Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-1089 | coupon-zen (WordPress plugin) | The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2022-1617 | wp-invoice (WordPress plugin) | The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as w | medium | 6.1 | 0% |
| CVE-2022-1618 | coru-lfmember (WordPress plugin) | The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as we | medium | 6.1 | 0% |
| CVE-2023-3178 | post-smtp (WordPress plugin) | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to mak | medium | 4.3 | 0% |
| CVE-2024-39639 | wordpress-file-upload (WordPress plugin) | Broken Access Control vulnerability in Nickolas Bossinas WordPress File Upload allows Exploiting Incorrectly Configured Access Control Secur | medium | 4.3 | 0% |
| CVE-2024-7568 | favicon-generator (WordPress plugin) | The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to | critical | 9.6 | 0% |
| CVE-2024-13758 | cp-contact-form-with-paypal (WordPress plugin) | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.5 | medium | 6.5 | 0% |
| CVE-2022-4103 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not | medium | 4.3 | 0% |
| CVE-2024-4758 | muslim-prayer-time-bd (WordPress plugin) | The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attac | high | 7.6 | 0% |
| CVE-2024-0428 | mihdan-index-now (WordPress plugin) | The Index Now plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.3. This is due to m | high | 7.1 | 0% |
| CVE-2024-6230 | pardakht-delkhah (WordPress plugin) | The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow | medium | 6.5 | 0% |
| CVE-2022-38356 | pearl-header-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions. | medium | 5.4 | 0% |
| CVE-2022-41620 | seosamba (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions. | medium | 5.4 | 0% |
| CVE-2023-44233 | foogallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions. | medium | 5.4 | 0% |
| CVE-2023-48754 | delete-post-revisions (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Wap Nepal Delete Post Revisions In WordPress allows Cross Site Request Forgery.This issue | medium | 5.4 | 0% |
| CVE-2024-10040 | infinite-scroll (WordPress plugin) | The Infinite-Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is du | medium | 5.3 | 0% |
| CVE-2024-13753 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. | high | 8.1 | 0% |
| CVE-2022-4148 | oauth-server (WordPress plugin) | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, w | medium | 4.3 | 0% |
| CVE-2022-47447 | wp-advanced-search (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions. | medium | 4.3 | 0% |
| CVE-2024-11143 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2 | medium | 4.3 | 0% |
| CVE-2023-41694 | realbig (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Realbig Team Realbig For WordPress plugin <= 1.0.3 versions. | medium | 4.3 | 0% |
| CVE-2023-5772 | debug-log-manager (WordPress plugin) | The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is | medium | 4.3 | 0% |
| CVE-2024-1504 | secupress (WordPress plugin) | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2024-3405 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to ma | high | 7.6 | 0% |
| CVE-2024-31503 | dolibarr/dolibarr | Dolibarr vulnerable to Cross-Site Request Forgery | high | 7.5 | 0% |
| CVE-2023-6242 | eventon (WordPress plugin), eventon-lite (WordPress plugin) | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 6.5 | 0% |
| CVE-2023-4247 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing | medium | 5.4 | 0% |
| CVE-2026-55593 | froxlor/froxlor | Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection | medium | 6.5 | 0% |
| CVE-2022-41805 | booster-for-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-45823 | video-contest-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in GalleryPlugins Video Contest WordPress plugin <= 3.2 versions. | medium | 4.3 | 0% |
| CVE-2022-47174 | performance-lab (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions. | medium | 4.3 | 0% |
| CVE-2023-22672 | vslider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions. | medium | 4.3 | 0% |
| CVE-2023-23705 | wordpress-books-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions. | medium | 4.3 | 0% |
| CVE-2023-23706 | wordpress-social-login-and-register-\(discord\,-google\,-twitter\,-linkedin\) (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugi | medium | 4.3 | 0% |
| CVE-2023-25708 | wp-vr (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 vers | medium | 4.3 | 0% |
| CVE-2023-34028 | wolf---wordpress-posts-bulk-editor-and-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 ve | medium | 4.3 | 0% |
| CVE-2023-41131 | spotify-play-button (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.10 versions. | medium | 4.3 | 0% |
| CVE-2023-5802 | wp-knowledgebase (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1 | medium | 4.3 | 0% |
| CVE-2024-29338 | anchorcms/anchor-cms | Cross-Site Request Forgery in Anchor CMS | high | 7.4 | 0% |
| CVE-2022-41615 | agile-store-locator (WordPress plugin) | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress. | medium | 6.1 | 0% |
| CVE-2023-25065 | wp-tabs (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions. | medium | 5.4 | 0% |
| CVE-2023-6326 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl | medium | 5.4 | 0% |
| CVE-2024-3642 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make log | medium | 6.9 | 0% |
| CVE-2024-35770 | vimeography (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin.This issue affects Vimeograph | medium | 4.3 | 0% |
| CVE-2022-4102 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not | low | 3.1 | 0% |
| CVE-2024-2843 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make | medium | 6.5 | 0% |
| CVE-2024-7859 | visual-sound (WordPress plugin) | The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 6.5 | 0% |
| CVE-2024-7864 | favicon-generator (WordPress plugin) | The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, | medium | 6.5 | 0% |
| CVE-2022-45846 | interactive-svg-image-map-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 ver | medium | 5.4 | 0% |
| CVE-2024-1325 | woomotiv (WordPress plugin) | The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up t | medium | 4.3 | 0% |