Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-0590 | microsoft-clarity (WordPress plugin) | The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is | medium | 6.1 | 1% |
| CVE-2020-6849 | marketo-forms-and-tracking (WordPress plugin) | The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS. | high | 8.8 | 1% |
| CVE-2022-1421 | discy (WordPress plugin) | The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary | medium | 4.3 | 1% |
| CVE-2008-0198 | wp-contactform (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and ea | medium | 4.3 | 1% |
| CVE-2015-4697 | google-analyticator (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563. | high | 8.8 | 1% |
| CVE-2021-24161 | responsive-menu (WordPress plugin) | In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploadi | high | 8.8 | 1% |
| CVE-2014-100001 | liveoptim (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers t | medium | 6.8 | 1% |
| CVE-2012-3384 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentica | medium | 6.8 | 1% |
| CVE-2015-1614 | image-metadata-cruncher (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hij | medium | 6.8 | 1% |
| CVE-2015-2039 | acobot-live-chat-\&-contact-form (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote atta | medium | 6.8 | 1% |
| CVE-2013-3253 | xhanch-my-twitter (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows rem | medium | 6.8 | 1% |
| CVE-2020-13426 | multi-scheduler (WordPress plugin) | The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the | medium | 6.5 | 1% |
| CVE-2013-2700 | wp125 (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows | medium | 6.8 | 1% |
| CVE-2015-6523 | portfolio-by-lisa-westlund (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the auth | medium | 6.8 | 1% |
| CVE-2014-9413 | simple-ip-ban (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the IP Ban (simple-ip-ban) plugin 1.2.3 for WordPress allow remote attackers t | medium | 6.8 | 1% |
| CVE-2014-9454 | simple-sticky-footer (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer plugin before 1.3.3 for WordPress allow remote attack | medium | 6.8 | 1% |
| CVE-2014-9524 | cardoza-facebook-like-box (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Facebook Like Box (cardoza-facebook-like-box) plugin before 2.8.3 for Word | medium | 6.8 | 1% |
| CVE-2019-11590 | form-maker (WordPress plugin) | The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local f | high | 8.8 | 1% |
| CVE-2014-7957 | pods (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the | medium | 6.8 | 1% |
| CVE-2020-11497 | nab-transact (WordPress plugin) | An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows | high | 7.5 | 1% |
| CVE-2014-9334 | bird-feeder (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack th | medium | 6.8 | 1% |
| CVE-2014-9460 | wp-vipergb (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hi | medium | 6.8 | 1% |
| CVE-2015-0920 | banner-effect-header (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the | medium | 6.8 | 1% |
| CVE-2012-4448 | WordPress core | Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authenticatio | medium | 6.8 | 1% |
| CVE-2015-4140 | wp-smiley (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentica | medium | 6.8 | 1% |
| CVE-2016-3734 | moodle/moodle | Moodle Cross-site request forgery (CSRF) vulnerability | high | 8.8 | 1% |
| CVE-2013-2699 | underconstruction (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2019-12826 | widget-logic (WordPress plugin) | A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows | high | 8.8 | 1% |
| CVE-2015-9408 | xpinner-lite (WordPress plugin) | The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS. | medium | 6.5 | 1% |
| CVE-2015-9409 | alo-easymail (WordPress plugin) | The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php. | medium | 6.5 | 1% |
| CVE-2015-9413 | eshop (WordPress plugin) | The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title paramete | medium | 6.5 | 1% |
| CVE-2015-9427 | googmonify (WordPress plugin) | The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID o | medium | 6.5 | 1% |
| CVE-2019-10186 | moodle/moodle | Moodle CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2020-9454 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a | high | 8.8 | 1% |
| CVE-2013-3252 | wp-postviews (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote | medium | 6.8 | 1% |
| CVE-2022-2441 | imagemagick-engine (WordPress plugin) | The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and inclu | high | 8.8 | 1% |
| CVE-2013-2693 | wp-print (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Options in the WP-Print plugin before 2.52 for WordPress allows remote attackers to h | medium | 6.8 | 1% |
| CVE-2020-28040 | WordPress core | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. | medium | 4.3 | 1% |
| CVE-2014-5034 | brute-force-login-protection (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hija | high | 8.8 | 1% |
| CVE-2013-2705 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote a | medium | 6.8 | 1% |
| CVE-2014-3882 | login-rebuilder (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Login rebuilder plugin before 1.2.0 for WordPress allows remote attackers to hijack t | medium | 6.8 | 1% |
| CVE-2015-0895 | all-in-one-wp-security-and-firewall (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote att | medium | 6.8 | 1% |
| CVE-2013-2698 | calendar (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the auth | medium | 6.8 | 1% |
| CVE-2013-3257 | related-posts (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the | medium | 6.8 | 1% |
| CVE-2013-3258 | digg-digg (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the auth | medium | 6.8 | 1% |
| CVE-2013-3476 | wordpress-23-related-posts-plugin (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts plugin before 2.6.2 for WordPress allows remote attackers to | medium | 6.8 | 1% |
| CVE-2013-3477 | related-posts-by-zemanta (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Related Posts by Zemanta plugin before 1.3.2 for WordPress allows remote attackers to | medium | 6.8 | 1% |
| CVE-2014-3907 | wysija-newsletters (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 for WordPress allows r | medium | 6.8 | 1% |
| CVE-2015-9445 | unite-gallery-lite (WordPress plugin) | The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action | high | 8.8 | 1% |
| CVE-2018-19969 | phpmyadmin/phpmyadmin | phpMyAdmin CSRF Vulnerability | high | 8.8 | 1% |