Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-45269 | carousel-slider (WordPress plugin) | WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection | medium | 4.3 | 0% |
| CVE-2022-43459 | captainform (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions. | medium | 5.4 | 0% |
| CVE-2022-47136 | ninja-tables (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 ver | medium | 4.3 | 0% |
| CVE-2022-47161 | health-check-\&-troubleshooting (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions. | medium | 4.3 | 0% |
| CVE-2023-23646 | album-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin <= 1.4.9 versions. | medium | 4.3 | 0% |
| CVE-2023-5990 | funnelforms-free (WordPress plugin) | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on | medium | 6.5 | 0% |
| CVE-2024-6496 | light-poll (WordPress plugin) | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in u | medium | 6.5 | 0% |
| CVE-2023-47230 | wordpress-contact-forms (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions. | medium | 5.4 | 0% |
| CVE-2023-49821 | livechat (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP li | medium | 5.4 | 0% |
| CVE-2022-44627 | cds-simple-seo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete | medium | 5.4 | 0% |
| CVE-2022-47446 | store-locator-for-wordpress-with-google-maps (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin <= 3 | medium | 5.4 | 0% |
| CVE-2024-3941 | recaptcha-jetpack (WordPress plugin) | The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escapin | medium | 4.7 | 0% |
| CVE-2023-48328 | nextgen-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery allows Cross Site Request Forgery.This | medium | 4.3 | 0% |
| CVE-2023-5602 | ultimate-social-media-icons (WordPress plugin) | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 4.3 | 0% |
| CVE-2023-2497 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing | high | 8.8 | 0% |
| CVE-2024-55924 | typo3/cms-scheduler | TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery | high | 8.0 | 0% |
| CVE-2024-6412 | html-forms (WordPress plugin) | The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users | medium | 6.5 | 0% |
| CVE-2023-4454 | wallabag/wallabag | Wallabag user can reset data unintentionally | medium | 5.7 | 0% |
| CVE-2024-1501 | wordpress-database-reset (WordPress plugin) | The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due | medium | 4.7 | 0% |
| CVE-2024-1760 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forg | medium | 4.3 | 0% |
| CVE-2022-4386 | intuitive-custom-post-order (WordPress plugin) | The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attack | medium | 4.3 | 0% |
| CVE-2022-4553 | fl3r-feelbox (WordPress plugin) | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make log | medium | 4.3 | 0% |
| CVE-2023-1089 | coupon-zen (WordPress plugin) | The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2022-1617 | wp-invoice (WordPress plugin) | The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as w | medium | 6.1 | 0% |
| CVE-2022-1618 | coru-lfmember (WordPress plugin) | The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as we | medium | 6.1 | 0% |
| CVE-2023-3178 | post-smtp (WordPress plugin) | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to mak | medium | 4.3 | 0% |
| CVE-2024-39639 | wordpress-file-upload (WordPress plugin) | Broken Access Control vulnerability in Nickolas Bossinas WordPress File Upload allows Exploiting Incorrectly Configured Access Control Secur | medium | 4.3 | 0% |
| CVE-2024-7568 | favicon-generator (WordPress plugin) | The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to | critical | 9.6 | 0% |
| CVE-2024-13758 | cp-contact-form-with-paypal (WordPress plugin) | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.5 | medium | 6.5 | 0% |
| CVE-2022-4103 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not | medium | 4.3 | 0% |
| CVE-2024-4758 | muslim-prayer-time-bd (WordPress plugin) | The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attac | high | 7.6 | 0% |
| CVE-2024-0428 | mihdan-index-now (WordPress plugin) | The Index Now plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.3. This is due to m | high | 7.1 | 0% |
| CVE-2024-6230 | pardakht-delkhah (WordPress plugin) | The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow | medium | 6.5 | 0% |
| CVE-2022-38356 | pearl-header-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions. | medium | 5.4 | 0% |
| CVE-2022-41620 | seosamba (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions. | medium | 5.4 | 0% |
| CVE-2023-44233 | foogallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions. | medium | 5.4 | 0% |
| CVE-2023-48754 | delete-post-revisions (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Wap Nepal Delete Post Revisions In WordPress allows Cross Site Request Forgery.This issue | medium | 5.4 | 0% |
| CVE-2024-10040 | infinite-scroll (WordPress plugin) | The Infinite-Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is du | medium | 5.3 | 0% |
| CVE-2024-13753 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. | high | 8.1 | 0% |
| CVE-2022-4148 | oauth-server (WordPress plugin) | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, w | medium | 4.3 | 0% |
| CVE-2022-47447 | wp-advanced-search (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions. | medium | 4.3 | 0% |
| CVE-2024-11143 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2 | medium | 4.3 | 0% |
| CVE-2023-41694 | realbig (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Realbig Team Realbig For WordPress plugin <= 1.0.3 versions. | medium | 4.3 | 0% |
| CVE-2023-5772 | debug-log-manager (WordPress plugin) | The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is | medium | 4.3 | 0% |
| CVE-2024-1504 | secupress (WordPress plugin) | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2024-3405 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to ma | high | 7.6 | 0% |
| CVE-2024-31503 | dolibarr/dolibarr | Dolibarr vulnerable to Cross-Site Request Forgery | high | 7.5 | 0% |
| CVE-2023-6242 | eventon (WordPress plugin), eventon-lite (WordPress plugin) | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 6.5 | 0% |
| CVE-2023-4247 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing | medium | 5.4 | 0% |
| CVE-2026-55593 | froxlor/froxlor | Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection | medium | 6.5 | 0% |