Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-15086 | drupal/raw_formatter | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-88023 | mongodb/mongodb | MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs | medium | 0.0 | 0% |
| CVE-2026-52793 | froxlor/froxlor | Froxlor's API Authentication bypasses 2FA Authentication | high | 8.1 | 0% |
| CVE-2026-2896 | funadmin/funadmin | funadmin has Incorrect Privilege Assignment in its Configuration Handler | high | 7.3 | 0% |
| CVE-2025-0521 | post-smtp (WordPress plugin) | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, an | high | 7.2 | 0% |
| CVE-2023-0737 | wallabag/wallabag | CSRF leading to delete account in wallabag/wallabag | medium | 6.5 | 0% |
| CVE-2024-9601 | qubely (WordPress plugin) | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' par | medium | 6.5 | 0% |
| CVE-2026-71537 | paymenter/paymenter | Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade) | medium | 6.5 | 0% |
| CVE-2024-13223 | tabulate (WordPress plugin) | The Tabulate WordPress plugin through 2.10.3 does not sanitise and escape some parameters before outputting them back in the page, leading t | medium | 6.1 | 0% |
| CVE-2024-6018 | music-request-manager (WordPress plugin) | The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an | medium | 6.1 | 0% |
| CVE-2024-6072 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it ba | medium | 6.1 | 0% |
| CVE-2024-8056 | mm-breaking-news (WordPress plugin) | The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an at | medium | 6.1 | 0% |
| CVE-2025-61457 | code16/sharp | code16 Sharp vulnerable to Cross Site Scripting (XSS) | medium | 6.1 | 0% |
| CVE-2024-13101 | wp-mediatagger (WordPress plugin) | The WP MediaTagger WordPress plugin through 4.1.1 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2025-3422 | everest-forms (WordPress plugin) | The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to ar | medium | 5.4 | 0% |
| CVE-2024-9770 | wp-recall (WordPress plugin) | The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins | medium | 4.7 | 0% |
| CVE-2022-3098 | login-block-ips (WordPress plugin) | The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2024-6872 | templatespare (WordPress plugin) | The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenber | medium | 4.3 | 0% |
| CVE-2025-0660 | concrete5/concrete5 | Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality | medium | 0.0 | 0% |
| CVE-2026-55479 | snipe/snipe-it | Snipe-IT has incorrect permission for legacy license checkin API | medium | 0.0 | 0% |
| CVE-2026-63493 | snipe/snipe-it | Snipe-IT: 2FA bypass via the API token flow | high | 0.0 | 0% |
| CVE-2026-81269 | drupal/datafield | This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoi | unknown | 0.0 | 0% |
| CVE-2023-1033 | froxlor/froxlor | Froxlor Cross-Site Request Forgery vulnerability | high | 8.8 | 0% |
| CVE-2024-4535 | kkprogressbar2 (WordPress plugin) | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logg | high | 8.8 | 0% |
| CVE-2024-0249 | advanced-schedule-posts (WordPress plugin) | The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, l | high | 7.1 | 0% |
| CVE-2024-9068 | oneelements-ultimate-addons-for-elementor (WordPress plugin) | The OneElements – Best Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versio | medium | 6.4 | 0% |
| CVE-2024-9069 | graphicsly (WordPress plugin) | The Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) plugin for Wo | medium | 6.4 | 0% |
| CVE-2023-7228 | illi-link-party\! (WordPress plugin) | The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to | medium | 6.1 | 0% |
| CVE-2020-23136 | microweber/microweber | Microweber Insufficient Session Expiry | medium | 5.5 | 0% |
| CVE-2024-1125 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capa | medium | 5.4 | 0% |
| CVE-2024-11502 | planning-center-online-giving (WordPress plugin) | The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before output | medium | 5.4 | 0% |
| CVE-2024-12722 | twitter-bootstrap-collapse-aka-accordian-shortcode (WordPress plugin) | The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attri | medium | 5.4 | 0% |
| CVE-2024-6668 | profilepro (WordPress plugin) | The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow | medium | 5.4 | 0% |
| CVE-2024-6718 | pvn-auth-popup (WordPress plugin) | The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2023-4975 | coming-soon (WordPress plugin) | The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1 | medium | 4.3 | 0% |
| CVE-2025-3647 | moodle/moodle | Moodle allows IDOR when accessing the cohorts report | medium | 4.3 | 0% |
| CVE-2024-10554 | wp-advanced-search (WordPress plugin) | The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high p | low | 3.5 | 0% |
| CVE-2024-10560 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege | low | 3.5 | 0% |
| CVE-2026-112065 | sgalinski/sg-cookie-optin | TYPO3-EXT-SA-2026-029: Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin) | unknown | 0.0 | 0% |
| CVE-2026-112068 | t3g/analytics | TYPO3-EXT-SA-2026-031: Insecure Direct Object Reference in extension "Analytics" (analytics) | unknown | 0.0 | 0% |
| CVE-2026-112070 | t3g/analytics | TYPO3-EXT-SA-2026-031: Broken Access Control in extension "Analytics" (analytics) | unknown | 0.0 | 0% |
| CVE-2026-44737 | getgrav/grav | Grav: Stored XSS via page title (data[header][title]) in admin panel | medium | 0.0 | 0% |
| CVE-2026-34568 | ci4-cms-erp/ci4ms | CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2026-27196 | statamic/cms | Statamic affected by privilege escalation via stored cross-site scripting | high | 8.1 | 0% |
| CVE-2024-13618 | downloadable-by-american-osteopathic-association (WordPress plugin) | The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowi | high | 7.2 | 0% |
| CVE-2026-41671 | admidio/admidio | Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation | medium | 6.8 | 0% |
| CVE-2024-10342 | league-of-legends-shortcodes (WordPress plugin) | The League of Legends Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-13868 | url-shortener-\|-conversion-tracking-\|-ab-testing-\|-woocommerce (WordPress plugin) | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape a parameter | medium | 6.1 | 0% |
| CVE-2024-3966 | pray-for-me (WordPress plugin) | The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform | medium | 6.1 | 0% |
| CVE-2024-10105 | jobs-for-wordpress (WordPress plugin) | The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 5.9 | 0% |