Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1214 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all | medium | 4.3 | 0% |
| CVE-2024-1489 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-13707 | wp-image-uploader (WordPress plugin) | The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is | high | 8.8 | 0% |
| CVE-2025-0393 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 6.1 | 0% |
| CVE-2024-2262 | woocommerce-product-filter (WordPress plugin) | Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users dele | medium | 4.7 | 0% |
| CVE-2023-7125 | peepso (WordPress plugin) | The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their p | medium | 4.3 | 0% |
| CVE-2026-2994 | concrete5/concrete5 | Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF) | low | 0.0 | 0% |
| CVE-2024-2857 | simple-buttons-creator (WordPress plugin) | The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowin | medium | 6.1 | 0% |
| CVE-2023-4246 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing | medium | 4.3 | 0% |
| CVE-2024-2113 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-6719 | offload-videos (WordPress plugin) | The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privil | high | 8.1 | 0% |
| CVE-2024-13356 | dsgvo-all-in-one-for-wp (WordPress plugin) | The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This | medium | 6.5 | 0% |
| CVE-2024-55945 | typo3/cms-lowlevel | TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-3590 | letterpress (WordPress plugin) | The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in user | medium | 6.1 | 0% |
| CVE-2024-54356 | online-booking-\&-scheduling-calendar (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vc | medium | 5.4 | 0% |
| CVE-2023-4059 | profile-builder (WordPress plugin) | The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated us | medium | 4.3 | 0% |
| CVE-2023-5383 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to | medium | 4.3 | 0% |
| CVE-2023-5818 | amazonify (WordPress plugin) | The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to m | medium | 4.3 | 0% |
| CVE-2024-0373 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 4.3 | 0% |
| CVE-2024-0374 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 4.3 | 0% |
| CVE-2024-0827 | play-ht (WordPress plugin) | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | 0% |
| CVE-2024-1162 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. T | medium | 4.3 | 0% |
| CVE-2024-6136 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make | medium | 5.4 | 0% |
| CVE-2023-4251 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2024-6628 | all-contact-form-integration-for-elementor (WordPress plugin) | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in al | medium | 4.3 | 0% |
| CVE-2024-8157 | alphabetical-list (WordPress plugin) | The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2024-8476 | easy-paypal-events-tickets (WordPress plugin) | The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is | medium | 4.3 | 0% |
| CVE-2026-23622 | alextselegidis/easyappointments | alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass | high | 0.0 | 0% |
| CVE-2023-2892 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 6.5 | 0% |
| CVE-2025-5142 | simple-page-access-restriction (WordPress plugin) | The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. | medium | 6.5 | 0% |
| CVE-2023-5534 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is d | medium | 4.3 | 0% |
| CVE-2024-8047 | visual-sound (WordPress plugin) | The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 0% |
| CVE-2022-45847 | countdown-widget (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.Me WordPress Countdown Widget allows Cross-Site Scripting (XSS).This issue affec | medium | 6.1 | 0% |
| CVE-2022-38468 | nextgen-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail al | medium | 4.3 | 0% |
| CVE-2023-6243 | eventon-lite (WordPress plugin) | The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u | medium | 4.3 | 0% |
| CVE-2024-3972 | similarity (WordPress plugin) | The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 4.3 | 0% |
| CVE-2024-6853 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2024-3471 | button-generator (WordPress plugin) | The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make | low | 3.4 | 0% |
| CVE-2024-6490 | master-slider (WordPress plugin) | During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to m | medium | 6.5 | 0% |
| CVE-2023-7202 | fatal-error-notify (WordPress plugin) | The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any | medium | 6.1 | 0% |
| CVE-2024-45270 | carousel-slider (WordPress plugin) | WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feat | medium | 4.3 | 0% |
| CVE-2025-31677 | drupal/ai | The Drupal AI module provides a framework for easily integrating Artificial Intelligence on any Drupal site using any ki | high | 8.8 | 0% |
| CVE-2025-31690 | drupal/cache_utility | The Cache Utility module provides an ability to view status and flush various caches. The module doesn't sufficiently p | high | 8.8 | 0% |
| CVE-2024-0667 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 5.4 | 0% |
| CVE-2023-1918 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1919 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1920 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1921 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1922 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1923 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |