Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-29428 | superb-social-media-share-buttons-and-follow-buttons (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1. | medium | 5.3 | 0% |
| CVE-2023-26524 | quiz-and-survey-master (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plug | medium | 4.3 | 0% |
| CVE-2023-5531 | wp-responsive-slider-with-lightbox (WordPress plugin) | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. T | medium | 4.3 | 0% |
| CVE-2022-40219 | favicon-switcher (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SedLex FavIcon Switcher plugin <= 1.2.11 at WordPress allows plugin settings change. | medium | 5.4 | 0% |
| CVE-2023-0685 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0722 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0724 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0725 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0726 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2024-10711 | ithemelandco-woo-report (WordPress plugin) | The WooCommerce Report plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is | high | 8.8 | 0% |
| CVE-2024-7492 | mainwp-child-reports (WordPress plugin) | The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is | high | 8.8 | 0% |
| CVE-2022-2312 | student-result-or-employee-database (WordPress plugin) | The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make log | medium | 5.4 | 0% |
| CVE-2023-1340 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1341 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1342 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1343 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1344 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1345 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-5945 | wp-responsive-video-gallery-with-lightbox (WordPress plugin) | The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to miss | medium | 4.3 | 0% |
| CVE-2023-5382 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to | medium | 6.5 | 0% |
| CVE-2022-1626 | sharebar (WordPress plugin) | The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to mak | medium | 5.4 | 0% |
| CVE-2022-1759 | rb-internal-links (WordPress plugin) | The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attack | medium | 5.4 | 0% |
| CVE-2022-1763 | static-page-extended (WordPress plugin) | Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin s | medium | 5.4 | 0% |
| CVE-2022-1764 | wp-chgfontsize (WordPress plugin) | The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 5.4 | 0% |
| CVE-2022-1780 | latex (WordPress plugin) | The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to m | medium | 5.4 | 0% |
| CVE-2022-1781 | posttabs (WordPress plugin) | The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2022-1787 | sideblog (WordPress plugin) | The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make | medium | 5.4 | 0% |
| CVE-2022-1792 | quick-subscribe (WordPress plugin) | The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 5.4 | 0% |
| CVE-2022-1818 | multi-page-toolkit (WordPress plugin) | The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attacker | medium | 5.4 | 0% |
| CVE-2023-5511 | snipe/snipe-it | Cross-Site Request Forgery (CSRF) in snipe/snipe-it | high | 8.8 | 0% |
| CVE-2022-3025 | bitcoin\/altcoin-faucet (WordPress plugin) | The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make | medium | 5.4 | 0% |
| CVE-2023-2717 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to mi | medium | 5.4 | 0% |
| CVE-2024-0830 | wp-comment-fields (WordPress plugin) | The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-1642 | mainwp (WordPress plugin) | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2021-24988 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboa | medium | 5.4 | 0% |
| CVE-2023-1867 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 5.4 | 0% |
| CVE-2023-1870 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-0735 | wallabag/wallabag | Cross-Site Request Forgery (CSRF) in wallabag/wallabag | medium | 6.5 | 0% |
| CVE-2023-28172 | wp-maps (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS (formerly WP Google Map Plugin) pl | medium | 5.4 | 0% |
| CVE-2022-4125 | popup-manager (WordPress plugin) | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sa | medium | 4.3 | 0% |
| CVE-2022-47177 | wp-easypay (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions. | medium | 4.3 | 0% |
| CVE-2023-1807 | stax-addons-for-elementor (WordPress plugin) | The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, an | medium | 4.3 | 0% |
| CVE-2024-5167 | cm-e-mail-blacklist (WordPress plugin) | The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item fro | high | 8.1 | 0% |
| CVE-2026-52823 | kimai/kimai | Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes | medium | 0.0 | 0% |
| CVE-2024-3215 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.3 | 0% |
| CVE-2024-1719 | paypal-\&-stripe-add-on (WordPress plugin) | The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2021-36915 | profile-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file an | medium | 4.2 | 0% |
| CVE-2023-1866 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 5.4 | 0% |
| CVE-2023-3427 | salon-booking-system (WordPress plugin) | The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is d | medium | 5.4 | 0% |
| CVE-2023-4689 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This | medium | 5.4 | 0% |