Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-5361 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php. | high | 8.8 | 1% |
| CVE-2014-3850 | member-approval (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the aut | medium | 6.8 | 1% |
| CVE-2015-9447 | unite-gallery-lite (WordPress plugin) | The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters. | medium | 6.5 | 1% |
| CVE-2016-11085 | quiz-and-survey-master (WordPress plugin) | php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the | medium | 6.5 | 1% |
| CVE-2014-9335 | dandyid-services (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attac | medium | 6.8 | 1% |
| CVE-2014-9336 | itwitter (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the iTwitter plugin 0.04 and earlier for WordPress allow remote attackers to h | medium | 6.8 | 1% |
| CVE-2014-9393 | post-to-twitter (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attacker | medium | 6.8 | 1% |
| CVE-2014-9396 | simpleflickr (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleFlickr plugin 3.0.3 and earlier for WordPress allow remote attackers | medium | 6.8 | 1% |
| CVE-2014-9397 | twimp-wp (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the twimp-wp plugin for WordPress allows remote attackers to hijack the authentication of | medium | 6.8 | 1% |
| CVE-2014-9400 | wp-unique-article-header-image (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow | medium | 6.8 | 1% |
| CVE-2014-9401 | wp-limit-posts-automatically (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attac | medium | 6.8 | 1% |
| CVE-2014-9437 | sliding-social-icons (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to h | medium | 6.8 | 1% |
| CVE-2014-9441 | lightbox-photo-gallery (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to | medium | 6.8 | 1% |
| CVE-2014-2838 | gd-star-rating (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2015-9233 | cp-contact-form-with-paypal (WordPress plugin) | The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to | high | 8.8 | 1% |
| CVE-2020-11825 | dolibarr/dolibarr | Dolibarr Cross-Site Request Forgery Vulnerability | high | 8.8 | 1% |
| CVE-2011-4298 | moodle/moodle | Moodle vulnerable to Cross-Site Request Forgery | medium | 0.0 | 1% |
| CVE-2014-9341 | yurl-retwitt (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers t | medium | 6.8 | 1% |
| CVE-2022-1203 | content-mask (WordPress plugin) | The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not va | medium | 4.3 | 1% |
| CVE-2015-2089 | crossslide-jquery (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 fo | medium | 6.8 | 1% |
| CVE-2011-4133 | moodle/moodle | Moodle vulnerable to Cross-Site Request Forgery | medium | 0.0 | 1% |
| CVE-2011-4281 | moodle/moodle | Moodle vulnerable to Cross-Site Request Forgery | medium | 0.0 | 1% |
| CVE-2014-0126 | moodle/moodle | Moodle cross-site request forgery (CSRF) vulnerability | medium | 0.0 | 1% |
| CVE-2014-0213 | moodle/moodle | Moodle multiple cross-site request forgery (CSRF) vulnerabilities | medium | 0.0 | 1% |
| CVE-2014-7836 | moodle/moodle | Moodle multiple cross-site request forgery (CSRF) vulnerabilities | medium | 0.0 | 1% |
| CVE-2014-7838 | moodle/moodle | Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module | medium | 0.0 | 1% |
| CVE-2015-0213 | moodle/moodle | Moodle multiple cross-site request forgery (CSRF) vulnerabilities | medium | 0.0 | 1% |
| CVE-2015-0218 | moodle/moodle | Moodle cross-site request forgery (CSRF) vulnerability | medium | 0.0 | 1% |
| CVE-2023-0335 | wp-shamsi (WordPress plugin) | The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscri | medium | 6.5 | 1% |
| CVE-2023-0336 | ooohboi-steroids-for-elementor (WordPress plugin) | The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with ro | medium | 6.5 | 1% |
| CVE-2014-9337 | mikiurl-wordpress-eklentisi (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Mikiurl Wordpress Eklentisi plugin 2.0 and earlier for WordPress allow rem | medium | 6.8 | 1% |
| CVE-2014-9338 | o2tweet (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the O2Tweet plugin 0.0.4 and earlier for WordPress allow remote attackers to h | medium | 6.8 | 1% |
| CVE-2014-9339 | spnbabble (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow remote attackers to | medium | 6.8 | 1% |
| CVE-2014-9340 | wpcommenttwit (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers | medium | 6.8 | 1% |
| CVE-2014-9368 | twitterdash (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack th | medium | 6.8 | 1% |
| CVE-2014-9391 | gslideshow (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the gSlideShow plugin 0.1 and earlier for WordPress allow remote attackers to | medium | 6.8 | 1% |
| CVE-2014-9392 | pictobrowser (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows rem | medium | 6.8 | 1% |
| CVE-2014-9395 | simplelife (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Simplelife plugin 1.2 and earlier for WordPress allow remote attackers to | medium | 6.8 | 1% |
| CVE-2014-9398 | twitter-liveblog (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hi | medium | 6.8 | 1% |
| CVE-2014-9399 | tweetscribe (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the TweetScribe plugin 1.1 and earlier for WordPress allows remote attackers to hijack th | medium | 6.8 | 1% |
| CVE-2014-9523 | our-team-showcase (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1.3 for WordPress allo | medium | 6.8 | 1% |
| CVE-2015-1580 | redirection (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2015-1581 | mobile-domain (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2024-0379 | custom-twitter-feeds (WordPress plugin) | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 1% |
| CVE-2015-4089 | wp-fastest-cache (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before | high | 8.8 | 1% |
| CVE-2012-6629 | newsletter-manager (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote att | medium | 6.8 | 1% |
| CVE-2020-35773 | site-offline (WordPress plugin) | The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF. | high | 8.8 | 1% |
| CVE-2015-9497 | ad-inserter (WordPress plugin) | The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php. | high | 8.8 | 1% |
| CVE-2016-2157 | moodle/moodle | Moodle cross-site request forgery (CSRF) vulnerability | high | 8.8 | 1% |
| CVE-2013-3251 | qtranslate (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the qTranslate plugin 2.5.34 and earlier for WordPress allows remote attackers to hijack | medium | 6.8 | 1% |