Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-43481 | advanced-coupons-for-woocommerce-free (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dis | medium | 5.4 | 0% |
| CVE-2023-5776 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. Thi | medium | 4.3 | 0% |
| CVE-2022-3024 | simple-bitcoin-faucets (WordPress plugin) | The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authentic | medium | 5.4 | 0% |
| CVE-2022-45072 | wpml (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-3764 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9 | medium | 4.3 | 0% |
| CVE-2023-2067 | bulletin-announcements (WordPress plugin) | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce va | medium | 6.3 | 0% |
| CVE-2024-9598 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ | high | 8.8 | 0% |
| CVE-2022-26366 | adrotate-banner-manager (WordPress plugin) | Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-3451 | product-stock-manager (WordPress plugin) | The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowin | medium | 4.3 | 0% |
| CVE-2022-4124 | popup-manager (WordPress plugin) | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthe | medium | 4.3 | 0% |
| CVE-2024-1845 | vikrentcar (WordPress plugin) | The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attack | high | 8.8 | 0% |
| CVE-2022-40632 | wpforo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion. | medium | 5.4 | 0% |
| CVE-2022-4552 | fl3r-feelbox (WordPress plugin) | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as es | medium | 6.1 | 0% |
| CVE-2022-1760 | core-control (WordPress plugin) | The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-3475 | sticky-buttons (WordPress plugin) | The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged | high | 7.5 | 0% |
| CVE-2023-5979 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could al | medium | 6.5 | 0% |
| CVE-2024-0592 | related-posts-for-wp (WordPress plugin) | The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1 | medium | 5.4 | 0% |
| CVE-2023-1871 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 5.4 | 0% |
| CVE-2023-2526 | google-maps-easy (WordPress plugin) | The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. This is due | medium | 5.4 | 0% |
| CVE-2024-3059 | enl-newsletter (WordPress plugin) | The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in ad | medium | 5.7 | 0% |
| CVE-2022-4872 | chained-products (WordPress plugin) | The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option | medium | 4.3 | 0% |
| CVE-2023-0497 | ht-portfolio (WordPress plugin) | The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged | medium | 4.3 | 0% |
| CVE-2024-5551 | wp-staging (WordPress plugin) | The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu | high | 7.5 | 0% |
| CVE-2023-47552 | image-hover-effects (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Image Hover Effects – WordPress Plugin.This issue affects Image Hover Effects | medium | 5.4 | 0% |
| CVE-2024-2405 | float-menu (WordPress plugin) | The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in ad | medium | 4.5 | 0% |
| CVE-2025-0865 | wp-media-category-management (WordPress plugin) | The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to m | medium | 6.5 | 0% |
| CVE-2023-0763 | clock-in-portal--staff-\&-attendance-management (WordPress plugin) | The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could | medium | 4.3 | 0% |
| CVE-2022-47181 | email-templates-customizer-and-designer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-t | medium | 4.3 | 0% |
| CVE-2023-32739 | custom-cursors (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions. | medium | 4.3 | 0% |
| CVE-2023-47238 | top-10 (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions. | medium | 4.3 | 0% |
| CVE-2023-5803 | business-directory (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Business Directory Team Business Directory Plugin – Easy Listing Directories for WordPres | medium | 4.3 | 0% |
| CVE-2024-3477 | popup-box (WordPress plugin) | The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in a | medium | 4.3 | 0% |
| CVE-2024-4532 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | medium | 6.4 | 0% |
| CVE-2023-48651 | concrete5/concrete5 | Concrete CMS Cross Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2023-48653 | concrete5/concrete5 | Concrete CMS Cross Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2026-52777 | yeswiki/yeswiki | YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize | critical | 0.0 | 0% |
| CVE-2021-36855 | booking-ultra-pro (WordPress plugin) | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress. | medium | 6.1 | 0% |
| CVE-2024-0432 | gestpay-for-woocommerce (WordPress plugin) | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. | medium | 4.3 | 0% |
| CVE-2024-0433 | gestpay-for-woocommerce (WordPress plugin) | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. | medium | 4.3 | 0% |
| CVE-2024-0767 | envo-elementor-for-woocommerce (WordPress plugin) | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, | medium | 4.3 | 0% |
| CVE-2023-2440 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing | high | 8.8 | 0% |
| CVE-2024-0203 | digits (WordPress plugin) | The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing | high | 8.8 | 0% |
| CVE-2024-2115 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, | high | 8.8 | 0% |
| CVE-2022-40131 | page-views-count (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset t | medium | 5.4 | 0% |
| CVE-2022-43488 | advanced-dynamic-pricing-for-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule typ | medium | 5.4 | 0% |
| CVE-2023-5756 | digital-publications-by-supsystic (WordPress plugin) | The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7 | medium | 5.4 | 0% |
| CVE-2024-6271 | community-events (WordPress plugin) | The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make | medium | 5.4 | 0% |
| CVE-2024-3481 | counter-box (WordPress plugin) | The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in | medium | 5.2 | 0% |
| CVE-2023-4731 | ladipage (WordPress plugin) | The LadiApp plugn for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the init_endpoint() function hoo | medium | 4.3 | 0% |
| CVE-2024-10593 | wpforms-lite (WordPress plugin) | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Si | medium | 4.3 | 0% |