Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-37391 | wordpress-mobile-pack (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid | medium | 5.4 | 0% |
| CVE-2023-34029 | disable-wordpress-update-notifications-and-auto-update-email-notifications (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications pl | medium | 4.3 | 0% |
| CVE-2023-34185 | wordpress-nextgen-galleryview (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions. | medium | 4.3 | 0% |
| CVE-2024-12436 | wp-customer-area (WordPress plugin) | The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2023-6529 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users | medium | 6.1 | 0% |
| CVE-2023-2919 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missi | medium | 4.3 | 0% |
| CVE-2024-5808 | wp-ajax-contact-form (WordPress plugin) | The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which co | medium | 4.3 | 0% |
| CVE-2024-3823 | base64-encoder\/decoder (WordPress plugin) | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation a | low | 2.4 | 0% |
| CVE-2023-5982 | updraftplus (WordPress plugin) | The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, | medium | 5.4 | 0% |
| CVE-2023-25170 | prestashop/prestashop | Possible CSRF token fixation | medium | 5.0 | 0% |
| CVE-2023-6633 | side-notes (WordPress plugin) | The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make | medium | 4.3 | 0% |
| CVE-2024-10521 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including | medium | 4.3 | 0% |
| CVE-2024-1503 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, | medium | 4.3 | 0% |
| CVE-2023-7203 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as l | medium | 6.1 | 0% |
| CVE-2023-6292 | ecwid-ecommerce-shopping-cart (WordPress plugin) | The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could a | medium | 4.3 | 0% |
| CVE-2024-5077 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 6.8 | 0% |
| CVE-2023-6197 | audio-merchant (WordPress plugin) | The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due | medium | 5.4 | 0% |
| CVE-2023-4000 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. | medium | 6.3 | 0% |
| CVE-2024-12545 | scratch-win-giveaways-for-website-facebook (WordPress plugin) | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vu | medium | 5.4 | 0% |
| CVE-2023-2285 | wp-security-audit-log (WordPress plugin) | The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This i | medium | 4.3 | 0% |
| CVE-2024-2110 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2023-6503 | wp-plugin-lister (WordPress plugin) | The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping | medium | 5.4 | 0% |
| CVE-2024-8094 | ntz-atispam (WordPress plugin) | The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 6.5 | 0% |
| CVE-2024-8286 | gdpr-cookie-consent (WordPress plugin) | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers | medium | 6.5 | 0% |
| CVE-2024-1954 | oliver-pos (WordPress plugin) | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a | medium | 6.3 | 0% |
| CVE-2024-5285 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attack | medium | 5.5 | 0% |
| CVE-2024-12414 | themify-store-locator (WordPress plugin) | The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This | medium | 4.3 | 0% |
| CVE-2024-6852 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2024-6855 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make | medium | 4.3 | 0% |
| CVE-2024-6856 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2025-8891 | oceanwp (WordPress plugin) | The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect | medium | 4.3 | 0% |
| CVE-2023-31218 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Edito | high | 7.1 | 0% |
| CVE-2024-3903 | add-custom-css-and-js (WordPress plugin) | The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as esca | high | 7.1 | 0% |
| CVE-2024-9943 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 6.3 | 0% |
| CVE-2023-5532 | imagemapper (WordPress plugin) | The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to mis | medium | 6.1 | 0% |
| CVE-2024-0660 | formidable (WordPress plugin) | The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cros | medium | 6.1 | 0% |
| CVE-2024-5155 | inquiry-cart (WordPress plugin) | The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, wh | medium | 6.1 | 0% |
| CVE-2024-1360 | colibri (WordPress theme) | The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to | medium | 4.3 | 0% |
| CVE-2024-1361 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. Thi | medium | 4.3 | 0% |
| CVE-2024-1362 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. Thi | medium | 4.3 | 0% |
| CVE-2024-41597 | processwire/processwire | ProcessWire Cross Site Request Forgery vulnerability | medium | 4.2 | 0% |
| CVE-2024-5287 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow atta | high | 7.1 | 0% |
| CVE-2024-5280 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as esca | medium | 4.7 | 0% |
| CVE-2025-0522 | likebot (WordPress plugin) | The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | medium | 4.7 | 0% |
| CVE-2024-2959 | svs-pricing-tables (WordPress plugin) | The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is | medium | 4.3 | 0% |
| CVE-2024-2960 | svs-pricing-tables (WordPress plugin) | The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is | medium | 4.3 | 0% |
| CVE-2024-3631 | hl-twitter (WordPress plugin) | The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2024-4751 | prayer (WordPress plugin) | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-7892 | adstxt (WordPress plugin) | The adstxt Plugin WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 4.3 | 0% |
| CVE-2023-32960 | updraftplus (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions lea | high | 7.1 | 0% |