | medium | 6.8 | 0% |
| CVE-2021-24446 | remove-footer-credit (WordPress plugin) | The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacke | medium | 5.4 | 0% |
| CVE-2024-5076 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |
| CVE-2023-4923 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 5.4 | 0% |
| CVE-2023-4926 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 5.4 | 0% |
| CVE-2023-4942 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |