Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2013-2701 | social-sharing-toolkit-plugin (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Social Sharing Toolkit plugin 2.1.1 for WordPress allows remote attackers to hijack t | medium | 6.8 | 1% |
| CVE-2013-2708 | content-slide (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers to hijack the authen | medium | 6.8 | 1% |
| CVE-2014-5199 | wp-file-upload (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remot | medium | 6.8 | 1% |
| CVE-2022-29429 | code-snippets-extended (WordPress plugin) | Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery. | high | 8.8 | 1% |
| CVE-2012-4921 | dvs-custom-notification (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remot | medium | 6.8 | 1% |
| CVE-2014-3843 | search-everything (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2024-0624 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.3 | 1% |
| CVE-2009-3633 | typo3/cms-core | TYPO3 API function vulnerable to Cross-site Scripting | medium | 0.0 | 1% |
| CVE-2016-4878 | baserproject/basercms | baserCMS Cross Site Request Forgery vulnerability | high | 8.8 | 1% |
| CVE-2016-4881 | baserproject/basercms | CSRF in baserCMS 3.0.10 and earlier | high | 8.8 | 1% |
| CVE-2020-35950 | xcloner (WordPress plugin) | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint). | critical | 9.8 | 1% |
| CVE-2020-15151 | openmage/magento-lts | Observable Timing Discrepancy in OpenMage LTS | high | 8.0 | 1% |
| CVE-2020-6167 | minimal-coming-soon-maintenance-mode (WordPress plugin) | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject | high | 8.8 | 1% |
| CVE-2018-16966 | wp-file-manager (WordPress plugin) | There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parame | high | 8.8 | 1% |
| CVE-2018-17584 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page. | high | 8.8 | 1% |
| CVE-2020-5767 | email-subscribers-\&-newsletters (WordPress plugin) | Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged em | medium | 6.5 | 1% |
| CVE-2021-24639 | omgf (WordPress plugin) | The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX actio | high | 8.1 | 1% |
| CVE-2014-2274 | subscribe-to-comments-reloaded (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attac | high | 8.8 | 1% |
| CVE-2016-10989 | leenkme (WordPress plugin) | The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF. | high | 8.8 | 1% |
| CVE-2021-3133 | sb-elementor-contact-form-db (WordPress plugin) | The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages. | medium | 6.5 | 1% |
| CVE-2024-0588 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 4.3 | 1% |
| CVE-2020-35135 | ultimate-category-excluder (WordPress plugin) | The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF. | high | 8.8 | 1% |
| CVE-2015-4179 | codestyling-localization (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress. | high | 8.8 | 1% |
| CVE-2019-12239 | wp-booking-system (WordPress plugin) | The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that r | high | 7.2 | 1% |
| CVE-2025-49555 | magento/community-edition, magento/project-community-edition | Magento Cross-Site Request Forgery (CSRF) vulnerability | high | 8.1 | 1% |
| CVE-2015-9424 | multicons (WordPress plugin) | The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.ph | medium | 6.5 | 1% |
| CVE-2015-9437 | dynamic-widgets (WordPress plugin) | The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit | medium | 6.5 | 1% |
| CVE-2016-4879 | baserproject/basercms | CSRF in baserCMS 3.0.10 and earlier | high | 8.8 | 1% |
| CVE-2021-20779 | wp-html-mail (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote at | high | 8.8 | 1% |
| CVE-2015-9421 | olevmedia-shortcodes (WordPress plugin) | The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id | medium | 6.5 | 1% |
| CVE-2015-9428 | wplegalpages (WordPress plugin) | The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-busi | medium | 6.5 | 1% |
| CVE-2015-9429 | yith-maintenance-mode (WordPress plugin) | The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mo | medium | 6.5 | 1% |
| CVE-2015-9431 | qtranslate-x (WordPress plugin) | The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_c | medium | 6.5 | 1% |
| CVE-2015-9432 | alpine-photo-tile-for-instagram (WordPress plugin) | The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?pag | medium | 6.5 | 1% |
| CVE-2015-9434 | kiwi-logo-carousel (WordPress plugin) | The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogo | medium | 6.5 | 1% |
| CVE-2021-20780 | currency-switcher (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack th | high | 8.8 | 1% |
| CVE-2019-17386 | animate-it (WordPress plugin) | The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php. | high | 8.8 | 1% |
| CVE-2019-19915 | 301-redirects (WordPress plugin) | The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, del | critical | 9.0 | 1% |
| CVE-2015-9422 | plugnedit (WordPress plugin) | The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields | medium | 6.5 | 1% |
| CVE-2015-9433 | wp-social-bookmarking-light (WordPress plugin) | The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twit | medium | 6.5 | 1% |
| CVE-2016-10938 | copy-me (WordPress plugin) | The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location. | medium | 6.5 | 1% |
| CVE-2019-8109 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability via CSRF | high | 8.0 | 1% |
| CVE-2019-5992 | wordpress-ultra-simple-paypal-shopping-cart (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to h | high | 8.8 | 1% |
| CVE-2021-20781 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions pri | high | 8.8 | 1% |
| CVE-2015-9442 | avenirsoft-directdownload (WordPress plugin) | The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin. | medium | 6.5 | 1% |
| CVE-2015-9443 | accurate-form-data-real-time-form-validation (WordPress plugin) | The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page= | medium | 6.5 | 1% |
| CVE-2020-5391 | wp-auth0 (WordPress plugin) | Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field. | high | 8.8 | 1% |
| CVE-2022-3747 | becustom (WordPress plugin) | The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to miss | high | 8.8 | 1% |
| CVE-2019-12466 | mediawiki/core | Wikimedia MediaWiki allows CSRF | high | 8.8 | 1% |
| CVE-2019-14216 | wp-svg-icons (WordPress plugin) | An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg- | high | 8.8 | 1% |