Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1818 | multi-page-toolkit (WordPress plugin) | The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attacker | medium | 5.4 | 0% |
| CVE-2023-5511 | snipe/snipe-it | Cross-Site Request Forgery (CSRF) in snipe/snipe-it | high | 8.8 | 0% |
| CVE-2022-3025 | bitcoin\/altcoin-faucet (WordPress plugin) | The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make | medium | 5.4 | 0% |
| CVE-2023-2717 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to mi | medium | 5.4 | 0% |
| CVE-2024-0830 | wp-comment-fields (WordPress plugin) | The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-1642 | mainwp (WordPress plugin) | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2021-24988 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboa | medium | 5.4 | 0% |
| CVE-2023-1867 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 5.4 | 0% |
| CVE-2023-1870 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-0735 | wallabag/wallabag | Cross-Site Request Forgery (CSRF) in wallabag/wallabag | medium | 6.5 | 0% |
| CVE-2023-28172 | wp-maps (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS (formerly WP Google Map Plugin) pl | medium | 5.4 | 0% |
| CVE-2022-4125 | popup-manager (WordPress plugin) | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sa | medium | 4.3 | 0% |
| CVE-2022-47177 | wp-easypay (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions. | medium | 4.3 | 0% |
| CVE-2023-1807 | stax-addons-for-elementor (WordPress plugin) | The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, an | medium | 4.3 | 0% |
| CVE-2024-5167 | cm-e-mail-blacklist (WordPress plugin) | The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item fro | high | 8.1 | 0% |
| CVE-2026-52823 | kimai/kimai | Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes | medium | 0.0 | 0% |
| CVE-2024-3215 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.3 | 0% |
| CVE-2024-1719 | paypal-\&-stripe-add-on (WordPress plugin) | The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2021-36915 | profile-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file an | medium | 4.2 | 0% |
| CVE-2023-1866 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 5.4 | 0% |
| CVE-2023-3427 | salon-booking-system (WordPress plugin) | The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is d | medium | 5.4 | 0% |
| CVE-2023-4689 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This | medium | 5.4 | 0% |
| CVE-2023-4690 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This | medium | 5.4 | 0% |
| CVE-2023-1029 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-1068 | read-more-excerpt-link (WordPress plugin) | The Download Read More Excerpt Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0 | medium | 4.3 | 0% |
| CVE-2023-2286 | wp-security-audit-log (WordPress plugin) | The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missin | medium | 4.3 | 0% |
| CVE-2023-2352 | chp-ads-block-detector (WordPress plugin) | The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is | medium | 4.3 | 0% |
| CVE-2023-2563 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-3199 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_ | medium | 4.3 | 0% |
| CVE-2023-3202 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebas | medium | 4.3 | 0% |
| CVE-2023-3407 | subscribe2 (WordPress plugin) | The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to miss | medium | 4.3 | 0% |
| CVE-2025-3638 | moodle/moodle | Moodle has a CSRF risk in Brickfield tool's analysis request action | low | 0.0 | 0% |
| CVE-2024-5943 | wp-nested-pages (WordPress plugin) | The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due t | high | 8.8 | 0% |
| CVE-2023-30616 | form-block (WordPress plugin) | Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery | medium | 6.5 | 0% |
| CVE-2022-36358 | ab-rankings-testing-tool (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout plugin <= 0.9.83 at WordPress allows attackers to trick users with administrati | medium | 5.4 | 0% |
| CVE-2024-0431 | gestpay-for-woocommerce (WordPress plugin) | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. | medium | 4.3 | 0% |
| CVE-2023-0729 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2022-0444 | xcloner (WordPress plugin) | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF c | medium | 4.3 | 0% |
| CVE-2023-41129 | patreon-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6. | medium | 4.3 | 0% |
| CVE-2023-2301 | contact-form-with-a-meeting-scheduler-by-vcita (WordPress plugin) | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. | medium | 6.1 | 0% |
| CVE-2023-2303 | lead-capturing-call-to-actions-by-vcita (WordPress plugin) | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includ | medium | 6.1 | 0% |
| CVE-2022-40686 | creative-mail (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-45073 | wordpress-rest-api-authentication (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-7863 | favicon-generator (WordPress plugin) | The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could | medium | 6.8 | 0% |
| CVE-2022-36417 | cardoza-3d-tag-cloud (WordPress plugin) | Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress. | medium | 6.1 | 0% |
| CVE-2022-29454 | bp-better-messages (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload file | low | 3.1 | 0% |
| CVE-2024-9990 | crypto (WordPress plugin) | The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing n | high | 8.8 | 0% |
| CVE-2023-2279 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due t | medium | 5.4 | 0% |
| CVE-2022-27855 | analytics-cat (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change. | medium | 5.4 | 0% |
| CVE-2022-32587 | wp-page-widget (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change. | medium | 5.4 | 0% |