Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1407 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.4 | 0% |
| CVE-2021-25117 | wp-postratings (WordPress plugin) | The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.ph | medium | 4.8 | 0% |
| CVE-2024-3582 | ungallery (WordPress plugin) | The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 4.8 | 0% |
| CVE-2024-0512 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-31430 | bear---woocommerce-bulk-editor-and-products-manager-professional (WordPress plugin), wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional, realmag777 BEAR – | medium | 4.3 | 0% |
| CVE-2024-3478 | herd-effects (WordPress plugin) | The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged i | medium | 6.1 | 0% |
| CVE-2024-0516 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability | medium | 5.3 | 0% |
| CVE-2023-51538 | awesome-support (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue aff | medium | 4.3 | 0% |
| CVE-2023-52119 | icegram-engage (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email | medium | 4.3 | 0% |
| CVE-2023-52128 | white-label (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.Thi | medium | 4.3 | 0% |
| CVE-2024-13883 | wpupper-share-buttons (WordPress plugin) | The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This | medium | 4.3 | 0% |
| CVE-2026-49992 | kimai/kimai | Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes | medium | 0.0 | 0% |
| CVE-2022-4014 | feehi/feehicms | Cross-Site Request Forgery in feehi/feehicms | medium | 4.3 | 0% |
| CVE-2024-3943 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to mi | medium | 4.3 | 0% |
| CVE-2024-3945 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to mi | medium | 4.3 | 0% |
| CVE-2024-3947 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to mi | medium | 4.3 | 0% |
| CVE-2024-9689 | post-from-frontend (WordPress plugin) | The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logg | medium | 4.3 | 0% |
| CVE-2024-12386 | wp-abstracts-manuscripts-manager (WordPress plugin) | The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due t | high | 8.1 | 0% |
| CVE-2023-6501 | splashscreen (WordPress plugin) | The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-11842 | shipping-by-weight-for-woocommerce (WordPress plugin) | The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which co | medium | 4.3 | 0% |
| CVE-2025-1383 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. | medium | 4.3 | 0% |
| CVE-2025-1441 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 6.1 | 0% |
| CVE-2022-30705 | wordpress-ping-optimizer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions. | medium | 5.4 | 0% |
| CVE-2023-25706 | better-robots.txt (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Pagup WordPress Robots.Txt optimization plugin <= 1.4.5 versions. | medium | 5.4 | 0% |
| CVE-2023-37391 | wordpress-mobile-pack (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid | medium | 5.4 | 0% |
| CVE-2023-34029 | disable-wordpress-update-notifications-and-auto-update-email-notifications (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications pl | medium | 4.3 | 0% |
| CVE-2023-34185 | wordpress-nextgen-galleryview (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions. | medium | 4.3 | 0% |
| CVE-2024-12436 | wp-customer-area (WordPress plugin) | The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2023-6529 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users | medium | 6.1 | 0% |
| CVE-2023-2919 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missi | medium | 4.3 | 0% |
| CVE-2024-5808 | wp-ajax-contact-form (WordPress plugin) | The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which co | medium | 4.3 | 0% |
| CVE-2024-3823 | base64-encoder\/decoder (WordPress plugin) | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation a | low | 2.4 | 0% |
| CVE-2023-5982 | updraftplus (WordPress plugin) | The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, | medium | 5.4 | 0% |
| CVE-2023-25170 | prestashop/prestashop | Possible CSRF token fixation | medium | 5.0 | 0% |
| CVE-2023-6633 | side-notes (WordPress plugin) | The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make | medium | 4.3 | 0% |
| CVE-2024-10521 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including | medium | 4.3 | 0% |
| CVE-2024-1503 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, | medium | 4.3 | 0% |
| CVE-2023-7203 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as l | medium | 6.1 | 0% |
| CVE-2023-6292 | ecwid-ecommerce-shopping-cart (WordPress plugin) | The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could a | medium | 4.3 | 0% |
| CVE-2024-5077 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 6.8 | 0% |
| CVE-2023-6197 | audio-merchant (WordPress plugin) | The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due | medium | 5.4 | 0% |
| CVE-2025-3479 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions u | medium | 5.3 | 0% |
| CVE-2023-4000 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. | medium | 6.3 | 0% |
| CVE-2024-12545 | scratch-win-giveaways-for-website-facebook (WordPress plugin) | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vu | medium | 5.4 | 0% |
| CVE-2023-2285 | wp-security-audit-log (WordPress plugin) | The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This i | medium | 4.3 | 0% |
| CVE-2024-2110 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2023-6503 | wp-plugin-lister (WordPress plugin) | The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping | medium | 5.4 | 0% |
| CVE-2024-8094 | ntz-atispam (WordPress plugin) | The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 6.5 | 0% |
| CVE-2024-8286 | gdpr-cookie-consent (WordPress plugin) | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers | medium | 6.5 | 0% |
| CVE-2024-1954 | oliver-pos (WordPress plugin) | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a | medium | 6.3 | 0% |