Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-7083 | voting-record (WordPress plugin) | The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whi | medium | 5.4 | 0% |
| CVE-2024-3058 | enl-newsletter (WordPress plugin) | The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, | medium | 5.4 | 0% |
| CVE-2024-12385 | wp-abstracts-manuscripts-manager (WordPress plugin) | The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due t | medium | 6.1 | 0% |
| CVE-2026-34613 | wwbn/avideo | AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins | medium | 6.5 | 0% |
| CVE-2024-8052 | review-ratings (WordPress plugin) | The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, wh | medium | 6.1 | 0% |
| CVE-2024-13555 | 1-click-migration (WordPress plugin) | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in al | medium | 5.3 | 0% |
| CVE-2024-3472 | modal-window (WordPress plugin) | The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to | medium | 5.9 | 0% |
| CVE-2024-3824 | base64-encoder\/decoder (WordPress plugin) | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow a | medium | 5.5 | 0% |
| CVE-2024-13518 | simplepress (WordPress plugin) | The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.12. This | medium | 4.3 | 0% |
| CVE-2025-1506 | wp-social (WordPress plugin) | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-3629 | hl-twitter (WordPress plugin) | The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers | low | 2.4 | 0% |
| CVE-2023-5519 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2023-6625 | product-enquiry-for-woocommerce (WordPress plugin) | The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could all | medium | 4.3 | 0% |
| CVE-2024-12280 | wp-customer-area (WordPress plugin) | The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-8091 | enhanced-search-box (WordPress plugin) | The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attac | medium | 6.5 | 0% |
| CVE-2015-10130 | circle-image-slider-with-lightbox (WordPress plugin) | The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to m | medium | 5.3 | 0% |
| CVE-2024-1592 | complianz-gdpr (WordPress plugin) | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1906 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due t | medium | 4.3 | 0% |
| CVE-2024-1907 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due t | medium | 4.3 | 0% |
| CVE-2024-1909 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due t | medium | 4.3 | 0% |
| CVE-2024-1910 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due t | medium | 4.3 | 0% |
| CVE-2024-1912 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due t | medium | 4.3 | 0% |
| CVE-2024-1976 | marketing-optimizer (WordPress plugin) | The Marketing Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20200925. Thi | medium | 4.3 | 0% |
| CVE-2024-4543 | snippet-shortcodes (WordPress plugin) | The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is | medium | 4.3 | 0% |
| CVE-2024-7820 | ilc-thickbox (WordPress plugin) | The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to m | medium | 6.5 | 0% |
| CVE-2024-7862 | blogintroduction-wordpress-plugin (WordPress plugin) | The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which cou | medium | 6.5 | 0% |
| CVE-2024-55920 | typo3/cms-dashboard | TYPO3 Cross-Site Request Forgery in Dashboard Module | medium | 4.3 | 0% |
| CVE-2024-55923 | typo3/cms-indexed-search | TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-7690 | dn-popup (WordPress plugin) | The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to mak | medium | 4.3 | 0% |
| CVE-2023-7297 | twitterposts (WordPress plugin) | The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to | low | 3.5 | 0% |
| CVE-2024-4534 | kkprogressbar2 (WordPress plugin) | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as es | medium | 6.1 | 0% |
| CVE-2024-3971 | similarity (WordPress plugin) | The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2025-0796 | wprequal (WordPress plugin) | The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2. | medium | 4.3 | 0% |
| CVE-2024-12279 | wp-fb-autoconnect (WordPress plugin) | The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This | medium | 6.1 | 0% |
| CVE-2023-6499 | lastunes (WordPress plugin) | The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 5.4 | 0% |
| CVE-2024-5003 | wp-stacker (WordPress plugin) | The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 5.4 | 0% |
| CVE-2024-10480 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2024-4969 | widget-bundle (WordPress plugin) | The Widget Bundle WordPress plugin through 2.0.0 does not have CSRF checks when logging Widgets, which could allow attackers to make logged | medium | 4.3 | 0% |
| CVE-2024-7689 | snapshot-backup (WordPress plugin) | The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, | medium | 4.3 | 0% |
| CVE-2025-2168 | ultimate-store-kit (WordPress plugin) | The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce | medium | 4.3 | 0% |
| CVE-2024-5030 | cm-table-of-contents (WordPress plugin) | The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow att | low | 3.8 | 0% |
| CVE-2024-3965 | pray-for-me (WordPress plugin) | The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 5.4 | 0% |
| CVE-2024-55922 | typo3/cms-form | TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery | medium | 5.4 | 0% |
| CVE-2024-13523 | memorialday (WordPress plugin) | The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to | medium | 6.1 | 0% |
| CVE-2024-4480 | prayer (WordPress plugin) | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its email settings, which could allow attack | medium | 6.1 | 0% |
| CVE-2024-6857 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, whi | medium | 4.3 | 0% |
| CVE-2024-6860 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow | medium | 4.3 | 0% |
| CVE-2023-6968 | the-moneytizer (WordPress plugin) | The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due | high | 8.1 | 0% |
| CVE-2022-4363 | wholesale-market (WordPress plugin), wholesale-market-for-woocommerce (WordPress plugin) | The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check | medium | 6.5 | 0% |
| CVE-2023-3409 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing o | medium | 5.4 | 0% |