Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-13001 | donations (WordPress plugin) | The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privile | medium | 4.1 | 0% |
| CVE-2025-65014 | librenms/librenms | LibreNMS has Weak Password Policy | low | 3.7 | 0% |
| CVE-2024-11924 | icegram-express (WordPress plugin) | The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, w | low | 3.5 | 0% |
| CVE-2024-12273 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privileg | low | 3.5 | 0% |
| CVE-2024-9771 | wp-recall (WordPress plugin) | The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users su | low | 3.5 | 0% |
| CVE-2025-0627 | taxopress (WordPress plugin) | The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, | low | 3.5 | 0% |
| CVE-2025-1523 | ultimate-dashboard (WordPress plugin) | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege us | low | 3.5 | 0% |
| CVE-2025-1524 | ultimate-dashboard (WordPress plugin) | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege us | low | 3.5 | 0% |
| CVE-2025-1525 | ultimate-dashboard (WordPress plugin) | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege us | low | 3.5 | 0% |
| CVE-2025-3514 | sureforms (WordPress plugin) | The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users | low | 3.5 | 0% |
| CVE-2026-31887 | shopware/core, shopware/platform | Shopware: Unauthenticated data extraction possible through store-api.order endpoint | high | 0.0 | 0% |
| CVE-2026-32629 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor | medium | 0.0 | 0% |
| CVE-2026-84914 | drupal/calculate_working_days | Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restric | unknown | 0.0 | 0% |
| CVE-2024-2544 | popup-builder (WordPress plugin) | The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check | high | 7.4 | 0% |
| CVE-2025-6540 | web-cam (WordPress plugin) | The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, | medium | 6.4 | 0% |
| CVE-2024-5312 | phpservermon/phpservermon | PHP Server Monitor vulnerable to Cross-site Scripting | medium | 6.3 | 0% |
| CVE-2025-1286 | download-html-tinymce-button (WordPress plugin) | The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page | medium | 6.1 | 0% |
| CVE-2025-2203 | funnel-builder (WordPress plugin) | The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins t | medium | 6.1 | 0% |
| CVE-2026-2898 | funadmin/funadmin | funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function | medium | 5.5 | 0% |
| CVE-2022-43459 | captainform (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions. | medium | 5.4 | 0% |
| CVE-2023-5651 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package | medium | 5.4 | 0% |
| CVE-2024-12825 | custom-related-posts (WordPress plugin) | The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-35621 | getformwork/formwork | formwork Cross-site scripting vulnerability in Markdown fields | medium | 4.8 | 0% |
| CVE-2025-54266 | magento/community-edition, magento/project-community-edition | Magento vulnerable to stored Cross-Site Scripting (XSS) | medium | 4.8 | 0% |
| CVE-2022-47136 | ninja-tables (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 ver | medium | 4.3 | 0% |
| CVE-2022-47161 | health-check-\&-troubleshooting (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions. | medium | 4.3 | 0% |
| CVE-2023-23646 | album-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin <= 1.4.9 versions. | medium | 4.3 | 0% |
| CVE-2026-27732 | wwbn/avideo | AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php | high | 8.1 | 0% |
| CVE-2026-41234 | froxlor/froxlor | Froxlor: BIND Zone File Injection via TXT Record Content | high | 7.6 | 0% |
| CVE-2023-5990 | funnelforms-free (WordPress plugin) | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on | medium | 6.5 | 0% |
| CVE-2024-49231 | wordpress-video (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cyclop WordPress Video wordpress-video | medium | 6.5 | 0% |
| CVE-2024-6496 | light-poll (WordPress plugin) | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in u | medium | 6.5 | 0% |
| CVE-2025-0321 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parameter in all versions up t | medium | 6.4 | 0% |
| CVE-2025-7046 | portfolio-elementor (WordPress plugin) | The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS | medium | 6.4 | 0% |
| CVE-2024-9628 | wps-telegram-chat (WordPress plugin) | The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability c | medium | 6.3 | 0% |
| CVE-2023-47230 | wordpress-contact-forms (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions. | medium | 5.4 | 0% |
| CVE-2023-49821 | livechat (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP li | medium | 5.4 | 0% |
| CVE-2024-9630 | wps-telegram-chat (WordPress plugin) | The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages i | medium | 5.4 | 0% |
| CVE-2026-107843 | contao/core-bundle | Contao: The registration module re-sends activation mails | medium | 5.3 | 0% |
| CVE-2023-4251 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2026-49288 | statamic/cms | Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources | medium | 4.3 | 0% |
| CVE-2024-13263 | drupal/opigno_group_manager | The Opigno group manager project is related to Opigno LMS distribution. It allows to build the contents of learning path | unknown | 0.0 | 0% |
| CVE-2026-118513 | symfony/security-http, symfony/symfony | CVE-2026-118513: X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Bou | unknown | 0.0 | 0% |
| CVE-2026-29176 | craftcms/commerce | Craft Commerce has stored XSS in Inventory Location Name | medium | 0.0 | 0% |
| CVE-2026-40907 | wwbn/avideo | WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens | medium | 6.5 | 0% |
| CVE-2023-1660 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated use | medium | 6.1 | 0% |
| CVE-2026-50550 | snipe/snipe-it | Snipe-IT has a 2FA reset privilege bypass | medium | 5.8 | 0% |
| CVE-2022-47446 | store-locator-for-wordpress-with-google-maps (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin <= 3 | medium | 5.4 | 0% |
| CVE-2025-3581 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/ | medium | 4.8 | 0% |
| CVE-2025-3582 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users | medium | 4.8 | 0% |