Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13338 | clearfy (WordPress plugin) | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request For | medium | 5.3 | 0% |
| CVE-2024-13339 | debounce-io-email-validator (WordPress plugin) | The DeBounce Email Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.8.0. T | medium | 6.1 | 0% |
| CVE-2025-55744 | unopim/unopim | UnoPim vulnerable to CSRF on Product edit feature and creation of other types | medium | 0.0 | 0% |
| CVE-2026-55742 | cotonti/cotonti | Cotonti: Cross-Site Request Forgery in the administration rights handler | critical | 9.6 | 0% |
| CVE-2026-63000 | redaxo/source | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates | medium | 6.4 | 0% |
| CVE-2024-13682 | wallet-system-for-woocommerce (WordPress plugin) | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2025-67472 | online-booking-\&-scheduling-calendar (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vc | medium | 4.3 | 0% |
| CVE-2026-55744 | cotonti/cotonti | Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module | high | 8.1 | 0% |
| CVE-2025-2797 | woffice (WordPress plugin) | The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due | medium | 5.4 | 0% |
| CVE-2025-5924 | wp-push-notification-firebase (WordPress plugin) | The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2 | medium | 4.3 | 0% |
| CVE-2025-11154 | idonate (WordPress plugin) | The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthe | medium | 5.4 | 0% |
| CVE-2026-8409 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete | low | 0.0 | 0% |
| CVE-2026-8410 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete | low | 0.0 | 0% |
| CVE-2026-43877 | wwbn/avideo | AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content | medium | 5.4 | 0% |
| CVE-2024-13512 | wonder-fontawesome (WordPress plugin) | The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is d | medium | 6.1 | 0% |
| CVE-2024-13521 | mailup-auto-subscribtion (WordPress plugin) | The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. T | medium | 6.1 | 0% |
| CVE-2026-47229 | admidio/admidio | Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation | medium | 5.4 | 0% |
| CVE-2025-5938 | digital-marketing-agency-templates-for-elementor (WordPress plugin) | The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers | medium | 5.3 | 0% |
| CVE-2025-5936 | vr-calendar-sync (WordPress plugin) | The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to | medium | 4.3 | 0% |
| CVE-2026-34383 | admidio/admidio | Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter | medium | 4.3 | 0% |
| CVE-2026-32816 | admidio/admidio | Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions | medium | 5.7 | 0% |
| CVE-2026-35181 | wwbn/avideo | AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php | medium | 4.3 | 0% |
| CVE-2025-10930 | drupal/currency | This module allows you to use different currencies on your website and do currency conversion. The module doesn't suffi | medium | 6.5 | 0% |
| CVE-2026-47232 | admidio/admidio | Admidio PKCS#12 private key export action lacks CSRF protection | medium | 4.3 | 0% |
| CVE-2026-8428 | concrete5/concrete5 | Concrete CMS is Vulnerable to Cross-Site Request Forgery | high | 0.0 | 0% |
| CVE-2026-8411 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete | low | 0.0 | 0% |
| CVE-2026-8412 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache | low | 0.0 | 0% |
| CVE-2026-8413 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design | low | 0.0 | 0% |
| CVE-2026-8414 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate | low | 0.0 | 0% |
| CVE-2026-8415 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder | low | 0.0 | 0% |
| CVE-2026-8416 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id) | low | 0.0 | 0% |
| CVE-2026-8427 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id) | low | 0.0 | 0% |
| CVE-2026-8432 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() | low | 0.0 | 0% |
| CVE-2026-8433 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() | low | 0.0 | 0% |
| CVE-2026-8434 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() | low | 0.0 | 0% |
| CVE-2026-34382 | admidio/admidio | Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php | medium | 4.6 | 0% |
| CVE-2026-8417 | concrete5/concrete5 | Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>` | high | 0.0 | 0% |
| CVE-2026-8140 | concrete5/concrete5 | Concrete CMS is Vulnerable to Cross-Site Request Forgery | high | 0.0 | 0% |
| CVE-2026-41663 | admidio/admidio | Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send | low | 3.5 | 0% |
| CVE-2026-7882 | concrete5/concrete5 | Concrete CMS is vulnerable to unauthorized file deletion | low | 0.0 | 0% |
| CVE-2026-40928 | wwbn/avideo | WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset | medium | 5.4 | 0% |
| CVE-2026-107848 | contao/core-bundle | Contao: Cross-site request forgery in custom backend actions | low | 3.5 | 0% |
| CVE-2026-8435 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() | low | 0.0 | 0% |
| CVE-2026-40929 | wwbn/avideo | WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creato | medium | 5.4 | 0% |
| CVE-2026-45610 | wwbn/avideo | AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA | medium | 5.7 | 0% |
| CVE-2016-20054 | khodakhah/nodcms | Nodcms contains a cross-site request forgery vulnerability | medium | 4.3 | 0% |
| CVE-2026-8340 | concrete5/concrete5 | Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion | low | 0.0 | 0% |
| CVE-2026-55745 | cotonti/cotonti | Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module | medium | 5.4 | 0% |
| GHSA-6v7p-5qcq-268c | zendframework/zend-navigation | Zend-Navigation vulnerable to Cross-site Scripting | high | 7.5 | – |
| GHSA-cg8w-5jrc-675g | zendframework/zend-http | Zend-HTTP URL Rewrite vulnerability | high | 7.5 | – |