Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8476 | easy-paypal-events-tickets (WordPress plugin) | The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is | medium | 4.3 | 0% |
| CVE-2026-23622 | alextselegidis/easyappointments | alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass | high | 0.0 | 0% |
| CVE-2023-2892 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 6.5 | 0% |
| CVE-2025-5142 | simple-page-access-restriction (WordPress plugin) | The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. | medium | 6.5 | 0% |
| CVE-2023-5534 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is d | medium | 4.3 | 0% |
| CVE-2024-8047 | visual-sound (WordPress plugin) | The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 0% |
| CVE-2022-45847 | countdown-widget (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.Me WordPress Countdown Widget allows Cross-Site Scripting (XSS).This issue affec | medium | 6.1 | 0% |
| CVE-2022-38468 | nextgen-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail al | medium | 4.3 | 0% |
| CVE-2023-6243 | eventon-lite (WordPress plugin) | The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u | medium | 4.3 | 0% |
| CVE-2024-3972 | similarity (WordPress plugin) | The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 4.3 | 0% |
| CVE-2024-6853 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2024-3471 | button-generator (WordPress plugin) | The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make | low | 3.4 | 0% |
| CVE-2024-6490 | master-slider (WordPress plugin) | During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to m | medium | 6.5 | 0% |
| CVE-2023-7202 | fatal-error-notify (WordPress plugin) | The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any | medium | 6.1 | 0% |
| CVE-2024-45270 | carousel-slider (WordPress plugin) | WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feat | medium | 4.3 | 0% |
| CVE-2025-31677 | drupal/ai | The Drupal AI module provides a framework for easily integrating Artificial Intelligence on any Drupal site using any ki | high | 8.8 | 0% |
| CVE-2025-31690 | drupal/cache_utility | The Cache Utility module provides an ability to view status and flush various caches. The module doesn't sufficiently p | high | 8.8 | 0% |
| CVE-2024-0667 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 5.4 | 0% |
| CVE-2023-1918 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1919 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1920 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1921 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1922 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1923 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1924 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1925 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1926 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1927 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-3254 | wp-reviews-plugin-for-google (WordPress plugin) | The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This | medium | 4.3 | 0% |
| CVE-2023-48652 | concrete5/concrete5 | Concrete CMS Cross Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2024-12301 | jsp-store-locator (WordPress plugin) | The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in u | medium | 6.5 | 0% |
| CVE-2024-12774 | altra-side-menu (WordPress plugin) | The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in adm | medium | 6.5 | 0% |
| CVE-2023-6788 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu | medium | 5.4 | 0% |
| CVE-2024-1306 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in user | medium | 5.4 | 0% |
| CVE-2024-10045 | transients-manager (WordPress plugin) | The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is | medium | 4.3 | 0% |
| CVE-2024-3163 | easy-property-listings (WordPress plugin) | The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attacker | medium | 4.3 | 0% |
| CVE-2024-6925 | truebooker (WordPress plugin) | The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2024-8200 | reviews-feed (WordPress plugin) | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2024-9351 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | 0% |
| CVE-2024-9352 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | 0% |
| CVE-2024-9649 | wp-ulike (WordPress plugin) | The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2024-6720 | light-poll (WordPress plugin) | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |
| CVE-2024-13684 | reset (WordPress plugin) | The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing | high | 8.1 | 0% |
| CVE-2024-1231 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged | medium | 6.8 | 0% |
| CVE-2024-7647 | ota-sync-booking-engine-widget (WordPress plugin) | The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. | medium | 6.1 | 0% |
| CVE-2024-5029 | cm-table-of-contents (WordPress plugin) | The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as | medium | 4.8 | 0% |
| CVE-2023-6385 | wordpress-ping-optimizer (WordPress plugin) | The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2024-5028 | cm-search-and-replace (WordPress plugin) | The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attacke | medium | 6.5 | 0% |
| CVE-2024-8044 | infolinks-ad-wrap (WordPress plugin) | The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 0% |
| CVE-2025-2299 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. | medium | 6.1 | 0% |