Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-12437 | silverstripe/graphql | Silverstripe CSRF Protection Bypass via GraphQL | high | 8.8 | 1% |
| CVE-2019-17237 | igniteup (WordPress plugin) | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF. | high | 8.8 | 1% |
| CVE-2017-18521 | democracy-poll (WordPress plugin) | The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n. | high | 8.8 | 1% |
| CVE-2020-11069 | typo3/cms, typo3/cms-core | Backend Same-Site Request Forgery in TYPO3 CMS | high | 8.0 | 1% |
| CVE-2019-15831 | visitors-traffic-real-time-statistics (WordPress plugin) | The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. | high | 8.8 | 1% |
| CVE-2021-24626 | chameleon-css (WordPress plugin) | The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticate | high | 8.8 | 1% |
| CVE-2016-10944 | multisite-post-duplicator (WordPress plugin) | The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF. | high | 8.8 | 1% |
| CVE-2016-10974 | fluid-responsive-slideshow (WordPress plugin) | The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS. | high | 8.8 | 1% |
| CVE-2016-10982 | kento-post-view-counter (WordPress plugin) | The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF. | high | 8.8 | 1% |
| CVE-2020-35943 | nextgen-gallery (WordPress plugin) | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to by | medium | 6.5 | 1% |
| CVE-2024-5481 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and i | medium | 6.8 | 1% |
| CVE-2021-20184 | moodle/moodle | Moodle Grade information disclosure in grade's external fetch functions | medium | 4.3 | 1% |
| CVE-2018-5285 | imageinject (WordPress plugin) | The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2021-24809 | bp-better-messages (WordPress plugin) | The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_ch | high | 8.8 | 1% |
| CVE-2021-39353 | easy-registration-forms (WordPress plugin) | The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_fo | high | 8.8 | 1% |
| CVE-2021-24565 | contact-form-7-captcha (WordPress plugin) | The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker t | high | 8.8 | 1% |
| CVE-2021-34619 | woocommerce-stock-manager (WordPress plugin) | The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up t | high | 8.8 | 1% |
| CVE-2015-9498 | wps-hide-login (WordPress plugin) | The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value. | high | 8.8 | 1% |
| CVE-2018-13067 | opencart/opencart | OpenCart Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2015-9455 | buddypress-activity-plus (WordPress plugin) | The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php b | high | 8.1 | 1% |
| CVE-2017-12651 | loginizer (WordPress plugin) | Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordP | high | 8.8 | 1% |
| CVE-2021-24491 | fileviewer (WordPress plugin) | The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a | high | 8.8 | 1% |
| CVE-2022-1599 | admin-management-xtended (WordPress plugin) | The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make | medium | 6.5 | 1% |
| CVE-2019-19109 | wpforo (WordPress plugin) | The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. | high | 8.8 | 1% |
| CVE-2018-17102 | quickapps/cms | QuickAppsCMS Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2019-15781 | facebook-by-weblizar (WordPress plugin) | The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15834 | webp-converter-for-media (WordPress plugin) | The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10882 | google-document-embedder (WordPress plugin) | The google-document-embedder plugin before 2.6.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-24249 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request For | medium | 6.5 | 1% |
| CVE-2019-15835 | wp-better-permalinks (WordPress plugin) | The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15865 | breadcrumbs-by-menu (WordPress plugin) | The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15868 | affiliates-manager (WordPress plugin) | The affiliates-manager plugin before 2.6.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2020-20693 | gilacms/gila | Cross-Site Request Forgery in GilaCMS | high | 8.8 | 1% |
| CVE-2021-34628 | admin-custom-login (WordPress plugin) | The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Lo | high | 8.8 | 1% |
| CVE-2021-34634 | sola-newsletters (WordPress plugin) | The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-news | high | 8.8 | 1% |
| CVE-2021-34637 | post-index (WordPress plugin) | The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php fil | high | 8.8 | 1% |
| CVE-2015-9307 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature. | high | 8.8 | 1% |
| CVE-2015-9308 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature. | high | 8.8 | 1% |
| CVE-2015-9309 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature. | high | 8.8 | 1% |
| CVE-2016-10884 | simple-membership (WordPress plugin) | The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues. | high | 8.8 | 1% |
| CVE-2021-24218 | facebook (WordPress plugin) | The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable | high | 8.8 | 1% |
| CVE-2022-3427 | corner-ad (WordPress plugin) | The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to miss | high | 8.8 | 1% |
| CVE-2015-1785 | nextgen-gallery (WordPress plugin) | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we | medium | 6.5 | 1% |
| CVE-2019-12246 | silverstripe/framework | SilverStripe Denial of Service on flush and development URL tools | medium | 4.3 | 1% |
| CVE-2020-13663 | drupal/core, drupal/drupal | The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other v | high | 8.8 | 1% |
| CVE-2016-10876 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 4.3.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15840 | facebook-for-woocommerce (WordPress plugin) | The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15841 | facebook-for-woocommerce (WordPress plugin) | The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, | high | 8.8 | 1% |
| CVE-2019-15329 | import-users-from-csv-with-meta (WordPress plugin) | The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15770 | woo-address-book (WordPress plugin) | The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks. | high | 8.8 | 1% |