Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-41805 | booster-for-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-45823 | video-contest-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in GalleryPlugins Video Contest WordPress plugin <= 3.2 versions. | medium | 4.3 | 0% |
| CVE-2022-47174 | performance-lab (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions. | medium | 4.3 | 0% |
| CVE-2023-22672 | vslider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions. | medium | 4.3 | 0% |
| CVE-2023-23705 | wordpress-books-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions. | medium | 4.3 | 0% |
| CVE-2023-23706 | wordpress-social-login-and-register-\(discord\,-google\,-twitter\,-linkedin\) (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugi | medium | 4.3 | 0% |
| CVE-2023-25708 | wp-vr (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 vers | medium | 4.3 | 0% |
| CVE-2023-34028 | wolf---wordpress-posts-bulk-editor-and-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 ve | medium | 4.3 | 0% |
| CVE-2023-41131 | spotify-play-button (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.10 versions. | medium | 4.3 | 0% |
| CVE-2023-5802 | wp-knowledgebase (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1 | medium | 4.3 | 0% |
| CVE-2024-29338 | anchorcms/anchor-cms | Cross-Site Request Forgery in Anchor CMS | high | 7.4 | 0% |
| CVE-2022-41615 | agile-store-locator (WordPress plugin) | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress. | medium | 6.1 | 0% |
| CVE-2023-25065 | wp-tabs (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions. | medium | 5.4 | 0% |
| CVE-2023-6326 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl | medium | 5.4 | 0% |
| CVE-2024-3642 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make log | medium | 6.9 | 0% |
| CVE-2024-35770 | vimeography (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin.This issue affects Vimeograph | medium | 4.3 | 0% |
| CVE-2022-4102 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not | low | 3.1 | 0% |
| CVE-2026-15305 | typo3/cms-form | TYPO3 CMS - Unrestricted File Upload in Form Framework | medium | 0.0 | 0% |
| CVE-2024-2843 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make | medium | 6.5 | 0% |
| CVE-2024-7859 | visual-sound (WordPress plugin) | The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 6.5 | 0% |
| CVE-2024-7864 | favicon-generator (WordPress plugin) | The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, | medium | 6.5 | 0% |
| CVE-2022-45846 | interactive-svg-image-map-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 ver | medium | 5.4 | 0% |
| CVE-2025-3247 | contact-form-7 (WordPress plugin) | The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip | medium | 5.3 | 0% |
| CVE-2024-1325 | woomotiv (WordPress plugin) | The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up t | medium | 4.3 | 0% |
| CVE-2024-9778 | image-gallery (WordPress plugin) | The ImagePress – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. | medium | 4.3 | 0% |
| CVE-2024-8507 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is d | high | 8.8 | 0% |
| CVE-2021-24870 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not saniti | medium | 6.1 | 0% |
| CVE-2023-37996 | gtmetrix (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.7 versions. | medium | 5.4 | 0% |
| CVE-2023-45831 | google-amp (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin <= 1.5.15 versions. | medium | 5.4 | 0% |
| CVE-2023-0498 | wp-education (WordPress plugin) | The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged | medium | 4.3 | 0% |
| CVE-2023-3356 | subscribers-text-counter (WordPress plugin) | The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow a | medium | 4.3 | 0% |
| CVE-2024-29499 | anchorcms/anchor-cms | Cross-Site Request Forgery in Anchor CMS | high | 7.4 | 0% |
| CVE-2023-5934 | travelpayouts (WordPress plugin) | The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings f | high | 7.3 | 0% |
| CVE-2023-6244 | eventon (WordPress plugin), eventon-lite (WordPress plugin) | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 6.5 | 0% |
| CVE-2023-3411 | image-map-pro-lite (WordPress plugin) | The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 6.1 | 0% |
| CVE-2024-55893 | typo3/cms-belog | TYPO3 Cross-Site Request Forgery in Log Module | medium | 4.3 | 0% |
| CVE-2024-55894 | typo3/cms-beuser | TYPO3 Cross-Site Request Forgery in Backend User Module | medium | 4.3 | 0% |
| CVE-2024-4531 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | high | 7.1 | 0% |
| CVE-2022-35730 | sticky-header (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-49744 | gift-up-gift-cards-for-wordpress-and-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Gift Up Gift Up Gift Cards for WordPress and WooCommerce.This issue affects Gift Up Gift | medium | 5.4 | 0% |
| CVE-2023-7269 | artplacer-widget (WordPress plugin) | The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping | high | 7.5 | 0% |
| CVE-2022-4936 | wc-multivendor-marketplace (WordPress plugin) | The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missin | medium | 6.3 | 0% |
| CVE-2022-4938 | wc-frontend-manager (WordPress plugin) | The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to mi | medium | 6.3 | 0% |
| CVE-2023-37968 | falang (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Faboba Falang multilanguage for WordPress plugin <= 1.3.39 versions. | medium | 5.4 | 0% |
| CVE-2023-6980 | wp-sms (WordPress plugin) | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Req | medium | 4.3 | 0% |
| CVE-2023-0831 | under-construction-page (WordPress plugin) | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due | medium | 4.3 | 0% |
| CVE-2023-1414 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow a | medium | 4.3 | 0% |
| CVE-2023-48323 | awesome-support (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin allows Cross S | medium | 4.3 | 0% |
| CVE-2024-2429 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow atta | medium | 4.3 | 0% |
| CVE-2024-13315 | shopwarden (WordPress plugin) | The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | high | 8.8 | 0% |