Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-1362 | url-shortener-\|-conversion-tracking-\|-ab-testing-\|-woocommerce (WordPress plugin) | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk a | medium | 4.3 | 0% |
| CVE-2025-2247 | wp-pmanager (WordPress plugin) | The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2025-1926 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2026-53760 | admidio/admidio | Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests | medium | 5.2 | 0% |
| CVE-2024-10581 | directorypress-frontend (WordPress plugin) | The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. Th | medium | 4.3 | 0% |
| CVE-2024-13336 | disable-auto-updates (WordPress plugin) | The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is | medium | 4.3 | 0% |
| CVE-2024-13438 | speedsize-ai-image-optimizer (WordPress plugin) | The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-13494 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. Thi | medium | 4.3 | 0% |
| CVE-2024-13718 | flexible-wishlist-for-woocommerce (WordPress plugin) | The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2026-40926 | wwbn/avideo | WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script) | high | 7.1 | 0% |
| CVE-2024-6751 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is du | medium | 6.3 | 0% |
| CVE-2023-7197 | marketing-twitter-bot (WordPress plugin) | The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as esca | high | 7.1 | 0% |
| CVE-2023-2438 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing | medium | 6.1 | 0% |
| CVE-2024-13826 | email-keep (WordPress plugin) | The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to mak | medium | 5.4 | 0% |
| CVE-2025-4580 | file-provider (WordPress plugin) | The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 4.3 | 0% |
| CVE-2025-0808 | houzez-property-feed (WordPress plugin) | The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This | medium | 4.3 | 0% |
| CVE-2025-10498 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions | medium | 4.3 | 0% |
| CVE-2025-10499 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versi | medium | 4.3 | 0% |
| CVE-2026-47228 | admidio/admidio | Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords | medium | 5.2 | 0% |
| CVE-2026-34611 | wwbn/avideo | AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users | medium | 6.5 | 0% |
| CVE-2024-8243 | wordpress\/plugin-upgrade-time-out-plugin (WordPress plugin) | The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisati | medium | 6.3 | 0% |
| CVE-2025-4966 | wp-online-users-stats (WordPress plugin) | The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This | medium | 6.1 | 0% |
| CVE-2024-8043 | vikinghammer-tweet (WordPress plugin) | The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escapi | medium | 5.4 | 0% |
| CVE-2025-14163 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11 | medium | 4.3 | 0% |
| CVE-2026-32313 | robrichards/xmlseclibs | xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption | high | 8.2 | 0% |
| CVE-2025-1436 | limit-bio (WordPress plugin) | The Limit Bio WordPress plugin through 1.0 does not have CSRF check when updating its settings, and is missing sanitisation as well as escap | high | 7.1 | 0% |
| CVE-2024-12115 | poll-maker (WordPress plugin) | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2026-32755 | admidio/admidio | Admidio is Missing CSRF Protection on Role Membership Date Changes | medium | 5.7 | 0% |
| CVE-2024-13338 | clearfy (WordPress plugin) | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request For | medium | 5.3 | 0% |
| CVE-2024-13339 | debounce-io-email-validator (WordPress plugin) | The DeBounce Email Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.8.0. T | medium | 6.1 | 0% |
| CVE-2025-55744 | unopim/unopim | UnoPim vulnerable to CSRF on Product edit feature and creation of other types | medium | 0.0 | 0% |
| CVE-2026-55742 | cotonti/cotonti | Cotonti: Cross-Site Request Forgery in the administration rights handler | critical | 9.6 | 0% |
| CVE-2026-32600 | simplesamlphp/xml-security | simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption | high | 8.2 | 0% |
| CVE-2026-63000 | redaxo/source | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates | medium | 6.4 | 0% |
| CVE-2024-13682 | wallet-system-for-woocommerce (WordPress plugin) | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2025-67472 | online-booking-\&-scheduling-calendar (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vc | medium | 4.3 | 0% |
| CVE-2026-55744 | cotonti/cotonti | Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module | high | 8.1 | 0% |
| CVE-2025-2797 | woffice (WordPress plugin) | The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due | medium | 5.4 | 0% |
| CVE-2025-5924 | wp-push-notification-firebase (WordPress plugin) | The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2 | medium | 4.3 | 0% |
| CVE-2025-11154 | idonate (WordPress plugin) | The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthe | medium | 5.4 | 0% |
| CVE-2026-8409 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete | low | 0.0 | 0% |
| CVE-2026-8410 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete | low | 0.0 | 0% |
| CVE-2026-43877 | wwbn/avideo | AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content | medium | 5.4 | 0% |
| CVE-2024-13512 | wonder-fontawesome (WordPress plugin) | The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is d | medium | 6.1 | 0% |
| CVE-2024-13521 | mailup-auto-subscribtion (WordPress plugin) | The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. T | medium | 6.1 | 0% |
| CVE-2026-47229 | admidio/admidio | Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation | medium | 5.4 | 0% |
| CVE-2025-5938 | digital-marketing-agency-templates-for-elementor (WordPress plugin) | The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers | medium | 5.3 | 0% |
| CVE-2025-5936 | vr-calendar-sync (WordPress plugin) | The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to | medium | 4.3 | 0% |
| CVE-2026-34383 | admidio/admidio | Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter | medium | 4.3 | 0% |
| CVE-2026-32816 | admidio/admidio | Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions | medium | 5.7 | 0% |