Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-25491 | craftcms/cms | Craft CMS Vulnerable to Stored XSS in Entry Types Name | low | 0.0 | 0% |
| CVE-2026-55803 | drupal/core | [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) added protection for fields that store serialized data to di | unknown | 0.0 | 0% |
| CVE-2026-55804 | drupal/core | Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists | unknown | 0.0 | 0% |
| CVE-2026-52767 | yeswiki/yeswiki | YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)` | high | 8.2 | 0% |
| CVE-2026-62232 | getgrav/grav | Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge | high | 7.4 | 0% |
| CVE-2023-1623 | custom-post-type-ui (WordPress plugin) | The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplie | medium | 6.5 | 0% |
| CVE-2024-5654 | cf7-google-sheets-connector (WordPress plugin) | The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 6.5 | 0% |
| CVE-2024-6332 | ameliabooking (WordPress plugin) | The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of da | medium | 6.5 | 0% |
| CVE-2024-13155 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split He | medium | 6.4 | 0% |
| CVE-2024-5686 | wpzoom-elementor-addons (WordPress plugin) | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribu | medium | 6.4 | 0% |
| CVE-2024-43439 | moodle/moodle | Moodle reflected XSS via H5P error message | medium | 5.4 | 0% |
| CVE-2022-4023 | 3dprint (WordPress plugin) | The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with | medium | 5.3 | 0% |
| CVE-2024-12713 | sureforms (WordPress plugin) | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, a | medium | 5.3 | 0% |
| CVE-2024-3634 | month-name-translation-benaceur (WordPress plugin) | The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2024-7716 | gs-logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-1469 | wp-express-checkout (WordPress plugin) | The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions u | medium | 4.4 | 0% |
| CVE-2023-1840 | spotify-play-button-for-wordpress (WordPress plugin) | The Sp*tify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to | medium | 4.4 | 0% |
| CVE-2024-6691 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to | medium | 4.4 | 0% |
| CVE-2012-10017 | portfolio (WordPress plugin) | A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an un | medium | 4.3 | 0% |
| CVE-2024-0779 | enjoy-social-feed (WordPress plugin) | The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function h | high | 8.8 | 0% |
| CVE-2025-3192 | spatie/browsershot | Browsershot Server-Side Request Forgery (SSRF) via setURL() Function | high | 8.2 | 0% |
| CVE-2026-38530 | krayin/laravel-crm | Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php | high | 8.1 | 0% |
| CVE-2026-38532 | krayin/laravel-crm | Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php | high | 8.1 | 0% |
| CVE-2026-42551 | flightphp/core | Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass | high | 7.5 | 0% |
| CVE-2025-0817 | formcraft (WordPress plugin) | The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3 | high | 7.2 | 0% |
| CVE-2023-50893 | impreza (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution Impreza – WordPress Website | high | 7.1 | 0% |
| CVE-2023-51501 | uncode (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce | high | 7.1 | 0% |
| CVE-2024-13571 | post-timeline (WordPress plugin) | The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to | high | 7.1 | 0% |
| CVE-2024-13631 | om-stripe (WordPress plugin) | The Om Stripe WordPress plugin through 02.00.00 does not sanitise and escape a parameter before outputting it back in the page, leading to a | high | 7.1 | 0% |
| CVE-2026-55212 | pimcore/studio-backend-bundle | Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation | high | 7.1 | 0% |
| CVE-2022-4024 | pie-register (WordPress plugin) | The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, | medium | 6.5 | 0% |
| CVE-2024-29932 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Tax | medium | 6.5 | 0% |
| CVE-2025-2575 | z-companion (WordPress plugin) | The Z Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, | medium | 6.4 | 0% |
| CVE-2024-4934 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them | medium | 5.5 | 0% |
| CVE-2025-12426 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is | medium | 5.3 | 0% |
| CVE-2024-11183 | simple-side-tab (WordPress plugin) | The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-3918 | pet-manager (WordPress plugin) | The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2024-4621 | arforms (WordPress plugin) | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which cou | medium | 4.8 | 0% |
| CVE-2024-5529 | wp-quicklatex (WordPress plugin) | The WP QuickLaTeX WordPress plugin before 3.8.8 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2023-5537 | delete-usermetas (WordPress plugin) | The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to | medium | 4.3 | 0% |
| CVE-2024-5453 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2024-7622 | revision-manager-tmc (WordPress plugin) | The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2024-8434 | themehunk-megamenu-plus (WordPress plugin) | The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability ch | medium | 4.3 | 0% |
| CVE-2024-13311 | drupal/all_extensions | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-49865 | kimai/kimai | Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs | medium | 0.0 | 0% |
| CVE-2026-50282 | craftcms/cms | Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves | high | 0.0 | 0% |
| CVE-2026-77127 | codingms/modules | TYPO3-EXT-SA-2026-016: Information Disclosure in extension "Modules" (modules) | unknown | 0.0 | 0% |
| CVE-2026-77130 | syssy/syssy-typo3-extension | TYPO3-EXT-SA-2026-015: Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy) | unknown | 0.0 | 0% |
| CVE-2026-77133 | in2code/femanager | TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager) | unknown | 0.0 | 0% |
| CVE-2026-77145 | jweiland/events2 | TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2) | unknown | 0.0 | 0% |