Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0482 | alextselegidis/easyappointments | Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments | critical | 9.1 | 44% |
| CVE-2019-9787 | WordPress core | WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default conf | high | 8.8 | 39% |
| CVE-2016-6897 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress bef | medium | 6.5 | 29% |
| CVE-2022-1020 | woo-product-table (WordPress plugin) | The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_adm | critical | 9.8 | 26% |
| CVE-2019-12616 | phpmyadmin/phpmyadmin | phpMyAdmin CSRF Vulnerability | medium | 6.5 | 20% |
| CVE-2020-5776 | dweeves/magmi | Cross-Site Request Forgery in MAGMI | high | 8.8 | 15% |
| CVE-2022-1574 | html2wp (WordPress plugin) | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as | critical | 9.8 | 12% |
| CVE-2020-8417 | code-snippets (WordPress plugin) | The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu. | high | 8.8 | 12% |
| CVE-2022-0952 | sitemap (WordPress plugin) | The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, | high | 8.8 | 11% |
| CVE-2020-8615 | tutor-lms (WordPress plugin) | A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and | medium | 6.5 | 11% |
| CVE-2019-12922 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-Site Request Forgery (CSRF) | medium | 6.5 | 11% |
| CVE-2024-1538 | wp-file-manager (WordPress plugin) | The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due t | high | 8.8 | 11% |
| CVE-2020-8658 | htaccess (WordPress plugin) | The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The fla | high | 8.8 | 10% |
| CVE-2017-1000499 | phpmyadmin/phpmyadmin | phpMyAdmin CSRF Vulnerability | high | 8.8 | 8% |
| CVE-2021-25032 | capabilities (WordPress plugin) | The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have autho | critical | 9.8 | 7% |
| CVE-2024-4474 | wp-logs-book (WordPress plugin) | The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 6% |
| CVE-2014-5347 | disqus-comment-system (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attack | medium | 6.8 | 5% |
| CVE-2015-4010 | encrypted-contact-form (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hij | medium | 6.8 | 5% |
| CVE-2019-10874 | bolt/bolt | Bolt Cross Site Request Forgery (CSRF) | high | 8.8 | 5% |
| CVE-2022-0439 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `aja | high | 8.8 | 4% |
| CVE-2021-24581 | blue-admin (WordPress plugin) | The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading t | high | 8.8 | 4% |
| CVE-2018-10188 | phpmyadmin/phpmyadmin | phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution | high | 8.8 | 4% |
| CVE-2013-7233 | WordPress core | Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlie | medium | 6.8 | 4% |
| CVE-2015-2755 | ab-google-map-travel (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote | medium | 6.8 | 4% |
| CVE-2014-8948 | imember360 (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hi | medium | 6.8 | 4% |
| CVE-2024-6244 | pz-frontend-manager (WordPress plugin) | The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged i | high | 8.8 | 4% |
| CVE-2014-2598 | quick-pagepost-redirect-plugin (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to | medium | 6.8 | 3% |
| CVE-2015-3986 | thecartpress (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin | medium | 4.3 | 3% |
| CVE-2015-5731 | WordPress core | Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authent | medium | 6.8 | 3% |
| CVE-2018-14057 | pimcore/pimcore | Pimcore CSRF Vulnerability | high | 8.8 | 3% |
| CVE-2014-2559 | twitget (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote atta | medium | 6.8 | 3% |
| CVE-2012-1936 | WordPress core | The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a | medium | 6.8 | 3% |
| CVE-2021-24174 | database-backups (WordPress plugin) | The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted action | high | 8.1 | 3% |
| CVE-2013-2107 | mail-on-update (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack th | medium | 6.8 | 3% |
| CVE-2013-5977 | cart66-lite (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote a | medium | 6.8 | 3% |
| CVE-2019-14328 | simple-membership (WordPress plugin) | The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. | high | 8.8 | 3% |
| CVE-2021-24884 | formidable-form-builder (WordPress plugin) | The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.Th | critical | 9.6 | 3% |
| CVE-2021-24947 | responsive-vector-maps (WordPress plugin) | The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path par | medium | 6.5 | 3% |
| CVE-2015-6965 | contact-form-generator (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote | medium | 6.8 | 3% |
| CVE-2021-25052 | button-generation (WordPress plugin) | The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extens | high | 8.8 | 3% |
| CVE-2013-6797 | blue-wrench-videos-widget (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordP | medium | 6.8 | 3% |
| CVE-2014-4030 | jw-player-plugin-for-wordpress (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the aut | medium | 6.8 | 3% |
| CVE-2014-2340 | xcloner-backup-and-restore (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authe | medium | 6.8 | 3% |
| CVE-2013-4240 | hms-testimonials (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers | medium | 6.8 | 3% |
| CVE-2014-4717 | simple-share-buttons-adder (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordPress allow remote at | medium | 6.8 | 3% |
| CVE-2019-17675 | WordPress core | WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CS | high | 8.8 | 3% |
| CVE-2022-2846 | calendar-event-multi-view (WordPress plugin) | The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event | medium | 4.3 | 3% |
| CVE-2014-9099 | whydowork-adsense (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the auth | medium | 6.8 | 3% |
| CVE-2014-5346 | disqus-comment-system (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to | medium | 6.8 | 3% |
| CVE-2017-8382 | admidio/admidio | admidio CSRF Vulnerability | medium | 4.5 | 3% |