Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6984 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 5.3 | 0% |
| CVE-2023-6493 | depicter (WordPress plugin) | The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery i | medium | 4.3 | 0% |
| CVE-2024-0511 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-13337 | clearfy (WordPress plugin) | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request For | medium | 4.3 | 0% |
| CVE-2024-1777 | admin-side-data-storage-for-contact-form-7 (WordPress plugin) | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i | medium | 4.3 | 0% |
| CVE-2025-31688 | drupal/config_split | This module enables you to create super sets of configuration and enable them conditionally, for example have some modul | medium | 6.8 | 0% |
| CVE-2024-7574 | christmasify (WordPress plugin) | The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to m | medium | 6.1 | 0% |
| CVE-2024-9450 | easync (WordPress plugin) | The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updat | medium | 6.5 | 0% |
| CVE-2025-1530 | tripetto (WordPress plugin) | The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to mi | medium | 4.3 | 0% |
| CVE-2024-8092 | accordion-image-menu (WordPress plugin) | The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as esca | medium | 5.4 | 0% |
| CVE-2024-8120 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.7 | 0% |
| CVE-2024-13118 | ip-based-login (WordPress plugin) | The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in use | medium | 4.3 | 0% |
| CVE-2024-2040 | himer (WordPress plugin) | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private grou | medium | 4.3 | 0% |
| CVE-2024-2233 | himer (WordPress plugin) | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform | medium | 4.3 | 0% |
| CVE-2024-2235 | himer (WordPress plugin) | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls | medium | 4.3 | 0% |
| CVE-2023-7174 | abitgone-commentsafe (WordPress plugin) | The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as esca | high | 7.1 | 0% |
| CVE-2024-2858 | simple-buttons-creator (WordPress plugin) | The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logge | medium | 4.8 | 0% |
| CVE-2024-3993 | azan (WordPress plugin) | The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 4.6 | 0% |
| CVE-2024-1747 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any au | medium | 6.5 | 0% |
| CVE-2025-65960 | contao/core-bundle | Contao is vulnerable to remote code execution in template closures | medium | 6.6 | 0% |
| CVE-2024-12005 | wp-bibtex (WordPress plugin) | The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to m | medium | 6.1 | 0% |
| CVE-2024-8051 | special-feed-items (WordPress plugin) | The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escapi | medium | 5.4 | 0% |
| CVE-2024-10634 | nokaut-offers-box (WordPress plugin) | The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2024-10677 | blue-trait-event-viewer (WordPress plugin) | The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a | medium | 4.3 | 0% |
| CVE-2024-11373 | connexion-logs (WordPress plugin) | The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2024-12750 | competition-form (WordPress plugin) | The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2024-9233 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-8093 | posts-reminder (WordPress plugin) | The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 6.5 | 0% |
| CVE-2024-2969 | wp-eggdrop (WordPress plugin) | The WP-Eggdrop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to mi | medium | 5.4 | 0% |
| CVE-2024-3407 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users p | medium | 5.3 | 0% |
| CVE-2024-13683 | automate-hub-free-by-sperse-io (WordPress plugin) | The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2025-1320 | teachpress (WordPress plugin) | The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to | medium | 4.3 | 0% |
| CVE-2024-5081 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whi | medium | 6.1 | 0% |
| CVE-2024-6017 | music-request-manager (WordPress plugin) | The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escap | medium | 6.1 | 0% |
| CVE-2024-7816 | gixaw-chat (WordPress plugin) | The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 6.1 | 0% |
| CVE-2024-10892 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2024-7984 | joy-of-text (WordPress plugin) | The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2024-8082 | widgets-reset (WordPress plugin) | The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-8245 | gamipress---reset-user (WordPress plugin) | The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2025-0801 | ratemyagent-official (WordPress plugin) | The RateMyAgent Official plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This | medium | 4.3 | 0% |
| CVE-2024-2964 | pocket-news-generator (WordPress plugin) | The Pocket News Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.0. This | medium | 5.4 | 0% |
| CVE-2024-4529 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | medium | 5.0 | 0% |
| CVE-2024-2368 | mollie-forms (WordPress plugin) | The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due | medium | 4.3 | 0% |
| CVE-2024-7386 | wpdm-premium-packages (WordPress plugin) | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 4.3 | 0% |
| CVE-2024-8319 | tourfic (WordPress plugin) | The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to m | medium | 4.3 | 0% |
| CVE-2026-29113 | craftcms/cms | Craft CMS has a potential information disclosure vulnerability in preview tokens | low | 0.0 | 0% |
| CVE-2024-11607 | gtpayment-donations (WordPress plugin) | The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escap | medium | 6.1 | 0% |
| CVE-2024-8090 | javascript-logic (WordPress plugin) | The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, | medium | 6.1 | 0% |
| CVE-2023-2334 | easy-digital-downloads-google-sheet-connector (WordPress plugin), edd-gsheetconnector (WordPress plugin) | The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 | medium | 5.4 | 0% |
| CVE-2024-41811 | ipl/web | ipl/web's `ipl\Web\Common\CsrfCounterMeasure` is susceptible to CSRF | medium | 5.0 | 0% |