Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-15779 | insta-gallery (WordPress plugin) | The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete. | high | 8.8 | 1% |
| CVE-2021-24711 | software-license-manager (WordPress plugin) | The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vu | high | 8.8 | 1% |
| CVE-2022-2541 | ucontext-for-amazon (WordPress plugin) | The uContext for Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and incl | high | 8.8 | 1% |
| CVE-2016-10918 | gallery-by-supsystic (WordPress plugin) | The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18504 | twitter-cards-meta (WordPress plugin) | The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2020-12076 | data-tables-generator (WordPress plugin) | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this | high | 8.8 | 1% |
| CVE-2020-13155 | nukeviet/nukeviet | NukeViet Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2015-5335 | moodle/moodle | Moodle cross-site request forgery (CSRF) vulnerability | medium | 4.3 | 1% |
| CVE-2019-14679 | arprice-responsive-pricing-table (WordPress plugin) | core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF. | medium | 6.5 | 1% |
| CVE-2020-23960 | forkcms/forkcms | Cross-Site Request Forgery in ForkCMS | high | 8.8 | 1% |
| CVE-2019-15645 | zoho-salesiq (WordPress plugin) | The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-25073 | wp125 (WordPress plugin) | The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to | high | 8.8 | 1% |
| CVE-2015-9425 | social-locker (WordPress plugin) | The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license | medium | 5.4 | 1% |
| CVE-2018-20964 | contact-form-to-email (WordPress plugin) | The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-21002 | js-support-ticket (WordPress plugin) | The js-support-ticket plugin before 2.0.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2020-9394 | pricing-table-by-supsystic (WordPress plugin) | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF. | high | 8.8 | 1% |
| CVE-2011-5328 | user-access-manager (WordPress plugin) | The user-access-manager plugin before 1.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2014-10381 | user-domain-whitelist (WordPress plugin) | The user-domain-whitelist plugin before 1.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2015-9343 | wp-rollback (WordPress plugin) | The wp-rollback plugin before 1.2.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10885 | wp-editor (WordPress plugin) | The wp-editor plugin before 1.2.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10902 | wp-customer-reviews (WordPress plugin) | The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools. | high | 8.8 | 1% |
| CVE-2016-10903 | godaddy-email-marketing-sign-up-forms (WordPress plugin) | The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10914 | add-from-server (WordPress plugin) | The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file. | high | 8.8 | 1% |
| CVE-2016-10915 | popup-by-supsystic (WordPress plugin) | The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15660 | wp-members (WordPress plugin) | The wp-members plugin before 3.2.8 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-34632 | seo-backlinks (WordPress plugin) | The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the loc_config function found in the ~/seo-backlinks.php | high | 8.8 | 1% |
| CVE-2021-34633 | youtube-feeder (WordPress plugin) | The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feede | high | 8.8 | 1% |
| CVE-2016-10874 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 4.3.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10978 | fossura-tag-miner (WordPress plugin) | The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2022-0505 | microweber/microweber | Cross-Site Request Forgery in microweber | medium | 6.5 | 1% |
| CVE-2019-14683 | import-users-from-csv-with-meta (WordPress plugin) | The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attac | medium | 5.7 | 1% |
| CVE-2022-2542 | ucontext (WordPress plugin) | The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and i | high | 8.8 | 1% |
| CVE-2019-13376 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2022-2233 | banner-cycler (WordPress plugin) | The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to miss | high | 8.8 | 1% |
| CVE-2019-20390 | intelliants/subrion | Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability | high | 8.1 | 1% |
| CVE-2013-7476 | simple-fields (WordPress plugin) | The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface. | high | 8.8 | 1% |
| CVE-2015-9322 | erident-custom-login-and-dashboard (WordPress plugin) | The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18523 | eelv-newsletter (WordPress plugin) | The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book. | high | 8.8 | 1% |
| CVE-2017-18569 | my-wp-translate (WordPress plugin) | The my-wp-translate plugin before 1.0.4 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-21006 | bbp-move-topics (WordPress plugin) | The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15113 | companion-sitemap-generator (WordPress plugin) | The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15114 | formcraft-form-builder (WordPress plugin) | The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15115 | peters-login-redirect (WordPress plugin) | The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-20846 | push-notifications-for-wp (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker | high | 8.8 | 1% |
| CVE-2015-9387 | mtouch-quiz (WordPress plugin) | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF. | medium | 6.5 | 1% |
| CVE-2015-9388 | mtouch-quiz (WordPress plugin) | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS. | medium | 6.5 | 1% |
| CVE-2015-9417 | testimonial-slider (WordPress plugin) | The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS. | medium | 6.5 | 1% |
| CVE-2021-24178 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forge | high | 8.8 | 1% |
| CVE-2021-24179 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forge | high | 8.8 | 1% |
| CVE-2015-9394 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php. | high | 8.8 | 1% |