Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-1924 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1925 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1926 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1927 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-3254 | wp-reviews-plugin-for-google (WordPress plugin) | The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This | medium | 4.3 | 0% |
| CVE-2023-48652 | concrete5/concrete5 | Concrete CMS Cross Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2024-12301 | jsp-store-locator (WordPress plugin) | The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in u | medium | 6.5 | 0% |
| CVE-2024-12774 | altra-side-menu (WordPress plugin) | The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in adm | medium | 6.5 | 0% |
| CVE-2023-6788 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu | medium | 5.4 | 0% |
| CVE-2024-1306 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in user | medium | 5.4 | 0% |
| CVE-2024-10045 | transients-manager (WordPress plugin) | The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is | medium | 4.3 | 0% |
| CVE-2024-3163 | easy-property-listings (WordPress plugin) | The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attacker | medium | 4.3 | 0% |
| CVE-2024-6925 | truebooker (WordPress plugin) | The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2024-8200 | reviews-feed (WordPress plugin) | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2024-9351 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | 0% |
| CVE-2024-9352 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | 0% |
| CVE-2024-9649 | wp-ulike (WordPress plugin) | The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2024-6720 | light-poll (WordPress plugin) | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |
| CVE-2024-13684 | reset (WordPress plugin) | The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing | high | 8.1 | 0% |
| CVE-2024-1231 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged | medium | 6.8 | 0% |
| CVE-2024-7647 | ota-sync-booking-engine-widget (WordPress plugin) | The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. | medium | 6.1 | 0% |
| CVE-2024-5029 | cm-table-of-contents (WordPress plugin) | The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as | medium | 4.8 | 0% |
| CVE-2023-6385 | wordpress-ping-optimizer (WordPress plugin) | The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2024-5028 | cm-search-and-replace (WordPress plugin) | The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attacke | medium | 6.5 | 0% |
| CVE-2024-8044 | infolinks-ad-wrap (WordPress plugin) | The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 0% |
| CVE-2025-2299 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. | medium | 6.1 | 0% |
| CVE-2024-1407 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.4 | 0% |
| CVE-2021-25117 | wp-postratings (WordPress plugin) | The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.ph | medium | 4.8 | 0% |
| CVE-2024-3582 | ungallery (WordPress plugin) | The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 4.8 | 0% |
| CVE-2024-0512 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-31430 | bear---woocommerce-bulk-editor-and-products-manager-professional (WordPress plugin), wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional, realmag777 BEAR – | medium | 4.3 | 0% |
| CVE-2024-3478 | herd-effects (WordPress plugin) | The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged i | medium | 6.1 | 0% |
| CVE-2024-0516 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability | medium | 5.3 | 0% |
| CVE-2023-51538 | awesome-support (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue aff | medium | 4.3 | 0% |
| CVE-2023-52119 | icegram-engage (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email | medium | 4.3 | 0% |
| CVE-2023-52128 | white-label (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.Thi | medium | 4.3 | 0% |
| CVE-2024-13883 | wpupper-share-buttons (WordPress plugin) | The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This | medium | 4.3 | 0% |
| CVE-2026-49992 | kimai/kimai | Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes | medium | 0.0 | 0% |
| CVE-2022-4014 | feehi/feehicms | Cross-Site Request Forgery in feehi/feehicms | medium | 4.3 | 0% |
| CVE-2024-3943 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to mi | medium | 4.3 | 0% |
| CVE-2024-3945 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to mi | medium | 4.3 | 0% |
| CVE-2024-3947 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to mi | medium | 4.3 | 0% |
| CVE-2024-9689 | post-from-frontend (WordPress plugin) | The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logg | medium | 4.3 | 0% |
| CVE-2024-12386 | wp-abstracts-manuscripts-manager (WordPress plugin) | The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due t | high | 8.1 | 0% |
| CVE-2023-6501 | splashscreen (WordPress plugin) | The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-11842 | shipping-by-weight-for-woocommerce (WordPress plugin) | The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which co | medium | 4.3 | 0% |
| CVE-2025-1383 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. | medium | 4.3 | 0% |
| CVE-2025-1441 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 6.1 | 0% |
| CVE-2022-30705 | wordpress-ping-optimizer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions. | medium | 5.4 | 0% |
| CVE-2023-25706 | better-robots.txt (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Pagup WordPress Robots.Txt optimization plugin <= 1.4.5 versions. | medium | 5.4 | 0% |