Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-3203 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_p | medium | 4.3 | 0% |
| CVE-2022-0398 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affili | medium | 5.4 | 0% |
| CVE-2023-4935 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |
| CVE-2023-4937 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |
| CVE-2021-39198 | oro/crm | The disqualify lead action may be executed without CSRF token check | medium | 4.2 | 0% |
| CVE-2024-6022 | contentlock (WordPress plugin) | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to | high | 8.8 | 0% |
| CVE-2024-6023 | contentlock (WordPress plugin) | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a l | high | 8.8 | 0% |
| CVE-2024-6024 | contentlock (WordPress plugin) | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers | high | 8.8 | 0% |
| CVE-2024-3983 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers t | high | 8.1 | 0% |
| CVE-2022-40695 | seo-redirection (WordPress plugin) | Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-41634 | media-library-plus (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-44740 | creative-mail-by-constant-contact (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-0790 | bulk-editor (WordPress plugin) | The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers | medium | 5.4 | 0% |
| CVE-2022-2387 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure | medium | 4.3 | 0% |
| CVE-2024-0859 | affiliates-manager (WordPress plugin) | The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This i | medium | 4.3 | 0% |
| CVE-2022-43491 | advanced-dynamic-pricing-for-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin s | medium | 5.4 | 0% |
| CVE-2023-4161 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustom | medium | 4.3 | 0% |
| CVE-2022-38704 | seo-redirection (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirec | medium | 5.4 | 0% |
| CVE-2023-5975 | imagemapper (WordPress plugin) | The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-5884 | word-balloon (WordPress plugin) | The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attac | medium | 6.5 | 0% |
| CVE-2022-0642 | jivochat (WordPress plugin) | The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and d | medium | 5.4 | 0% |
| CVE-2022-1112 | autolinks (WordPress plugin) | The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as | medium | 5.4 | 0% |
| CVE-2023-29428 | superb-social-media-share-buttons-and-follow-buttons (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1. | medium | 5.3 | 0% |
| CVE-2023-26524 | quiz-and-survey-master (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plug | medium | 4.3 | 0% |
| CVE-2023-5531 | wp-responsive-slider-with-lightbox (WordPress plugin) | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. T | medium | 4.3 | 0% |
| CVE-2022-40219 | favicon-switcher (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SedLex FavIcon Switcher plugin <= 1.2.11 at WordPress allows plugin settings change. | medium | 5.4 | 0% |
| CVE-2023-0685 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0722 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0724 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0725 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0726 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2024-10711 | ithemelandco-woo-report (WordPress plugin) | The WooCommerce Report plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is | high | 8.8 | 0% |
| CVE-2024-7492 | mainwp-child-reports (WordPress plugin) | The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is | high | 8.8 | 0% |
| CVE-2022-2312 | student-result-or-employee-database (WordPress plugin) | The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make log | medium | 5.4 | 0% |
| CVE-2023-1340 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1341 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1342 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1343 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1344 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1345 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-5945 | wp-responsive-video-gallery-with-lightbox (WordPress plugin) | The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to miss | medium | 4.3 | 0% |
| CVE-2023-5382 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to | medium | 6.5 | 0% |
| CVE-2022-1626 | sharebar (WordPress plugin) | The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to mak | medium | 5.4 | 0% |
| CVE-2022-1759 | rb-internal-links (WordPress plugin) | The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attack | medium | 5.4 | 0% |
| CVE-2022-1763 | static-page-extended (WordPress plugin) | Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin s | medium | 5.4 | 0% |
| CVE-2022-1764 | wp-chgfontsize (WordPress plugin) | The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 5.4 | 0% |
| CVE-2022-1780 | latex (WordPress plugin) | The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to m | medium | 5.4 | 0% |
| CVE-2022-1781 | posttabs (WordPress plugin) | The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2022-1787 | sideblog (WordPress plugin) | The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make | medium | 5.4 | 0% |
| CVE-2022-1792 | quick-subscribe (WordPress plugin) | The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 5.4 | 0% |