Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-37992 | smarty-for-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions. | medium | 5.4 | 0% |
| CVE-2023-4248 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing | medium | 5.4 | 0% |
| CVE-2023-6520 | wp-2fa (WordPress plugin) | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, | medium | 4.3 | 0% |
| CVE-2024-0796 | profit-products-tables-for-woocommerce (WordPress plugin) | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Cross-S | medium | 4.3 | 0% |
| CVE-2024-1334 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2022-47163 | wp-csv-to-database (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress p | low | 3.1 | 0% |
| CVE-2023-2891 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 6.5 | 0% |
| CVE-2024-1232 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged | medium | 4.8 | 0% |
| CVE-2024-0514 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2023-0832 | under-construction-page (WordPress plugin) | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due | medium | 4.3 | 0% |
| CVE-2026-34394 | wwbn/avideo | AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking | high | 8.1 | 0% |
| CVE-2026-19418 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS - Broken Access Control in Backend and Install Tool | high | 0.0 | 0% |
| CVE-2024-5284 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as esca | medium | 6.8 | 0% |
| CVE-2023-2893 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-2894 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-2895 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-2896 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-3408 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing o | medium | 4.3 | 0% |
| CVE-2024-30457 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress | medium | 4.3 | 0% |
| CVE-2024-13146 | booknetic (WordPress plugin) | The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logge | high | 8.8 | 0% |
| CVE-2024-7688 | azindex (WordPress plugin) | The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin del | medium | 6.5 | 0% |
| CVE-2024-7817 | misiek-photo-album (WordPress plugin) | The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged i | medium | 6.5 | 0% |
| CVE-2022-38075 | mantenimiento-web (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPres | medium | 6.1 | 0% |
| CVE-2024-1213 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all | medium | 5.4 | 0% |
| CVE-2024-1214 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all | medium | 4.3 | 0% |
| CVE-2024-1489 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-13707 | wp-image-uploader (WordPress plugin) | The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is | high | 8.8 | 0% |
| CVE-2025-0393 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 6.1 | 0% |
| CVE-2024-2262 | woocommerce-product-filter (WordPress plugin) | Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users dele | medium | 4.7 | 0% |
| CVE-2023-7125 | peepso (WordPress plugin) | The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their p | medium | 4.3 | 0% |
| CVE-2026-2994 | concrete5/concrete5 | Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF) | low | 0.0 | 0% |
| CVE-2024-2857 | simple-buttons-creator (WordPress plugin) | The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowin | medium | 6.1 | 0% |
| CVE-2023-4246 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing | medium | 4.3 | 0% |
| CVE-2024-2113 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-6719 | offload-videos (WordPress plugin) | The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privil | high | 8.1 | 0% |
| CVE-2024-13356 | dsgvo-all-in-one-for-wp (WordPress plugin) | The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This | medium | 6.5 | 0% |
| CVE-2024-55945 | typo3/cms-lowlevel | TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-3590 | letterpress (WordPress plugin) | The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in user | medium | 6.1 | 0% |
| CVE-2024-54356 | online-booking-\&-scheduling-calendar (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vc | medium | 5.4 | 0% |
| CVE-2023-4059 | profile-builder (WordPress plugin) | The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated us | medium | 4.3 | 0% |
| CVE-2023-5383 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to | medium | 4.3 | 0% |
| CVE-2023-5818 | amazonify (WordPress plugin) | The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to m | medium | 4.3 | 0% |
| CVE-2024-0373 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 4.3 | 0% |
| CVE-2024-0374 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 4.3 | 0% |
| CVE-2024-0827 | play-ht (WordPress plugin) | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | 0% |
| CVE-2024-1162 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. T | medium | 4.3 | 0% |
| CVE-2024-6136 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make | medium | 5.4 | 0% |
| CVE-2023-4251 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2024-6628 | all-contact-form-integration-for-elementor (WordPress plugin) | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in al | medium | 4.3 | 0% |
| CVE-2024-8157 | alphabetical-list (WordPress plugin) | The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |