Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-36358 | ab-rankings-testing-tool (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout plugin <= 0.9.83 at WordPress allows attackers to trick users with administrati | medium | 5.4 | 0% |
| CVE-2024-10678 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks WordPress plugin before 3.2.4 does not validate and escape some of its block options before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2024-3288 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attri | medium | 5.4 | 0% |
| CVE-2026-55464 | snipe/snipe-it | Snipe-IT vulnerable to stored XSS via Markdown custom field | medium | 5.4 | 0% |
| CVE-2025-11564 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missin | medium | 5.3 | 0% |
| CVE-2020-26231 | october/cms | Bypass of fix for CVE-2020-15247, Twig sandbox escape | medium | 5.2 | 0% |
| CVE-2023-5691 | collectchat (WordPress plugin) | The Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insuf | medium | 4.4 | 0% |
| CVE-2022-4549 | tickera (WordPress plugin) | The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to mak | medium | 4.3 | 0% |
| CVE-2024-0431 | gestpay-for-woocommerce (WordPress plugin) | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. | medium | 4.3 | 0% |
| CVE-2026-90935 | froxlor/froxlor | Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API | medium | 4.3 | 0% |
| CVE-2023-2897 | brizy (WordPress plugin) | The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an | low | 3.7 | 0% |
| CVE-2026-107268 | drupal/miniorange_2fa | This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA | unknown | 0.0 | 0% |
| CVE-2026-32270 | craftcms/commerce | Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments | low | 0.0 | 0% |
| CVE-2026-46628 | twig/twig | Twig: The `spaceless` filter implicitly marks its output as safe | low | 0.0 | 0% |
| CVE-2026-47730 | twig/twig | Twig: XSS in profiler HtmlDumper via unescaped template and profile names | low | 0.0 | 0% |
| CVE-2024-5031 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via th | high | 8.5 | 0% |
| CVE-2026-7733 | funadmin/funadmin | Funadmin has an Improper Access Control Issue | high | 7.3 | 0% |
| CVE-2026-39976 | laravel/passport | Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens | high | 7.1 | 0% |
| CVE-2024-43125 | wp-table-builder (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Table Builder WP Table Build | medium | 6.5 | 0% |
| CVE-2024-13459 | fusedesk (WordPress plugin) | The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusedesk_newcase' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-48228 | funadmin/funadmin | Funadmin Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2023-0729 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2025-1625 | qi-blocks (WordPress plugin) | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a pa | medium | 5.4 | 0% |
| CVE-2025-4133 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in | medium | 5.4 | 0% |
| CVE-2024-3977 | wordpress-jitsi-shortcode (WordPress plugin) | The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2025-3503 | wp-maps (WordPress plugin) | The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2022-0444 | xcloner (WordPress plugin) | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF c | medium | 4.3 | 0% |
| CVE-2023-41129 | patreon-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6. | medium | 4.3 | 0% |
| CVE-2024-13526 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2025-59018 | typo3/cms-workspaces | TYPO3 Workspaces Module Information Disclosure | high | 0.0 | 0% |
| CVE-2026-47347 | typo3/cms-core | TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities | medium | 0.0 | 0% |
| CVE-2026-55478 | snipe/snipe-it | Snipe-IT has missing object-level authorization in Kits API | medium | 0.0 | 0% |
| CVE-2026-76759 | drupal/screenshot | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-28426 | statamic/cms | Statamic vulnerable to privilege escalation via stored cross-site scripting | high | 8.7 | 0% |
| CVE-2026-43874 | wwbn/avideo | AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Rela | high | 7.2 | 0% |
| CVE-2024-12813 | open-hours (WordPress plugin) | The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current- | medium | 6.4 | 0% |
| CVE-2024-13465 | ablocks (WordPress plugin) | The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, | medium | 6.4 | 0% |
| CVE-2024-13665 | admire-extra (WordPress plugin) | The Admire Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'space' shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2023-2301 | contact-form-with-a-meeting-scheduler-by-vcita (WordPress plugin) | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. | medium | 6.1 | 0% |
| CVE-2023-2303 | lead-capturing-call-to-actions-by-vcita (WordPress plugin) | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includ | medium | 6.1 | 0% |
| CVE-2023-6978 | wp-job-manager-companies (WordPress plugin) | The WP Job Manager – Company Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'company' parameter in al | medium | 6.1 | 0% |
| CVE-2024-13467 | wp-contact-form7-email-spam-blocker (WordPress plugin) | The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all | medium | 6.1 | 0% |
| CVE-2025-63644 | ph7software/ph7builder | pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability | medium | 6.1 | 0% |
| CVE-2022-26366 | adrotate-banner-manager (WordPress plugin) | Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-40686 | creative-mail (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-45073 | wordpress-rest-api-authentication (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-13257 | drupal/commerce_view_receipt | The Commerce View Receipts module enables you to view commerce order receipts in the browser. The module doesn't suffic | unknown | 0.0 | 0% |
| CVE-2026-33162 | craftcms/cms | Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions | medium | 0.0 | 0% |
| CVE-2024-7863 | favicon-generator (WordPress plugin) | The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could | medium | 6.8 | 0% |
| CVE-2024-44314 | tastyigniter/tastyigniter | TastyIgniter Has an Incorrect Access Control Vulnerability | medium | 6.5 | 0% |