Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-15645 | zoho-salesiq (WordPress plugin) | The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-25073 | wp125 (WordPress plugin) | The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to | high | 8.8 | 1% |
| CVE-2015-9425 | social-locker (WordPress plugin) | The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license | medium | 5.4 | 1% |
| CVE-2018-20964 | contact-form-to-email (WordPress plugin) | The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-21002 | js-support-ticket (WordPress plugin) | The js-support-ticket plugin before 2.0.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2020-9394 | pricing-table-by-supsystic (WordPress plugin) | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF. | high | 8.8 | 1% |
| CVE-2011-5328 | user-access-manager (WordPress plugin) | The user-access-manager plugin before 1.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2014-10381 | user-domain-whitelist (WordPress plugin) | The user-domain-whitelist plugin before 1.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2015-9343 | wp-rollback (WordPress plugin) | The wp-rollback plugin before 1.2.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10885 | wp-editor (WordPress plugin) | The wp-editor plugin before 1.2.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10902 | wp-customer-reviews (WordPress plugin) | The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools. | high | 8.8 | 1% |
| CVE-2016-10903 | godaddy-email-marketing-sign-up-forms (WordPress plugin) | The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10914 | add-from-server (WordPress plugin) | The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file. | high | 8.8 | 1% |
| CVE-2016-10915 | popup-by-supsystic (WordPress plugin) | The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15660 | wp-members (WordPress plugin) | The wp-members plugin before 3.2.8 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-34632 | seo-backlinks (WordPress plugin) | The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the loc_config function found in the ~/seo-backlinks.php | high | 8.8 | 1% |
| CVE-2021-34633 | youtube-feeder (WordPress plugin) | The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feede | high | 8.8 | 1% |
| CVE-2016-10874 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 4.3.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10978 | fossura-tag-miner (WordPress plugin) | The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2022-0505 | microweber/microweber | Cross-Site Request Forgery in microweber | medium | 6.5 | 1% |
| CVE-2019-14683 | import-users-from-csv-with-meta (WordPress plugin) | The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attac | medium | 5.7 | 1% |
| CVE-2022-2542 | ucontext (WordPress plugin) | The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and i | high | 8.8 | 1% |
| CVE-2019-13376 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2022-2233 | banner-cycler (WordPress plugin) | The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to miss | high | 8.8 | 1% |
| CVE-2019-20390 | intelliants/subrion | Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability | high | 8.1 | 1% |
| CVE-2013-7476 | simple-fields (WordPress plugin) | The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface. | high | 8.8 | 1% |
| CVE-2015-9322 | erident-custom-login-and-dashboard (WordPress plugin) | The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18523 | eelv-newsletter (WordPress plugin) | The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book. | high | 8.8 | 1% |
| CVE-2017-18569 | my-wp-translate (WordPress plugin) | The my-wp-translate plugin before 1.0.4 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-21006 | bbp-move-topics (WordPress plugin) | The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15113 | companion-sitemap-generator (WordPress plugin) | The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15114 | formcraft-form-builder (WordPress plugin) | The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15115 | peters-login-redirect (WordPress plugin) | The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-20846 | push-notifications-for-wp (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker | high | 8.8 | 1% |
| CVE-2015-9387 | mtouch-quiz (WordPress plugin) | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF. | medium | 6.5 | 1% |
| CVE-2015-9388 | mtouch-quiz (WordPress plugin) | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS. | medium | 6.5 | 1% |
| CVE-2015-9417 | testimonial-slider (WordPress plugin) | The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS. | medium | 6.5 | 1% |
| CVE-2021-24178 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forge | high | 8.8 | 1% |
| CVE-2021-24179 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forge | high | 8.8 | 1% |
| CVE-2015-9394 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php. | high | 8.8 | 1% |
| CVE-2021-25053 | wp-coder (WordPress plugin) | The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as | high | 8.8 | 1% |
| CVE-2017-18607 | avada (WordPress theme) | The avada theme before 5.1.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2020-36504 | wp-pro-quiz (WordPress plugin) | The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make | medium | 6.5 | 1% |
| CVE-2024-0623 | vk-block-patterns (WordPress plugin) | The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This | medium | 4.3 | 1% |
| CVE-2018-10233 | ultimate-member (WordPress plugin) | The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. T | high | 8.8 | 1% |
| CVE-2022-2540 | link-optimizer-lite (WordPress plugin) | The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and incl | high | 8.8 | 1% |
| CVE-2020-20726 | gilacms/gila | GilaCMS Cross Site Request Forgery vulnerability | high | 8.8 | 1% |
| CVE-2017-14530 | crony (WordPress plugin) | WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create ope | high | 8.0 | 1% |
| CVE-2022-2435 | anymind-widget (WordPress plugin) | The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to mis | high | 8.8 | 1% |
| CVE-2015-1786 | zendframework/zendframework, zendframework/zend-validator | Zend Framework CSRF Vulnerability | high | 8.8 | 1% |