Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5551 | wp-staging (WordPress plugin) | The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu | high | 7.5 | 0% |
| CVE-2023-47552 | image-hover-effects (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Image Hover Effects – WordPress Plugin.This issue affects Image Hover Effects | medium | 5.4 | 0% |
| CVE-2024-2405 | float-menu (WordPress plugin) | The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in ad | medium | 4.5 | 0% |
| CVE-2025-0865 | wp-media-category-management (WordPress plugin) | The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to m | medium | 6.5 | 0% |
| CVE-2023-0763 | clock-in-portal--staff-\&-attendance-management (WordPress plugin) | The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could | medium | 4.3 | 0% |
| CVE-2022-47181 | email-templates-customizer-and-designer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-t | medium | 4.3 | 0% |
| CVE-2023-32739 | custom-cursors (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions. | medium | 4.3 | 0% |
| CVE-2023-47238 | top-10 (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions. | medium | 4.3 | 0% |
| CVE-2023-5803 | business-directory (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Business Directory Team Business Directory Plugin – Easy Listing Directories for WordPres | medium | 4.3 | 0% |
| CVE-2024-3477 | popup-box (WordPress plugin) | The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in a | medium | 4.3 | 0% |
| CVE-2024-4532 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | medium | 6.4 | 0% |
| CVE-2023-48651 | concrete5/concrete5 | Concrete CMS Cross Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2023-48653 | concrete5/concrete5 | Concrete CMS Cross Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2026-52777 | yeswiki/yeswiki | YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize | critical | 0.0 | 0% |
| CVE-2021-36855 | booking-ultra-pro (WordPress plugin) | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress. | medium | 6.1 | 0% |
| CVE-2024-0432 | gestpay-for-woocommerce (WordPress plugin) | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. | medium | 4.3 | 0% |
| CVE-2024-0433 | gestpay-for-woocommerce (WordPress plugin) | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. | medium | 4.3 | 0% |
| CVE-2024-0767 | envo-elementor-for-woocommerce (WordPress plugin) | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, | medium | 4.3 | 0% |
| CVE-2023-2440 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing | high | 8.8 | 0% |
| CVE-2024-0203 | digits (WordPress plugin) | The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing | high | 8.8 | 0% |
| CVE-2024-2115 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, | high | 8.8 | 0% |
| CVE-2022-40131 | page-views-count (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset t | medium | 5.4 | 0% |
| CVE-2022-43488 | advanced-dynamic-pricing-for-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule typ | medium | 5.4 | 0% |
| CVE-2023-5756 | digital-publications-by-supsystic (WordPress plugin) | The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7 | medium | 5.4 | 0% |
| CVE-2024-6271 | community-events (WordPress plugin) | The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make | medium | 5.4 | 0% |
| CVE-2024-3481 | counter-box (WordPress plugin) | The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in | medium | 5.2 | 0% |
| CVE-2023-4731 | ladipage (WordPress plugin) | The LadiApp plugn for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the init_endpoint() function hoo | medium | 4.3 | 0% |
| CVE-2024-10593 | wpforms-lite (WordPress plugin) | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Si | medium | 4.3 | 0% |
| CVE-2024-45269 | carousel-slider (WordPress plugin) | WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection | medium | 4.3 | 0% |
| CVE-2022-43459 | captainform (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions. | medium | 5.4 | 0% |
| CVE-2022-47136 | ninja-tables (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 ver | medium | 4.3 | 0% |
| CVE-2022-47161 | health-check-\&-troubleshooting (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions. | medium | 4.3 | 0% |
| CVE-2023-23646 | album-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin <= 1.4.9 versions. | medium | 4.3 | 0% |
| CVE-2023-5990 | funnelforms-free (WordPress plugin) | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on | medium | 6.5 | 0% |
| CVE-2024-6496 | light-poll (WordPress plugin) | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in u | medium | 6.5 | 0% |
| CVE-2023-47230 | wordpress-contact-forms (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions. | medium | 5.4 | 0% |
| CVE-2023-49821 | livechat (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP li | medium | 5.4 | 0% |
| CVE-2022-44627 | cds-simple-seo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete | medium | 5.4 | 0% |
| CVE-2022-47446 | store-locator-for-wordpress-with-google-maps (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin <= 3 | medium | 5.4 | 0% |
| CVE-2024-3941 | recaptcha-jetpack (WordPress plugin) | The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escapin | medium | 4.7 | 0% |
| CVE-2023-48328 | nextgen-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery allows Cross Site Request Forgery.This | medium | 4.3 | 0% |
| CVE-2023-5602 | ultimate-social-media-icons (WordPress plugin) | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 4.3 | 0% |
| CVE-2023-2497 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing | high | 8.8 | 0% |
| CVE-2024-55924 | typo3/cms-scheduler | TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery | high | 8.0 | 0% |
| CVE-2024-6412 | html-forms (WordPress plugin) | The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users | medium | 6.5 | 0% |
| CVE-2023-4454 | wallabag/wallabag | Wallabag user can reset data unintentionally | medium | 5.7 | 0% |
| CVE-2024-1501 | wordpress-database-reset (WordPress plugin) | The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due | medium | 4.7 | 0% |
| CVE-2024-1760 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forg | medium | 4.3 | 0% |
| CVE-2022-4386 | intuitive-custom-post-order (WordPress plugin) | The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attack | medium | 4.3 | 0% |
| CVE-2022-4553 | fl3r-feelbox (WordPress plugin) | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make log | medium | 4.3 | 0% |