Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-55877 | symfony/ux-icons | symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses | medium | 6.1 | 0% |
| CVE-2026-71435 | statamic/cms | Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template | medium | 6.1 | 0% |
| CVE-2026-52772 | yeswiki/yeswiki | YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html')) | medium | 5.5 | 0% |
| CVE-2024-10637 | gutenberg-blocks-with-ai (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before out | medium | 5.4 | 0% |
| CVE-2026-54717 | silverstripe/cms | Silverstripe: XSS in breadcrumbs in page list view | medium | 5.4 | 0% |
| CVE-2026-55779 | silverstripe/versioned | silverstripe/versioned has XSS in archive admin restore | medium | 5.4 | 0% |
| CVE-2026-56826 | shopper/framework | Shopping privilege escalation through missing authorization in Settings components | medium | 5.4 | 0% |
| CVE-2024-3944 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 1.3.0 due t | medium | 4.4 | 0% |
| CVE-2023-46152 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 | medium | 4.3 | 0% |
| CVE-2025-3627 | moodle/moodle | Moodle makes some user data available before completing second factor with MFA enabled | medium | 4.3 | 0% |
| CVE-2026-45064 | symfony/html-sanitizer, symfony/symfony | Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing | medium | 0.0 | 0% |
| CVE-2026-45066 | symfony/html-sanitizer, symfony/symfony | Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification | medium | 0.0 | 0% |
| CVE-2026-48760 | symfony/html-sanitizer, symfony/symfony | Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defens | medium | 0.0 | 0% |
| CVE-2026-49210 | symfony/ux-live-component | symfony/ux-live-component: XSS via attacker-controlled child component tag | medium | 0.0 | 0% |
| CVE-2021-47763 | aimeos/aimeos-laravel | Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter | high | 8.2 | 0% |
| CVE-2026-46366 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query | high | 7.5 | 0% |
| CVE-2024-8918 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This | high | 7.4 | 0% |
| CVE-2023-2079 | buymeacoffee (WordPress plugin) | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce valid | high | 7.1 | 0% |
| CVE-2023-2179 | woocommerce-order-status-change-notifier (WordPress plugin) | The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders | medium | 6.5 | 0% |
| CVE-2024-31108 | iflychat (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iFlyChat Team iFlyChat – WordPress Cha | medium | 6.5 | 0% |
| CVE-2024-10091 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all ve | medium | 6.4 | 0% |
| CVE-2023-2277 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due t | medium | 6.1 | 0% |
| CVE-2024-11400 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really | medium | 6.1 | 0% |
| CVE-2022-27855 | analytics-cat (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change. | medium | 5.4 | 0% |
| CVE-2022-32587 | wp-page-widget (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change. | medium | 5.4 | 0% |
| CVE-2022-43481 | advanced-coupons-for-woocommerce-free (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dis | medium | 5.4 | 0% |
| CVE-2024-10970 | motors-car-dealership-classified-listings (WordPress plugin) | The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to | medium | 5.4 | 0% |
| CVE-2024-56410 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties | medium | 5.4 | 0% |
| CVE-2024-4899 | seopress (WordPress plugin) | The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users suc | medium | 5.0 | 0% |
| CVE-2024-0656 | password-protected (WordPress plugin) | The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Stored C | medium | 4.4 | 0% |
| CVE-2024-0658 | insert-php-code-snippet (WordPress plugin) | The Insert PHP Code Snippet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's name when accessing the insert- | medium | 4.4 | 0% |
| CVE-2022-29489 | sucuri-scanner (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin <= 1.8.33 at WordPress leading to Event log entry creation. | medium | 4.3 | 0% |
| CVE-2023-1086 | preview-link-generator (WordPress plugin) | The Preview Link Generator WordPress plugin before 1.0.4 does not have CSRF check when activating plugins, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2024-13430 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to | medium | 4.3 | 0% |
| CVE-2024-43427 | moodle/moodle | Moodle admin presets export tool includes some secrets that should not be exported | low | 3.7 | 0% |
| CVE-2026-102601 | league/flysystem | Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting | low | 3.5 | 0% |
| CVE-2026-44012 | craftcms/cms | Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure | high | 0.0 | 0% |
| CVE-2025-13000 | db-access (WordPress plugin) | The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscr | high | 7.7 | 0% |
| CVE-2023-7294 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capabili | high | 7.1 | 0% |
| CVE-2023-5382 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to | medium | 6.5 | 0% |
| CVE-2024-29804 | fancy-comments (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Fancy Comments WordPress | medium | 6.5 | 0% |
| CVE-2026-54164 | api-platform/core | API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion) | medium | 6.5 | 0% |
| CVE-2025-3888 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and inclu | medium | 6.4 | 0% |
| CVE-2024-10250 | nioland (WordPress theme) | The Nioland theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in all versions up to, and including, | medium | 6.1 | 0% |
| CVE-2024-6074 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.1 | 0% |
| CVE-2024-9382 | gantry (WordPress plugin) | The Gantry 4 Framework plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'override_id' parameter in all versions | medium | 6.1 | 0% |
| CVE-2024-9653 | menu-ordering-reservations (WordPress plugin) | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the | medium | 6.1 | 0% |
| CVE-2023-51536 | crm-perks-forms (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms – WordPress | medium | 5.9 | 0% |
| CVE-2024-13113 | countdown-timer-for-elementor (WordPress plugin) | The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the pag | medium | 5.9 | 0% |
| CVE-2021-36854 | booking-ultra-pro (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress. | medium | 5.4 | 0% |