Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5285 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attack | medium | 5.5 | 0% |
| CVE-2024-12414 | themify-store-locator (WordPress plugin) | The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This | medium | 4.3 | 0% |
| CVE-2024-6852 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2024-6855 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make | medium | 4.3 | 0% |
| CVE-2024-6856 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2025-8891 | oceanwp (WordPress plugin) | The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect | medium | 4.3 | 0% |
| CVE-2023-31218 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Edito | high | 7.1 | 0% |
| CVE-2024-3903 | add-custom-css-and-js (WordPress plugin) | The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as esca | high | 7.1 | 0% |
| CVE-2024-9943 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 6.3 | 0% |
| CVE-2023-5532 | imagemapper (WordPress plugin) | The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to mis | medium | 6.1 | 0% |
| CVE-2024-0660 | formidable (WordPress plugin) | The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cros | medium | 6.1 | 0% |
| CVE-2024-5155 | inquiry-cart (WordPress plugin) | The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, wh | medium | 6.1 | 0% |
| CVE-2024-1360 | colibri (WordPress theme) | The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to | medium | 4.3 | 0% |
| CVE-2024-1361 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. Thi | medium | 4.3 | 0% |
| CVE-2024-1362 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. Thi | medium | 4.3 | 0% |
| CVE-2024-41597 | processwire/processwire | ProcessWire Cross Site Request Forgery vulnerability | medium | 4.2 | 0% |
| CVE-2024-5287 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow atta | high | 7.1 | 0% |
| CVE-2024-5280 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as esca | medium | 4.7 | 0% |
| CVE-2025-0522 | likebot (WordPress plugin) | The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | medium | 4.7 | 0% |
| CVE-2024-2959 | svs-pricing-tables (WordPress plugin) | The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is | medium | 4.3 | 0% |
| CVE-2024-2960 | svs-pricing-tables (WordPress plugin) | The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is | medium | 4.3 | 0% |
| CVE-2024-3631 | hl-twitter (WordPress plugin) | The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2024-4751 | prayer (WordPress plugin) | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-7892 | adstxt (WordPress plugin) | The adstxt Plugin WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 4.3 | 0% |
| CVE-2023-32960 | updraftplus (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions lea | high | 7.1 | 0% |
| CVE-2024-1943 | yuki (WordPress theme) | The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing | medium | 4.3 | 0% |
| CVE-2024-4382 | commonsbooking (WordPress plugin) | The CB (legacy) WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged | medium | 6.5 | 0% |
| CVE-2023-1472 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 6.3 | 0% |
| CVE-2024-4530 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | medium | 6.3 | 0% |
| CVE-2024-5033 | sully (WordPress plugin) | The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which coul | medium | 5.9 | 0% |
| CVE-2023-7048 | mystickymenu (WordPress plugin) | The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due | low | 3.1 | 0% |
| CVE-2025-31689 | drupal/gdpr | The GDPR Task submodule enables you to create GDPR tasks. The module doesn't sufficiently protect against Cross Site Re | high | 8.1 | 0% |
| CVE-2023-3055 | page-builder-by-azexo (WordPress plugin) | The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This | medium | 6.1 | 0% |
| CVE-2024-22304 | freshmail-for-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a | medium | 5.4 | 0% |
| CVE-2024-24887 | contest-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Shar | medium | 5.4 | 0% |
| CVE-2023-4628 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ladiflow_save_hook() functi | medium | 4.3 | 0% |
| CVE-2023-4629 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the save_config() function in v | medium | 4.3 | 0% |
| CVE-2023-4729 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the publish_lp() function hooke | medium | 4.3 | 0% |
| CVE-2023-7195 | wp-reply-notify (WordPress plugin) | The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2023-7196 | ultimate-noindex-nofollow-tool (WordPress plugin) | The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could | medium | 4.3 | 0% |
| CVE-2024-0513 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-0515 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1335 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1336 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1338 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1339 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-2326 | pretty-link (WordPress plugin) | The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request | medium | 4.3 | 0% |
| CVE-2024-43117 | hummingbird (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This is | medium | 4.3 | 0% |
| CVE-2024-49627 | wordpress-image-seo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Noor Alam WordPress Image SEO allows Cross Site Request Forgery.This issue affects WordPr | medium | 4.3 | 0% |
| CVE-2024-50466 | darkmysite (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross S | medium | 4.3 | 0% |