Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-25053 | wp-coder (WordPress plugin) | The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as | high | 8.8 | 1% |
| CVE-2017-18607 | avada (WordPress theme) | The avada theme before 5.1.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2020-36504 | wp-pro-quiz (WordPress plugin) | The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make | medium | 6.5 | 1% |
| CVE-2024-0623 | vk-block-patterns (WordPress plugin) | The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This | medium | 4.3 | 1% |
| CVE-2018-10233 | ultimate-member (WordPress plugin) | The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. T | high | 8.8 | 1% |
| CVE-2022-2540 | link-optimizer-lite (WordPress plugin) | The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and incl | high | 8.8 | 1% |
| CVE-2020-20726 | gilacms/gila | GilaCMS Cross Site Request Forgery vulnerability | high | 8.8 | 1% |
| CVE-2017-14530 | crony (WordPress plugin) | WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create ope | high | 8.0 | 1% |
| CVE-2022-2435 | anymind-widget (WordPress plugin) | The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to mis | high | 8.8 | 1% |
| CVE-2015-1786 | zendframework/zendframework, zendframework/zend-validator | Zend Framework CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2017-18366 | intelliants/subrion | Subrion CMS vulnerable to CSRF in blog/delete | high | 8.8 | 1% |
| CVE-2018-16387 | elefant/cms | Elefant CMS CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2023-7014 | molongui-authorship (WordPress plugin) | The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure i | medium | 5.3 | 1% |
| CVE-2017-18510 | custom-sidebars (WordPress plugin) | The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions. | high | 8.8 | 1% |
| CVE-2017-18511 | custom-sidebars (WordPress plugin) | The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18512 | newsletter-by-supsystic (WordPress plugin) | The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18513 | responsive-menu (WordPress plugin) | The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface. | high | 8.8 | 1% |
| CVE-2017-18544 | invite-anyone (WordPress plugin) | The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF. | high | 8.8 | 1% |
| CVE-2017-18546 | jayj-quicktag (WordPress plugin) | The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18547 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms. | high | 8.8 | 1% |
| CVE-2018-20967 | wp-ultimate-csv-importer (WordPress plugin) | The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-20968 | wp-ultimate-exporter (WordPress plugin) | The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-20971 | church-admin (WordPress plugin) | The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan. | high | 8.8 | 1% |
| CVE-2018-20972 | companion-auto-update (WordPress plugin) | The companion-auto-update plugin before 3.2.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-20974 | js-jobs (WordPress plugin) | The js-jobs plugin before 1.0.7 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-6357 | acurax-social-media-widget (WordPress plugin) | The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via th | high | 8.8 | 1% |
| CVE-2022-2001 | dx-share-selection (WordPress plugin) | The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to | high | 8.8 | 1% |
| CVE-2022-2039 | livesupporti (WordPress plugin) | The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is | high | 8.8 | 1% |
| CVE-2021-24500 | workreap (WordPress plugin) | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct obj | high | 8.1 | 1% |
| CVE-2022-0134 | anycomment (WordPress plugin) | The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers | high | 8.8 | 1% |
| CVE-2022-0914 | export-all-urls (WordPress plugin) | The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logge | medium | 6.5 | 1% |
| CVE-2021-24763 | perfect-survey (WordPress plugin) | The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, | high | 8.8 | 1% |
| CVE-2018-5368 | srbtranslatin (WordPress plugin) | The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2018-5658 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php. | high | 8.8 | 1% |
| CVE-2020-1692 | moodle/moodle | Cross-Site Request Forgery in Moodle | medium | 6.5 | 1% |
| CVE-2021-3944 | ssddanbrown/bookstack | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) | low | 3.1 | 1% |
| CVE-2021-41113 | typo3/cms, typo3/cms-core | Cross-Site-Request-Forgery in Backend | high | 8.8 | 1% |
| CVE-2021-24487 | st-daily-tip (WordPress plugin) | The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' set | high | 8.8 | 1% |
| CVE-2017-8099 | whizz (WordPress plugin) | There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's statu | high | 8.1 | 1% |
| CVE-2021-34645 | wp-easycart (WordPress plugin) | The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function fou | high | 8.8 | 1% |
| CVE-2022-2443 | freemind-wp-browser (WordPress plugin) | The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due t | high | 8.8 | 1% |
| CVE-2021-4168 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.3 | 1% |
| CVE-2021-24620 | simple-e-commerce-shopping-cart (WordPress plugin) | The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downl | high | 8.8 | 1% |
| CVE-2021-24804 | simple-jwt-login (WordPress plugin) | The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged | high | 8.8 | 1% |
| CVE-2019-19979 | wp-maintenance (WordPress plugin) | A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject mal | high | 8.8 | 1% |
| CVE-2021-24696 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks | high | 8.8 | 1% |
| CVE-2020-23264 | forkcms/forkcms | Cross-Site Request Forgery in forkcms | high | 8.8 | 1% |
| CVE-2021-24803 | core-tweaks-wp-setup (WordPress plugin) | The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as c | high | 8.8 | 1% |
| CVE-2022-0499 | sermon-browser (WordPress plugin) | The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate th | high | 8.8 | 1% |
| CVE-2023-29290 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 5.3 | 1% |