Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5006 | wp-discord-invite (WordPress plugin) | The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated a | medium | 6.5 | 0% |
| CVE-2022-3126 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2022-3151 | wp-custom-cursors (WordPress plugin) | The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2023-0522 | enable\/disable-auto-login-when-register (WordPress plugin) | The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, whi | medium | 6.5 | 0% |
| CVE-2025-12189 | bread-butter (WordPress plugin) | The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to C | medium | 4.3 | 0% |
| CVE-2023-0737 | wallabag/wallabag | CSRF leading to delete account in wallabag/wallabag | medium | 6.5 | 0% |
| CVE-2022-3098 | login-block-ips (WordPress plugin) | The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2023-1033 | froxlor/froxlor | Froxlor Cross-Site Request Forgery vulnerability | high | 8.8 | 0% |
| CVE-2024-4535 | kkprogressbar2 (WordPress plugin) | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logg | high | 8.8 | 0% |
| CVE-2023-4975 | coming-soon (WordPress plugin) | The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1 | medium | 4.3 | 0% |
| CVE-2022-33177 | booking (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations | medium | 5.4 | 0% |
| CVE-2022-38095 | advanced-dynamic-pricing-for-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-40671 | rate-my-post (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress. | medium | 4.3 | 0% |
| CVE-2023-2087 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due t | medium | 4.3 | 0% |
| CVE-2023-0723 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0727 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0730 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2024-0768 | envo-elementor-for-woocommerce (WordPress plugin) | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to | medium | 4.3 | 0% |
| CVE-2023-5448 | wp-register-profile-with-shortcode (WordPress plugin) | The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3. | high | 8.8 | 0% |
| CVE-2022-40488 | processwire/processwire | ProcessWire vulnerable to Cross-Site Request Forgery | medium | 6.5 | 0% |
| CVE-2023-4455 | wallabag/wallabag | Wallabag user can delete own API client unintentionally | medium | 6.5 | 0% |
| CVE-2022-4941 | wc-multivendor-membership (WordPress plugin) | The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing | medium | 6.3 | 0% |
| CVE-2023-4924 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability c | medium | 5.4 | 0% |
| CVE-2022-25952 | content-egg (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-4277 | realia (WordPress plugin) | The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing | high | 8.8 | 0% |
| CVE-2023-3011 | armember-membership (WordPress plugin) | The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missin | medium | 6.5 | 0% |
| CVE-2023-2528 | contact-form-by-supsystic (WordPress plugin) | The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. Thi | medium | 5.4 | 0% |
| CVE-2023-0824 | userplus (WordPress plugin) | The User registration & user profile WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as we | medium | 6.5 | 0% |
| CVE-2024-1756 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenti | medium | 6.5 | 0% |
| CVE-2021-24388 | vikrentcar-car-rental-management-system (WordPress plugin) | In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the | medium | 5.4 | 0% |
| CVE-2021-24611 | keyword-meta (WordPress plugin) | The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they ar | medium | 5.4 | 0% |
| CVE-2021-36861 | rich-reviews (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete revie | medium | 5.4 | 0% |
| CVE-2022-2405 | wp-popup-builder (WordPress plugin) | The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated | medium | 4.3 | 0% |
| CVE-2022-2657 | multivendor-marketplace-solution-for-woocommerce---wc-marketplace (WordPress plugin) | The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actio | medium | 4.3 | 0% |
| CVE-2023-4940 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |
| CVE-2024-8795 | ba-book-everything (WordPress plugin) | The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This i | high | 8.8 | 0% |
| CVE-2023-6845 | commenttweets (WordPress plugin) | The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |
| CVE-2024-3756 | mf-gig-calendar (WordPress plugin) | The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in C | high | 7.5 | 0% |
| CVE-2023-3052 | page-builder-by-azexo (WordPress plugin) | The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This | medium | 6.3 | 0% |
| CVE-2021-24822 | stylish-cost-calculator (WordPress plugin) | The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (avail | medium | 5.4 | 0% |
| CVE-2022-34654 | manage-notification-e-mails (WordPress plugin) | Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-1028 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to mis | medium | 4.3 | 0% |
| CVE-2022-3149 | wp-custom-cursors (WordPress plugin) | The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow a | medium | 6.1 | 0% |
| CVE-2022-2171 | progressive-license (WordPress plugin) | The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2023-1346 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2022-44737 | all-in-one-wp-security-\&-firewall (WordPress plugin) | Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on Wor | medium | 6.5 | 0% |
| CVE-2023-0728 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-3198 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_ | medium | 4.3 | 0% |
| CVE-2023-3200 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_ord | medium | 4.3 | 0% |
| CVE-2023-3201 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_ord | medium | 4.3 | 0% |