Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-4690 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This | medium | 5.4 | 0% |
| CVE-2023-1029 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-1068 | read-more-excerpt-link (WordPress plugin) | The Download Read More Excerpt Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0 | medium | 4.3 | 0% |
| CVE-2023-2286 | wp-security-audit-log (WordPress plugin) | The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missin | medium | 4.3 | 0% |
| CVE-2023-2352 | chp-ads-block-detector (WordPress plugin) | The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is | medium | 4.3 | 0% |
| CVE-2023-2563 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-3199 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_ | medium | 4.3 | 0% |
| CVE-2023-3202 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebas | medium | 4.3 | 0% |
| CVE-2023-3407 | subscribe2 (WordPress plugin) | The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to miss | medium | 4.3 | 0% |
| CVE-2025-3638 | moodle/moodle | Moodle has a CSRF risk in Brickfield tool's analysis request action | low | 0.0 | 0% |
| CVE-2024-5943 | wp-nested-pages (WordPress plugin) | The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due t | high | 8.8 | 0% |
| CVE-2023-30616 | form-block (WordPress plugin) | Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery | medium | 6.5 | 0% |
| CVE-2022-36358 | ab-rankings-testing-tool (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout plugin <= 0.9.83 at WordPress allows attackers to trick users with administrati | medium | 5.4 | 0% |
| CVE-2024-0431 | gestpay-for-woocommerce (WordPress plugin) | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. | medium | 4.3 | 0% |
| CVE-2023-0729 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2022-0444 | xcloner (WordPress plugin) | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF c | medium | 4.3 | 0% |
| CVE-2023-41129 | patreon-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6. | medium | 4.3 | 0% |
| CVE-2023-2301 | contact-form-with-a-meeting-scheduler-by-vcita (WordPress plugin) | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. | medium | 6.1 | 0% |
| CVE-2023-2303 | lead-capturing-call-to-actions-by-vcita (WordPress plugin) | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includ | medium | 6.1 | 0% |
| CVE-2022-40686 | creative-mail (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-45073 | wordpress-rest-api-authentication (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-7863 | favicon-generator (WordPress plugin) | The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could | medium | 6.8 | 0% |
| CVE-2022-36417 | cardoza-3d-tag-cloud (WordPress plugin) | Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress. | medium | 6.1 | 0% |
| CVE-2022-29454 | bp-better-messages (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload file | low | 3.1 | 0% |
| CVE-2024-9990 | crypto (WordPress plugin) | The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing n | high | 8.8 | 0% |
| CVE-2023-2279 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due t | medium | 5.4 | 0% |
| CVE-2022-27855 | analytics-cat (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change. | medium | 5.4 | 0% |
| CVE-2022-32587 | wp-page-widget (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change. | medium | 5.4 | 0% |
| CVE-2022-43481 | advanced-coupons-for-woocommerce-free (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dis | medium | 5.4 | 0% |
| CVE-2023-5776 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. Thi | medium | 4.3 | 0% |
| CVE-2022-3024 | simple-bitcoin-faucets (WordPress plugin) | The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authentic | medium | 5.4 | 0% |
| CVE-2022-45072 | wpml (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-3764 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9 | medium | 4.3 | 0% |
| CVE-2023-2067 | bulletin-announcements (WordPress plugin) | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce va | medium | 6.3 | 0% |
| CVE-2024-9598 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ | high | 8.8 | 0% |
| CVE-2022-26366 | adrotate-banner-manager (WordPress plugin) | Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-3451 | product-stock-manager (WordPress plugin) | The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowin | medium | 4.3 | 0% |
| CVE-2022-4124 | popup-manager (WordPress plugin) | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthe | medium | 4.3 | 0% |
| CVE-2024-1845 | vikrentcar (WordPress plugin) | The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attack | high | 8.8 | 0% |
| CVE-2022-40632 | wpforo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion. | medium | 5.4 | 0% |
| CVE-2022-4552 | fl3r-feelbox (WordPress plugin) | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as es | medium | 6.1 | 0% |
| CVE-2022-1760 | core-control (WordPress plugin) | The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-3475 | sticky-buttons (WordPress plugin) | The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged | high | 7.5 | 0% |
| CVE-2023-5979 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could al | medium | 6.5 | 0% |
| CVE-2024-0592 | related-posts-for-wp (WordPress plugin) | The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1 | medium | 5.4 | 0% |
| CVE-2023-1871 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 5.4 | 0% |
| CVE-2023-2526 | google-maps-easy (WordPress plugin) | The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. This is due | medium | 5.4 | 0% |
| CVE-2024-3059 | enl-newsletter (WordPress plugin) | The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in ad | medium | 5.7 | 0% |
| CVE-2022-4872 | chained-products (WordPress plugin) | The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option | medium | 4.3 | 0% |
| CVE-2023-0497 | ht-portfolio (WordPress plugin) | The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged | medium | 4.3 | 0% |