Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3941 | recaptcha-jetpack (WordPress plugin) | The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escapin | medium | 4.7 | 0% |
| CVE-2025-65954 | simplesamlphp/simplesamlphp-module-casserver | SimpleSAMLphp casserver: Open Redirect in logout | medium | 4.7 | 0% |
| CVE-2023-48328 | nextgen-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery allows Cross Site Request Forgery.This | medium | 4.3 | 0% |
| CVE-2023-5602 | ultimate-social-media-icons (WordPress plugin) | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 4.3 | 0% |
| CVE-2025-62400 | moodle/moodle | Moodle exposed the names of hidden groups to users | medium | 4.3 | 0% |
| CVE-2025-61924 | prestashop/ps_checkout | PrestaShop Checkout Target PayPal merchant account hijacking from backoffice | low | 3.8 | 0% |
| CVE-2025-13980 | drupal/ckeditor5_premium_features | The module provides instant integration of the official CKEditor 5 Premium plugins into the Drupal editor configuration. | unknown | 0.0 | 0% |
| CVE-2026-120331 | mediaessenz/mail | TYPO3-EXT-SA-2026-037: Server-Side Request Forgery in extension "Mail" (mail) | unknown | 0.0 | 0% |
| CVE-2026-13240 | drupal/paragraphs | The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. The module doesn't sufficien | unknown | 0.0 | 0% |
| CVE-2026-13241 | drupal/paragraphs | The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. The module doesn't sufficien | unknown | 0.0 | 0% |
| CVE-2026-41237 | froxlor/froxlor | Froxlor has an incomplete fix for CVE-2026-30932 | high | 0.0 | 0% |
| CVE-2026-41891 | ci4-cms-erp/ci4ms | CI4MS has a Deactivated User Session Bypass (active=0) | medium | 0.0 | 0% |
| CVE-2026-47348 | typo3/cms-core, typo3/cms-indexed-search | TYPO3 CMS has Cross-Site Scripting in Indexed Search | medium | 0.0 | 0% |
| CVE-2023-2497 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing | high | 8.8 | 0% |
| CVE-2024-55924 | typo3/cms-scheduler | TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery | high | 8.0 | 0% |
| CVE-2026-32734 | baserproject/basercms | baserCMS is Vulnerable to Cross-site Scripting | high | 7.1 | 0% |
| CVE-2024-6412 | html-forms (WordPress plugin) | The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users | medium | 6.5 | 0% |
| CVE-2026-28424 | statamic/cms | Statamic's missing authorization allows access to email addresses | medium | 6.5 | 0% |
| CVE-2024-12117 | stackable-ultimate-gutenberg-blocks (WordPress plugin) | The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of | medium | 6.4 | 0% |
| CVE-2025-0837 | puzzles (WordPress theme) | The Puzzles theme for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.2.6 due to i | medium | 6.4 | 0% |
| CVE-2025-6234 | hostel (WordPress plugin) | The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 6.1 | 0% |
| CVE-2026-77609 | mediawiki/semantic-media-wiki | Semantic MediaWiki has an open redirect in Special:URIResolver | medium | 6.1 | 0% |
| CVE-2023-4454 | wallabag/wallabag | Wallabag user can reset data unintentionally | medium | 5.7 | 0% |
| CVE-2023-5611 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its set | medium | 5.3 | 0% |
| CVE-2024-1501 | wordpress-database-reset (WordPress plugin) | The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due | medium | 4.7 | 0% |
| CVE-2024-10860 | nextmove (WordPress plugin) | The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2024-13358 | wc4bp (WordPress plugin) | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access | medium | 4.3 | 0% |
| CVE-2024-1760 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forg | medium | 4.3 | 0% |
| CVE-2025-1780 | wc4bp (WordPress plugin) | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access | medium | 4.3 | 0% |
| CVE-2025-59021 | typo3/cms-redirects | TYPO3 CMS Allows Broken Access Control in Redirects Module | medium | 0.0 | 0% |
| CVE-2026-34372 | sulu/sulu | Sulu checks fix permissions for subentities endpoints | medium | 0.0 | 0% |
| CVE-2026-48979 | php-standard-library/h2, php-standard-library/php-standard-library | PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling | high | 7.5 | 0% |
| CVE-2024-1940 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and inclu | high | 7.1 | 0% |
| CVE-2025-9637 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of | medium | 6.5 | 0% |
| CVE-2025-1437 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all ve | medium | 6.4 | 0% |
| CVE-2025-1526 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget (countdown | medium | 6.4 | 0% |
| CVE-2025-1560 | wow-entrance-effects-wee (WordPress plugin) | The WOW Entrance Effects (WEE!) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all ve | medium | 6.4 | 0% |
| CVE-2025-5337 | ml-slider (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ param | medium | 6.4 | 0% |
| CVE-2024-13422 | seo-blogger-to-wordpress-301-redirector (WordPress plugin) | The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'u | medium | 6.1 | 0% |
| CVE-2024-11847 | -wp-svg-upload (WordPress plugin), digimix/wp-svg-upload | The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to S | medium | 4.8 | 0% |
| CVE-2024-13602 | poll-maker (WordPress plugin) | The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2025-0329 | wpbot (WordPress plugin) | The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | 0% |
| CVE-2025-0629 | coronavirus-\(covid-19\)-notice-message (WordPress plugin) | The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allo | medium | 4.8 | 0% |
| CVE-2025-0718 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2025-1289 | plugin-oficial (WordPress plugin) | The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2025-1619 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2025-1620 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2025-1621 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2026-58657 | getgrav/grav | Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav | medium | 4.8 | 0% |
| CVE-2022-4386 | intuitive-custom-post-order (WordPress plugin) | The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attack | medium | 4.3 | 0% |