Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9778 | image-gallery (WordPress plugin) | The ImagePress – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. | medium | 4.3 | 0% |
| CVE-2024-8507 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is d | high | 8.8 | 0% |
| CVE-2021-24870 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not saniti | medium | 6.1 | 0% |
| CVE-2023-37996 | gtmetrix (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.7 versions. | medium | 5.4 | 0% |
| CVE-2023-45831 | google-amp (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin <= 1.5.15 versions. | medium | 5.4 | 0% |
| CVE-2023-0498 | wp-education (WordPress plugin) | The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged | medium | 4.3 | 0% |
| CVE-2023-3356 | subscribers-text-counter (WordPress plugin) | The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow a | medium | 4.3 | 0% |
| CVE-2024-29499 | anchorcms/anchor-cms | Cross-Site Request Forgery in Anchor CMS | high | 7.4 | 0% |
| CVE-2023-5934 | travelpayouts (WordPress plugin) | The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings f | high | 7.3 | 0% |
| CVE-2023-6244 | eventon (WordPress plugin), eventon-lite (WordPress plugin) | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 6.5 | 0% |
| CVE-2023-3411 | image-map-pro-lite (WordPress plugin) | The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 6.1 | 0% |
| CVE-2024-55893 | typo3/cms-belog | TYPO3 Cross-Site Request Forgery in Log Module | medium | 4.3 | 0% |
| CVE-2024-55894 | typo3/cms-beuser | TYPO3 Cross-Site Request Forgery in Backend User Module | medium | 4.3 | 0% |
| CVE-2024-4531 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | high | 7.1 | 0% |
| CVE-2022-35730 | sticky-header (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-49744 | gift-up-gift-cards-for-wordpress-and-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Gift Up Gift Up Gift Cards for WordPress and WooCommerce.This issue affects Gift Up Gift | medium | 5.4 | 0% |
| CVE-2023-7269 | artplacer-widget (WordPress plugin) | The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping | high | 7.5 | 0% |
| CVE-2022-4936 | wc-multivendor-marketplace (WordPress plugin) | The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missin | medium | 6.3 | 0% |
| CVE-2022-4938 | wc-frontend-manager (WordPress plugin) | The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to mi | medium | 6.3 | 0% |
| CVE-2023-37968 | falang (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Faboba Falang multilanguage for WordPress plugin <= 1.3.39 versions. | medium | 5.4 | 0% |
| CVE-2023-6980 | wp-sms (WordPress plugin) | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Req | medium | 4.3 | 0% |
| CVE-2023-0831 | under-construction-page (WordPress plugin) | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due | medium | 4.3 | 0% |
| CVE-2023-1414 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow a | medium | 4.3 | 0% |
| CVE-2023-48323 | awesome-support (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin allows Cross S | medium | 4.3 | 0% |
| CVE-2024-2429 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow atta | medium | 4.3 | 0% |
| CVE-2024-13315 | shopwarden (WordPress plugin) | The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | high | 8.8 | 0% |
| CVE-2023-37992 | smarty-for-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions. | medium | 5.4 | 0% |
| CVE-2023-4248 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing | medium | 5.4 | 0% |
| CVE-2023-6520 | wp-2fa (WordPress plugin) | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, | medium | 4.3 | 0% |
| CVE-2024-0796 | profit-products-tables-for-woocommerce (WordPress plugin) | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Cross-S | medium | 4.3 | 0% |
| CVE-2024-1334 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2022-47163 | wp-csv-to-database (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress p | low | 3.1 | 0% |
| CVE-2023-2891 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 6.5 | 0% |
| CVE-2024-1232 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged | medium | 4.8 | 0% |
| CVE-2024-0514 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2023-0832 | under-construction-page (WordPress plugin) | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due | medium | 4.3 | 0% |
| CVE-2026-34394 | wwbn/avideo | AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking | high | 8.1 | 0% |
| CVE-2026-19418 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS - Broken Access Control in Backend and Install Tool | high | 0.0 | 0% |
| CVE-2024-5284 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as esca | medium | 6.8 | 0% |
| CVE-2023-2893 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-2894 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-2895 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-2896 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-3408 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing o | medium | 4.3 | 0% |
| CVE-2024-30457 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress | medium | 4.3 | 0% |
| CVE-2024-13146 | booknetic (WordPress plugin) | The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logge | high | 8.8 | 0% |
| CVE-2024-7688 | azindex (WordPress plugin) | The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin del | medium | 6.5 | 0% |
| CVE-2024-7817 | misiek-photo-album (WordPress plugin) | The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged i | medium | 6.5 | 0% |
| CVE-2022-38075 | mantenimiento-web (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPres | medium | 6.1 | 0% |
| CVE-2024-1213 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all | medium | 5.4 | 0% |