Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-33541 | miraheze/ts-portal | TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service | medium | 6.5 | 0% |
| CVE-2024-1328 | newsletter2go (WordPress plugin) | The Newsletter2Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-5867 | delicate (WordPress theme) | The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode i | medium | 6.4 | 0% |
| CVE-2024-7054 | popup-maker (WordPress plugin) | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2022-1626 | sharebar (WordPress plugin) | The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to mak | medium | 5.4 | 0% |
| CVE-2022-1818 | multi-page-toolkit (WordPress plugin) | The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attacker | medium | 5.4 | 0% |
| CVE-2023-4247 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing | medium | 5.4 | 0% |
| CVE-2025-2290 | lifterlms (WordPress plugin) | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a | medium | 5.3 | 0% |
| CVE-2025-10054 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-1668 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check | medium | 4.3 | 0% |
| CVE-2025-9821 | mautic/core | Mautic vulnerable to SSRF via webhook function | low | 2.7 | 0% |
| CVE-2026-32272 | craftcms/commerce | Craft Commerce hasVariant/hasProduct Blind SQL Injection | high | 0.0 | 0% |
| CVE-2023-5511 | snipe/snipe-it | Cross-Site Request Forgery (CSRF) in snipe/snipe-it | high | 8.8 | 0% |
| CVE-2025-67850 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | high | 7.3 | 0% |
| CVE-2023-52124 | wp-tabs (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs – Responsive | medium | 6.5 | 0% |
| CVE-2026-46362 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check | medium | 6.5 | 0% |
| CVE-2024-8962 | wpbits-addons-for-elementor (WordPress plugin) | The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all v | medium | 6.4 | 0% |
| CVE-2022-3025 | bitcoin\/altcoin-faucet (WordPress plugin) | The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make | medium | 5.4 | 0% |
| CVE-2023-2717 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to mi | medium | 5.4 | 0% |
| CVE-2024-1219 | easy-social-feed (WordPress plugin) | The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.3 | 0% |
| CVE-2025-10929 | drupal/reverse_proxy_header | This module allows you to specify an HTTP header name to determine the client's IP address. The module doesn't sufficie | medium | 5.3 | 0% |
| CVE-2024-0830 | wp-comment-fields (WordPress plugin) | The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-1642 | mainwp (WordPress plugin) | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2026-54244 | statamic/cms | Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors | low | 3.5 | 0% |
| CVE-2022-31114 | backpack/crud | backpack/crud is vulnerable to Cross-Site Scripting (XSS) | medium | 0.0 | 0% |
| CVE-2025-59017 | typo3/cms-backend, typo3/cms-beuser, typo3/cms-dashboard +2 more | TYPO3 backend modules have Broken Access Control | medium | 0.0 | 0% |
| CVE-2026-42137 | getkirby/cms | Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API | high | 0.0 | 0% |
| CVE-2026-34989 | ci4-cms-erp/ci4ms | CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.0 | 0% |
| CVE-2026-35676 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation | high | 8.2 | 0% |
| CVE-2026-47260 | phanan/koel | Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs | high | 7.7 | 0% |
| CVE-2024-12851 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulner | medium | 6.4 | 0% |
| CVE-2024-12852 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_cmc_text' parameter of the Happ | medium | 6.4 | 0% |
| CVE-2025-3614 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a | medium | 6.4 | 0% |
| CVE-2024-13838 | uncanny-automator (WordPress plugin) | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side R | medium | 5.5 | 0% |
| CVE-2021-24988 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboa | medium | 5.4 | 0% |
| CVE-2023-1867 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 5.4 | 0% |
| CVE-2023-1870 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 4.3 | 0% |
| CVE-2025-3452 | secupress (WordPress plugin) | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-4353 | concrete5/concrete5 | Concrete CMS vulnerable to Stored Cross-site Scripting | low | 3.1 | 0% |
| CVE-2024-47780 | typo3/cms-backend | Information Disclosure in TYPO3 Page Tree | low | 3.1 | 0% |
| CVE-2026-46722 | tpwd/ke_search | TYPO3 ke_search XML External Entity Injection | medium | 0.0 | 0% |
| CVE-2026-34375 | wwbn/avideo | AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page | high | 8.2 | 0% |
| CVE-2026-33492 | wwbn/avideo | AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration | high | 7.3 | 0% |
| CVE-2023-0735 | wallabag/wallabag | Cross-Site Request Forgery (CSRF) in wallabag/wallabag | medium | 6.5 | 0% |
| CVE-2023-0889 | themeflection-numbers (WordPress plugin) | Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that t | medium | 6.5 | 0% |
| CVE-2026-61455 | getgrav/grav | Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits | medium | 6.5 | 0% |
| CVE-2024-13564 | rife-elementor-extensions (WordPress plugin) | The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Writing Effect | medium | 6.4 | 0% |
| CVE-2024-13565 | simple-map-no-api (WordPress plugin) | The Simple Map No Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-13648 | maps-for-wp (WordPress plugin) | The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2024-13672 | mini-course-generator (WordPress plugin) | The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |