Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-10982 | kento-post-view-counter (WordPress plugin) | The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF. | high | 8.8 | 1% |
| CVE-2020-35943 | nextgen-gallery (WordPress plugin) | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to by | medium | 6.5 | 1% |
| CVE-2018-5285 | imageinject (WordPress plugin) | The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2021-24809 | bp-better-messages (WordPress plugin) | The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_ch | high | 8.8 | 1% |
| CVE-2021-39353 | easy-registration-forms (WordPress plugin) | The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_fo | high | 8.8 | 1% |
| CVE-2021-24565 | contact-form-7-captcha (WordPress plugin) | The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker t | high | 8.8 | 1% |
| CVE-2021-34619 | woocommerce-stock-manager (WordPress plugin) | The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up t | high | 8.8 | 1% |
| CVE-2015-9498 | wps-hide-login (WordPress plugin) | The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value. | high | 8.8 | 1% |
| CVE-2018-13067 | opencart/opencart | OpenCart Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2015-9455 | buddypress-activity-plus (WordPress plugin) | The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php b | high | 8.1 | 1% |
| CVE-2017-12651 | loginizer (WordPress plugin) | Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordP | high | 8.8 | 1% |
| CVE-2021-24491 | fileviewer (WordPress plugin) | The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a | high | 8.8 | 1% |
| CVE-2022-1599 | admin-management-xtended (WordPress plugin) | The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make | medium | 6.5 | 1% |
| CVE-2019-19109 | wpforo (WordPress plugin) | The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. | high | 8.8 | 1% |
| CVE-2018-17102 | quickapps/cms | QuickAppsCMS Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2019-15781 | facebook-by-weblizar (WordPress plugin) | The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15834 | webp-converter-for-media (WordPress plugin) | The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10882 | google-document-embedder (WordPress plugin) | The google-document-embedder plugin before 2.6.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-24249 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request For | medium | 6.5 | 1% |
| CVE-2019-15835 | wp-better-permalinks (WordPress plugin) | The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15865 | breadcrumbs-by-menu (WordPress plugin) | The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15868 | affiliates-manager (WordPress plugin) | The affiliates-manager plugin before 2.6.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2020-20693 | gilacms/gila | Cross-Site Request Forgery in GilaCMS | high | 8.8 | 1% |
| CVE-2021-34628 | admin-custom-login (WordPress plugin) | The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Lo | high | 8.8 | 1% |
| CVE-2021-34634 | sola-newsletters (WordPress plugin) | The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-news | high | 8.8 | 1% |
| CVE-2021-34637 | post-index (WordPress plugin) | The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php fil | high | 8.8 | 1% |
| CVE-2015-9307 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature. | high | 8.8 | 1% |
| CVE-2015-9308 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature. | high | 8.8 | 1% |
| CVE-2015-9309 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature. | high | 8.8 | 1% |
| CVE-2016-10884 | simple-membership (WordPress plugin) | The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues. | high | 8.8 | 1% |
| CVE-2021-24218 | facebook (WordPress plugin) | The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable | high | 8.8 | 1% |
| CVE-2022-3427 | corner-ad (WordPress plugin) | The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to miss | high | 8.8 | 1% |
| CVE-2015-1785 | nextgen-gallery (WordPress plugin) | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we | medium | 6.5 | 1% |
| CVE-2019-12246 | silverstripe/framework | SilverStripe Denial of Service on flush and development URL tools | medium | 4.3 | 1% |
| CVE-2020-13663 | drupal/core, drupal/drupal | The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other v | high | 8.8 | 1% |
| CVE-2016-10876 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 4.3.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15840 | facebook-for-woocommerce (WordPress plugin) | The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15841 | facebook-for-woocommerce (WordPress plugin) | The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, | high | 8.8 | 1% |
| CVE-2019-15329 | import-users-from-csv-with-meta (WordPress plugin) | The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15770 | woo-address-book (WordPress plugin) | The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks. | high | 8.8 | 1% |
| CVE-2019-15779 | insta-gallery (WordPress plugin) | The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete. | high | 8.8 | 1% |
| CVE-2021-24711 | software-license-manager (WordPress plugin) | The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vu | high | 8.8 | 1% |
| CVE-2022-2541 | ucontext-for-amazon (WordPress plugin) | The uContext for Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and incl | high | 8.8 | 1% |
| CVE-2016-10918 | gallery-by-supsystic (WordPress plugin) | The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18504 | twitter-cards-meta (WordPress plugin) | The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2020-12076 | data-tables-generator (WordPress plugin) | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this | high | 8.8 | 1% |
| CVE-2020-13155 | nukeviet/nukeviet | NukeViet Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2015-5335 | moodle/moodle | Moodle cross-site request forgery (CSRF) vulnerability | medium | 4.3 | 1% |
| CVE-2019-14679 | arprice-responsive-pricing-table (WordPress plugin) | core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF. | medium | 6.5 | 1% |
| CVE-2020-23960 | forkcms/forkcms | Cross-Site Request Forgery in ForkCMS | high | 8.8 | 1% |