Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9233 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-8093 | posts-reminder (WordPress plugin) | The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 6.5 | 0% |
| CVE-2024-2969 | wp-eggdrop (WordPress plugin) | The WP-Eggdrop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to mi | medium | 5.4 | 0% |
| CVE-2024-3407 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users p | medium | 5.3 | 0% |
| CVE-2024-13683 | automate-hub-free-by-sperse-io (WordPress plugin) | The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2025-1320 | teachpress (WordPress plugin) | The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to | medium | 4.3 | 0% |
| CVE-2024-5081 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whi | medium | 6.1 | 0% |
| CVE-2024-6017 | music-request-manager (WordPress plugin) | The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escap | medium | 6.1 | 0% |
| CVE-2024-7816 | gixaw-chat (WordPress plugin) | The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 6.1 | 0% |
| CVE-2024-10892 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2024-7984 | joy-of-text (WordPress plugin) | The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2024-8082 | widgets-reset (WordPress plugin) | The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-8245 | gamipress---reset-user (WordPress plugin) | The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2025-0801 | ratemyagent-official (WordPress plugin) | The RateMyAgent Official plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This | medium | 4.3 | 0% |
| CVE-2024-2964 | pocket-news-generator (WordPress plugin) | The Pocket News Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.0. This | medium | 5.4 | 0% |
| CVE-2024-4529 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | medium | 5.0 | 0% |
| CVE-2024-2368 | mollie-forms (WordPress plugin) | The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due | medium | 4.3 | 0% |
| CVE-2024-7386 | wpdm-premium-packages (WordPress plugin) | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 4.3 | 0% |
| CVE-2024-8319 | tourfic (WordPress plugin) | The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to m | medium | 4.3 | 0% |
| CVE-2026-29113 | craftcms/cms | Craft CMS has a potential information disclosure vulnerability in preview tokens | low | 0.0 | 0% |
| CVE-2024-11607 | gtpayment-donations (WordPress plugin) | The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escap | medium | 6.1 | 0% |
| CVE-2024-8090 | javascript-logic (WordPress plugin) | The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, | medium | 6.1 | 0% |
| CVE-2023-2334 | easy-digital-downloads-google-sheet-connector (WordPress plugin), edd-gsheetconnector (WordPress plugin) | The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 | medium | 5.4 | 0% |
| CVE-2024-41811 | ipl/web | ipl/web's `ipl\Web\Common\CsrfCounterMeasure` is susceptible to CSRF | medium | 5.0 | 0% |
| CVE-2025-6459 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all ver | high | 8.8 | 0% |
| CVE-2025-2163 | zoorum-comments (WordPress plugin) | The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due | medium | 6.1 | 0% |
| CVE-2024-9709 | ekc-tournament-manager (WordPress plugin) | The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 5.4 | 0% |
| CVE-2024-9711 | ekc-tournament-manager (WordPress plugin) | The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 5.4 | 0% |
| CVE-2024-13795 | ecwid-shopping-cart (WordPress plugin) | The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-43269 | backup-and-restore-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: | medium | 4.3 | 0% |
| CVE-2024-4475 | wp-logs-book (WordPress plugin) | The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in | medium | 4.3 | 0% |
| CVE-2024-13774 | wish-list-for-woocommerce (WordPress plugin) | The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 6.1 | 0% |
| CVE-2024-9588 | wp-custom-taxonomy-meta (WordPress plugin) | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0 | medium | 5.4 | 0% |
| CVE-2024-7687 | azindex (WordPress plugin) | The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | medium | 4.3 | 0% |
| CVE-2024-12526 | arena-liveblog-and-chat-tool (WordPress plugin) | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, an | medium | 4.3 | 0% |
| CVE-2024-2395 | bulgarisation-for-woocommerce (WordPress plugin) | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0 | high | 7.3 | 0% |
| CVE-2025-31680 | drupal/matomo | This module enables you to add the Matomo web statistics tracking system to your website. The Matomo Analytics Tag Mana | medium | 6.8 | 0% |
| CVE-2025-31683 | drupal/google_tag | This module enables you to integrate the site with the Google Tag Manager (GTM) application. The module doesn't suffici | medium | 6.8 | 0% |
| CVE-2025-31684 | drupal/oauth2_client | This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth prote | medium | 6.8 | 0% |
| CVE-2023-7229 | illi-link-party\! (WordPress plugin) | The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 5.5 | 0% |
| CVE-2023-2447 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing | medium | 6.1 | 0% |
| CVE-2024-12282 | wp-connect (WordPress plugin) | The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, w | medium | 6.1 | 0% |
| CVE-2024-13115 | wp-projects-portfolio-with-client-testimonials (WordPress plugin) | The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sani | medium | 6.1 | 0% |
| CVE-2025-1382 | contact-us (WordPress plugin) | The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as es | medium | 6.1 | 0% |
| CVE-2024-1446 | social-networks-auto-poster-facebook-twitter-g (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc | medium | 5.4 | 0% |
| CVE-2024-4426 | comparison-slider (WordPress plugin) | The Comparison Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is | medium | 4.3 | 0% |
| CVE-2024-8050 | custom-author-base (WordPress plugin) | The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attack | medium | 4.3 | 0% |
| CVE-2024-8398 | simple-nav-archives (WordPress plugin) | The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attac | medium | 4.3 | 0% |
| CVE-2024-8477 | mailin (WordPress plugin) | The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Cross-Site Req | medium | 4.3 | 0% |
| CVE-2024-3246 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is | medium | 6.1 | 0% |