Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-3635 | moodle/moodle | Moodle has a CSRF risk in user tours manager that allows tour duplication | low | 3.5 | 0% |
| CVE-2024-3593 | ubermenu (WordPress plugin) | The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to mi | high | 7.2 | 0% |
| CVE-2026-81890 | studio-42/elfinder | elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections | medium | 5.4 | 0% |
| CVE-2026-49215 | symfony/ux-live-component | symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted | low | 0.0 | 0% |
| CVE-2023-6008 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing | medium | 6.3 | 0% |
| CVE-2024-11719 | tarteaucitron-wp (WordPress plugin) | The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, | medium | 6.1 | 0% |
| CVE-2026-34384 | admidio/admidio | Admidio has Missing CSRF Protection on Registration Approval Actions | medium | 4.5 | 0% |
| CVE-2026-33649 | wwbn/avideo | AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification | high | 8.1 | 0% |
| CVE-2025-5932 | homerunner-smartcheckout (WordPress plugin) | The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to | medium | 4.3 | 0% |
| CVE-2025-5937 | paid-membership (WordPress plugin) | The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Reques | medium | 4.3 | 0% |
| CVE-2026-40925 | wwbn/avideo | WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials | high | 8.3 | 0% |
| CVE-2024-13647 | sakolawp-lite (WordPress plugin) | The School Management System – SakolaWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2025-1288 | wooexim (WordPress plugin) | The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 6.1 | 0% |
| CVE-2024-13522 | magayo-lottery-results (WordPress plugin) | The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. Th | medium | 6.1 | 0% |
| CVE-2026-8421 | concrete5/concrete5 | Concrete CMS contains a CSRF vulnerability | high | 0.0 | 0% |
| CVE-2026-8426 | concrete5/concrete5 | Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>` | high | 0.0 | 0% |
| CVE-2024-13096 | wp-finance (WordPress plugin) | The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 4.6 | 0% |
| CVE-2024-12709 | bulk-me-now\! (WordPress plugin) | The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users | medium | 4.3 | 0% |
| CVE-2024-13580 | xv-random-quotes (WordPress plugin) | The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2025-1762 | event-tickets-with-ticket-scanner (WordPress plugin) | The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which coul | medium | 4.3 | 0% |
| CVE-2024-6405 | floating-social-buttons (WordPress plugin) | The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This | medium | 6.1 | 0% |
| CVE-2024-8032 | smooth-gallery-replacement (WordPress plugin) | The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as | medium | 6.1 | 0% |
| CVE-2024-8085 | peoplepond (WordPress plugin) | The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 6.1 | 0% |
| CVE-2025-1362 | url-shortener-\|-conversion-tracking-\|-ab-testing-\|-woocommerce (WordPress plugin) | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk a | medium | 4.3 | 0% |
| CVE-2025-2247 | wp-pmanager (WordPress plugin) | The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2025-1926 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2026-53760 | admidio/admidio | Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests | medium | 5.2 | 0% |
| CVE-2024-10581 | directorypress-frontend (WordPress plugin) | The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. Th | medium | 4.3 | 0% |
| CVE-2024-13336 | disable-auto-updates (WordPress plugin) | The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is | medium | 4.3 | 0% |
| CVE-2024-13438 | speedsize-ai-image-optimizer (WordPress plugin) | The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-13494 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. Thi | medium | 4.3 | 0% |
| CVE-2024-13718 | flexible-wishlist-for-woocommerce (WordPress plugin) | The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2026-40926 | wwbn/avideo | WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script) | high | 7.1 | 0% |
| CVE-2024-6751 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is du | medium | 6.3 | 0% |
| CVE-2023-7197 | marketing-twitter-bot (WordPress plugin) | The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as esca | high | 7.1 | 0% |
| CVE-2023-2438 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing | medium | 6.1 | 0% |
| CVE-2024-13826 | email-keep (WordPress plugin) | The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to mak | medium | 5.4 | 0% |
| CVE-2025-4580 | file-provider (WordPress plugin) | The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 4.3 | 0% |
| CVE-2025-0808 | houzez-property-feed (WordPress plugin) | The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This | medium | 4.3 | 0% |
| CVE-2025-10498 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions | medium | 4.3 | 0% |
| CVE-2025-10499 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versi | medium | 4.3 | 0% |
| CVE-2026-47228 | admidio/admidio | Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords | medium | 5.2 | 0% |
| CVE-2026-34611 | wwbn/avideo | AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users | medium | 6.5 | 0% |
| CVE-2024-8243 | wordpress\/plugin-upgrade-time-out-plugin (WordPress plugin) | The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisati | medium | 6.3 | 0% |
| CVE-2025-4966 | wp-online-users-stats (WordPress plugin) | The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This | medium | 6.1 | 0% |
| CVE-2024-8043 | vikinghammer-tweet (WordPress plugin) | The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escapi | medium | 5.4 | 0% |
| CVE-2025-14163 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11 | medium | 4.3 | 0% |
| CVE-2025-1436 | limit-bio (WordPress plugin) | The Limit Bio WordPress plugin through 1.0 does not have CSRF check when updating its settings, and is missing sanitisation as well as escap | high | 7.1 | 0% |
| CVE-2024-12115 | poll-maker (WordPress plugin) | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2026-32755 | admidio/admidio | Admidio is Missing CSRF Protection on Role Membership Date Changes | medium | 5.7 | 0% |