Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-47936 | typo3/cms-webhooks | TYPO3 CMS Webhooks Server Side Request Forgery | low | 3.3 | 0% |
| CVE-2025-48920 | drupal/etracker | The module adds the etracker web statistics tracking system to your website. The cookies\_etracker submodule allows the | unknown | 0.0 | 0% |
| CVE-2026-28782 | craftcms/cms | Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action | medium | 0.0 | 0% |
| CVE-2023-2440 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing | high | 8.8 | 0% |
| CVE-2024-0203 | digits (WordPress plugin) | The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing | high | 8.8 | 0% |
| CVE-2024-2115 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, | high | 8.8 | 0% |
| CVE-2026-31018 | dolibarr/dolibarr | Dolibarr Allows Code Injection through its Website Module | high | 8.8 | 0% |
| CVE-2024-13574 | xv-random-quotes (WordPress plugin) | The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading t | high | 7.1 | 0% |
| CVE-2024-13836 | wp-login-control (WordPress plugin) | The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading | high | 7.1 | 0% |
| CVE-2024-13862 | s3bubble-amazon-web-services-oembed-media-streaming-support (WordPress plugin) | The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a paramet | high | 7.1 | 0% |
| CVE-2024-13863 | stylish-google-sheet-reader (WordPress plugin) | The Stylish Google Sheet Reader 4.0 WordPress plugin before 4.1 does not sanitise and escape a parameter before outputting it back in the p | high | 7.1 | 0% |
| CVE-2024-13891 | schedule (WordPress plugin) | The Schedule WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | high | 7.1 | 0% |
| CVE-2025-4522 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via | medium | 6.5 | 0% |
| CVE-2024-4939 | weaverx-theme-support (WordPress plugin) | The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all vers | medium | 6.4 | 0% |
| CVE-2024-5341 | the-plus-addons-for-elementor (WordPress plugin) | The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' attribute of | medium | 6.4 | 0% |
| CVE-2024-9125 | king-ie (WordPress plugin) | The king_IE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 | medium | 6.4 | 0% |
| CVE-2025-5568 | mage-eventpress (WordPress plugin) | The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including | medium | 6.4 | 0% |
| CVE-2024-10309 | tracking-code-manager (WordPress plugin) | The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the | medium | 5.9 | 0% |
| CVE-2024-9230 | powerpress (WordPress plugin) | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a | medium | 5.9 | 0% |
| CVE-2024-9775 | anih (WordPress theme) | The Anih - Creative Agency WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versio | medium | 5.5 | 0% |
| CVE-2026-46696 | october/system | October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls | low | 3.3 | 0% |
| CVE-2026-107256 | drupal/shield | The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non | unknown | 0.0 | 0% |
| CVE-2026-55808 | drupal/core | The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file exte | unknown | 0.0 | 0% |
| CVE-2026-87936 | drupal/ai_provider_amazeeio | **Update 2026-09-11:** Increased risk score to reflect publicly documented methods for developing exploits. This module | unknown | 0.0 | 0% |
| CVE-2026-92161 | fof/oauth | FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider | critical | 9.8 | 0% |
| CVE-2026-4208 | ralffreit/mfa-email | Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email) | high | 8.8 | 0% |
| CVE-2015-4582 | boot-store (WordPress theme) | The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS. NOTE: CVE-2015-4582 is not | high | 7.2 | 0% |
| CVE-2024-13758 | cp-contact-form-with-paypal (WordPress plugin) | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.5 | medium | 6.5 | 0% |
| CVE-2024-2923 | magical-addons-for-elementor (WordPress plugin) | The Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) plugin for WordPress is vuln | medium | 6.4 | 0% |
| CVE-2024-5789 | triton-lite (WordPress theme) | The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode | medium | 6.4 | 0% |
| CVE-2024-5869 | neighborly (WordPress theme) | The Neighborly theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode | medium | 6.4 | 0% |
| CVE-2024-5870 | tweaker5 (WordPress theme) | The Tweaker5 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in | medium | 6.4 | 0% |
| CVE-2024-5884 | beauty (WordPress theme) | The Beauty theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tpl_featured_cat_id’ parameter in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-9373 | elemenda (WordPress plugin) | The Elemenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0. | medium | 6.4 | 0% |
| CVE-2025-6976 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin | medium | 6.4 | 0% |
| CVE-2025-65013 | librenms/librenms | LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name` | medium | 6.2 | 0% |
| CVE-2024-13749 | stafflist (WordPress plugin) | The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to m | medium | 6.1 | 0% |
| CVE-2025-2279 | maps (WordPress plugin) | The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page | medium | 5.9 | 0% |
| CVE-2023-5756 | digital-publications-by-supsystic (WordPress plugin) | The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7 | medium | 5.4 | 0% |
| CVE-2024-3987 | mobile-menu (WordPress plugin) | The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt tex | medium | 5.4 | 0% |
| CVE-2024-6271 | community-events (WordPress plugin) | The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make | medium | 5.4 | 0% |
| CVE-2024-3481 | counter-box (WordPress plugin) | The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in | medium | 5.2 | 0% |
| CVE-2024-10680 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-13381 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2024-9882 | salon-booking-system (WordPress plugin) | The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and esc | medium | 4.8 | 0% |
| CVE-2025-1453 | category-posts-widget (WordPress plugin) | The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2025-3504 | wp-maps (WordPress plugin) | The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-4731 | ladipage (WordPress plugin) | The LadiApp plugn for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the init_endpoint() function hoo | medium | 4.3 | 0% |
| CVE-2024-10593 | wpforms-lite (WordPress plugin) | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Si | medium | 4.3 | 0% |
| CVE-2024-45269 | carousel-slider (WordPress plugin) | WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection | medium | 4.3 | 0% |