Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-18366 | intelliants/subrion | Subrion CMS vulnerable to CSRF in blog/delete | high | 8.8 | 1% |
| CVE-2018-16387 | elefant/cms | Elefant CMS CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2017-18510 | custom-sidebars (WordPress plugin) | The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions. | high | 8.8 | 1% |
| CVE-2017-18511 | custom-sidebars (WordPress plugin) | The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18512 | newsletter-by-supsystic (WordPress plugin) | The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18513 | responsive-menu (WordPress plugin) | The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface. | high | 8.8 | 1% |
| CVE-2017-18544 | invite-anyone (WordPress plugin) | The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF. | high | 8.8 | 1% |
| CVE-2017-18546 | jayj-quicktag (WordPress plugin) | The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18547 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms. | high | 8.8 | 1% |
| CVE-2018-20967 | wp-ultimate-csv-importer (WordPress plugin) | The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-20968 | wp-ultimate-exporter (WordPress plugin) | The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-20971 | church-admin (WordPress plugin) | The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan. | high | 8.8 | 1% |
| CVE-2018-20972 | companion-auto-update (WordPress plugin) | The companion-auto-update plugin before 3.2.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-20974 | js-jobs (WordPress plugin) | The js-jobs plugin before 1.0.7 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-6357 | acurax-social-media-widget (WordPress plugin) | The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via th | high | 8.8 | 1% |
| CVE-2022-2001 | dx-share-selection (WordPress plugin) | The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to | high | 8.8 | 1% |
| CVE-2022-2039 | livesupporti (WordPress plugin) | The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is | high | 8.8 | 1% |
| CVE-2021-24500 | workreap (WordPress plugin) | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct obj | high | 8.1 | 1% |
| CVE-2022-0134 | anycomment (WordPress plugin) | The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers | high | 8.8 | 1% |
| CVE-2022-0914 | export-all-urls (WordPress plugin) | The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logge | medium | 6.5 | 1% |
| CVE-2021-24763 | perfect-survey (WordPress plugin) | The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, | high | 8.8 | 1% |
| CVE-2018-5368 | srbtranslatin (WordPress plugin) | The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2018-5658 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php. | high | 8.8 | 1% |
| CVE-2020-1692 | moodle/moodle | Cross-Site Request Forgery in Moodle | medium | 6.5 | 1% |
| CVE-2021-3944 | ssddanbrown/bookstack | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) | low | 3.1 | 1% |
| CVE-2021-41113 | typo3/cms, typo3/cms-core | Cross-Site-Request-Forgery in Backend | high | 8.8 | 1% |
| CVE-2021-24487 | st-daily-tip (WordPress plugin) | The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' set | high | 8.8 | 1% |
| CVE-2017-8099 | whizz (WordPress plugin) | There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's statu | high | 8.1 | 1% |
| CVE-2021-34645 | wp-easycart (WordPress plugin) | The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function fou | high | 8.8 | 1% |
| CVE-2022-2443 | freemind-wp-browser (WordPress plugin) | The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due t | high | 8.8 | 1% |
| CVE-2021-4168 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.3 | 1% |
| CVE-2021-24620 | simple-e-commerce-shopping-cart (WordPress plugin) | The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downl | high | 8.8 | 1% |
| CVE-2021-24804 | simple-jwt-login (WordPress plugin) | The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged | high | 8.8 | 1% |
| CVE-2019-19979 | wp-maintenance (WordPress plugin) | A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject mal | high | 8.8 | 1% |
| CVE-2021-24696 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks | high | 8.8 | 1% |
| CVE-2020-23264 | forkcms/forkcms | Cross-Site Request Forgery in forkcms | high | 8.8 | 1% |
| CVE-2021-24803 | core-tweaks-wp-setup (WordPress plugin) | The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as c | high | 8.8 | 1% |
| CVE-2022-0499 | sermon-browser (WordPress plugin) | The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate th | high | 8.8 | 1% |
| CVE-2022-3568 | imagemagick-engine (WordPress plugin) | The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up | high | 8.8 | 1% |
| CVE-2021-34636 | countdown-wpdevart-extended (WordPress plugin) | The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function | high | 8.8 | 1% |
| CVE-2021-42358 | contact-form-with-captcha (WordPress plugin) | The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-for | high | 8.8 | 1% |
| CVE-2021-42364 | stetic (WordPress plugin) | The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in | high | 8.8 | 1% |
| CVE-2019-15648 | insert-or-embed-articulate-content-into-wordpress (WordPress plugin) | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renam | medium | 6.5 | 1% |
| CVE-2021-43559 | moodle/moodle | Moodle contains CSRF vulnerability | high | 8.8 | 1% |
| CVE-2022-1611 | bulk-page-creator (WordPress plugin) | The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them v | high | 8.8 | 1% |
| CVE-2019-14327 | custom-simple-rss (WordPress plugin) | A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings. | medium | 6.5 | 1% |
| CVE-2020-36505 | delete-all-comments-easily (WordPress plugin) | The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an un | medium | 6.5 | 1% |
| CVE-2021-24704 | orange-form (WordPress plugin) | In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared | high | 8.8 | 1% |
| CVE-2017-8875 | clean-login (WordPress plugin) | CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL. | medium | 6.5 | 1% |
| CVE-2022-1912 | smartsoftbutton-widget-de-botones-de-chat (WordPress plugin) | The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This i | high | 8.8 | 1% |