Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-6459 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all ver | high | 8.8 | 0% |
| CVE-2025-2163 | zoorum-comments (WordPress plugin) | The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due | medium | 6.1 | 0% |
| CVE-2024-9709 | ekc-tournament-manager (WordPress plugin) | The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 5.4 | 0% |
| CVE-2024-9711 | ekc-tournament-manager (WordPress plugin) | The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 5.4 | 0% |
| CVE-2024-13795 | ecwid-shopping-cart (WordPress plugin) | The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-43269 | backup-and-restore-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: | medium | 4.3 | 0% |
| CVE-2024-4475 | wp-logs-book (WordPress plugin) | The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in | medium | 4.3 | 0% |
| CVE-2024-13774 | wish-list-for-woocommerce (WordPress plugin) | The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 6.1 | 0% |
| CVE-2024-9588 | wp-custom-taxonomy-meta (WordPress plugin) | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0 | medium | 5.4 | 0% |
| CVE-2024-7687 | azindex (WordPress plugin) | The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | medium | 4.3 | 0% |
| CVE-2025-47939 | typo3/cms-core | TYPO3 Allows Unrestricted File Upload in File Abstraction Layer | medium | 5.4 | 0% |
| CVE-2024-12526 | arena-liveblog-and-chat-tool (WordPress plugin) | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, an | medium | 4.3 | 0% |
| CVE-2024-2395 | bulgarisation-for-woocommerce (WordPress plugin) | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0 | high | 7.3 | 0% |
| CVE-2025-31680 | drupal/matomo | This module enables you to add the Matomo web statistics tracking system to your website. The Matomo Analytics Tag Mana | medium | 6.8 | 0% |
| CVE-2025-31683 | drupal/google_tag | This module enables you to integrate the site with the Google Tag Manager (GTM) application. The module doesn't suffici | medium | 6.8 | 0% |
| CVE-2025-31684 | drupal/oauth2_client | This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth prote | medium | 6.8 | 0% |
| CVE-2023-7229 | illi-link-party\! (WordPress plugin) | The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 5.5 | 0% |
| CVE-2023-2447 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing | medium | 6.1 | 0% |
| CVE-2024-12282 | wp-connect (WordPress plugin) | The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, w | medium | 6.1 | 0% |
| CVE-2024-13115 | wp-projects-portfolio-with-client-testimonials (WordPress plugin) | The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sani | medium | 6.1 | 0% |
| CVE-2025-1382 | contact-us (WordPress plugin) | The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as es | medium | 6.1 | 0% |
| CVE-2024-1446 | social-networks-auto-poster-facebook-twitter-g (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc | medium | 5.4 | 0% |
| CVE-2024-4426 | comparison-slider (WordPress plugin) | The Comparison Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is | medium | 4.3 | 0% |
| CVE-2024-8050 | custom-author-base (WordPress plugin) | The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attack | medium | 4.3 | 0% |
| CVE-2024-8398 | simple-nav-archives (WordPress plugin) | The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attac | medium | 4.3 | 0% |
| CVE-2024-8477 | mailin (WordPress plugin) | The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Cross-Site Req | medium | 4.3 | 0% |
| CVE-2024-3246 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is | medium | 6.1 | 0% |
| CVE-2025-3635 | moodle/moodle | Moodle has a CSRF risk in user tours manager that allows tour duplication | low | 3.5 | 0% |
| CVE-2024-3593 | ubermenu (WordPress plugin) | The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to mi | high | 7.2 | 0% |
| CVE-2026-81890 | studio-42/elfinder | elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections | medium | 5.4 | 0% |
| CVE-2026-49215 | symfony/ux-live-component | symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted | low | 0.0 | 0% |
| CVE-2023-6008 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing | medium | 6.3 | 0% |
| CVE-2024-11719 | tarteaucitron-wp (WordPress plugin) | The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, | medium | 6.1 | 0% |
| CVE-2026-34384 | admidio/admidio | Admidio has Missing CSRF Protection on Registration Approval Actions | medium | 4.5 | 0% |
| CVE-2026-33649 | wwbn/avideo | AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification | high | 8.1 | 0% |
| CVE-2025-5932 | homerunner-smartcheckout (WordPress plugin) | The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to | medium | 4.3 | 0% |
| CVE-2025-5937 | paid-membership (WordPress plugin) | The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Reques | medium | 4.3 | 0% |
| CVE-2026-40925 | wwbn/avideo | WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials | high | 8.3 | 0% |
| CVE-2024-13647 | sakolawp-lite (WordPress plugin) | The School Management System – SakolaWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2025-1288 | wooexim (WordPress plugin) | The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 6.1 | 0% |
| CVE-2024-13522 | magayo-lottery-results (WordPress plugin) | The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. Th | medium | 6.1 | 0% |
| CVE-2026-8421 | concrete5/concrete5 | Concrete CMS contains a CSRF vulnerability | high | 0.0 | 0% |
| CVE-2026-8426 | concrete5/concrete5 | Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>` | high | 0.0 | 0% |
| CVE-2024-13096 | wp-finance (WordPress plugin) | The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 4.6 | 0% |
| CVE-2024-12709 | bulk-me-now\! (WordPress plugin) | The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users | medium | 4.3 | 0% |
| CVE-2024-13580 | xv-random-quotes (WordPress plugin) | The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2025-1762 | event-tickets-with-ticket-scanner (WordPress plugin) | The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which coul | medium | 4.3 | 0% |
| CVE-2024-6405 | floating-social-buttons (WordPress plugin) | The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This | medium | 6.1 | 0% |
| CVE-2024-8032 | smooth-gallery-replacement (WordPress plugin) | The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as | medium | 6.1 | 0% |
| CVE-2024-8085 | peoplepond (WordPress plugin) | The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 6.1 | 0% |