Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9442 | avenirsoft-directdownload (WordPress plugin) | The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin. | medium | 6.5 | 1% |
| CVE-2015-9443 | accurate-form-data-real-time-form-validation (WordPress plugin) | The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page= | medium | 6.5 | 1% |
| CVE-2020-5391 | wp-auth0 (WordPress plugin) | Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field. | high | 8.8 | 1% |
| CVE-2022-3747 | becustom (WordPress plugin) | The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to miss | high | 8.8 | 1% |
| CVE-2019-12466 | mediawiki/core | Wikimedia MediaWiki allows CSRF | high | 8.8 | 1% |
| CVE-2019-14216 | wp-svg-icons (WordPress plugin) | An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg- | high | 8.8 | 1% |
| CVE-2022-1969 | mobile-browser-color-select (WordPress plugin) | The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. Th | high | 8.8 | 1% |
| CVE-2021-24981 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP | high | 7.5 | 1% |
| CVE-2014-5072 | wp-security-audit-log (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack | high | 8.8 | 1% |
| CVE-2015-9440 | monetize (WordPress plugin) | The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new. | medium | 6.5 | 1% |
| CVE-2015-9441 | bookmarkify (WordPress plugin) | The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php. | medium | 6.5 | 1% |
| CVE-2016-10997 | beauty-premium (WordPress theme) | The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php. | medium | 6.5 | 1% |
| CVE-2021-28055 | centreon/centreon | Predictable CSRF tokens in centreon/centreon | medium | 6.5 | 1% |
| CVE-2022-1918 | toolbar-to-share (WordPress plugin) | The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to | high | 8.8 | 1% |
| CVE-2018-18420 | tribalsystems/zenario | Zenario CMS vulnerable to CSRF | high | 8.8 | 1% |
| CVE-2015-9380 | photo-gallery (WordPress plugin) | The photo-gallery plugin before 1.2.42 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2022-0215 | login\/signup-popup (WordPress plugin), side-cart-woocommerce (WordPress plugin), waitlist-woocommerce (WordPress plugin) | The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vu | high | 8.8 | 1% |
| CVE-2025-51586 | prestashop/prestashop | Presta Shop vulnerable to email enumeration | medium | 4.2 | 1% |
| CVE-2020-13641 | real-time-find-and-replace (WordPress plugin) | An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any no | high | 8.8 | 1% |
| CVE-2020-13642 | siteorigin-panels (WordPress plugin) | An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do a | high | 8.8 | 1% |
| CVE-2020-13643 | siteorigin-panels (WordPress plugin) | An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce ver | high | 8.8 | 1% |
| CVE-2019-16993 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2017-8100 | wp-copysafe-web (WordPress plugin) | There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings. | medium | 6.5 | 1% |
| CVE-2021-24333 | content-copy-protection-\&-prevent-image-save (WordPress plugin) | The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform | medium | 6.5 | 1% |
| CVE-2019-15769 | handl-utm-grabber (WordPress plugin) | The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option. | high | 8.8 | 1% |
| CVE-2021-24162 | responsive-menu (WordPress plugin) | In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importi | high | 8.8 | 1% |
| CVE-2019-14681 | deny-all-firewall (WordPress plugin) | The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF. | high | 8.8 | 1% |
| CVE-2019-15828 | one-click-ssl (WordPress plugin) | The one-click-ssl plugin before 1.4.7 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15832 | visitors-traffic-real-time-statistics (WordPress plugin) | The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2023-0292 | quiz-master-next (WordPress plugin) | The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is | medium | 5.4 | 1% |
| CVE-2022-1749 | find-any-think (WordPress plugin) | The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function fou | high | 8.8 | 1% |
| CVE-2015-5338 | moodle/moodle | Moodle multiple cross-site request forgery (CSRF) vulnerabilities | high | 8.8 | 1% |
| CVE-2020-35944 | pagelayer (WordPress plugin) | An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, whic | high | 8.8 | 1% |
| CVE-2016-10945 | pagelines (WordPress theme) | The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF. | high | 8.8 | 1% |
| CVE-2016-10946 | wp-d3 (WordPress plugin) | The wp-d3 plugin before 2.4.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-6379 | drupal/core, drupal/drupal | Drupal Cross-Site Request Forgery (CSRF) | high | 7.5 | 1% |
| CVE-2020-28649 | orbisius-child-theme-creator (WordPress plugin) | The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file. | high | 8.8 | 1% |
| CVE-2021-25051 | modal-window (WordPress plugin) | The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension | high | 8.8 | 1% |
| CVE-2022-40687 | creative-mail (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. | medium | 5.4 | 1% |
| CVE-2021-24905 | advanced-cf7-db (WordPress plugin) | The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete | high | 8.0 | 1% |
| CVE-2018-5673 | booking-calendar (WordPress plugin) | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php. | high | 8.8 | 1% |
| CVE-2022-1788 | change-uploaded-file-permissions (WordPress plugin) | Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to | medium | 6.5 | 1% |
| CVE-2019-19013 | pagekit/pagekit | Pagekit File Upload vulnerability | high | 8.8 | 1% |
| CVE-2021-24504 | wp-learn-manager (WordPress plugin) | The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing | medium | 6.1 | 1% |
| CVE-2017-8874 | mautic/core | Mautic Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2018-9108 | quickapps/cms | QuickAppsCMS Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2024-10857 | product-input-fields-for-woocommerce (WordPress plugin) | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 | medium | 6.5 | 1% |
| CVE-2024-20718 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Cross-Site Request Forgery (CSRF) | medium | 4.3 | 1% |
| CVE-2018-11406 | symfony/security, symfony/security-bundle, symfony/security-http +2 more | Symfony CSRF Token Fixation | high | 8.8 | 1% |
| CVE-2019-15238 | cforms2 (WordPress plugin) | The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field. | high | 8.8 | 1% |