Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4553 | fl3r-feelbox (WordPress plugin) | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make log | medium | 4.3 | 0% |
| CVE-2023-1089 | coupon-zen (WordPress plugin) | The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2023-3366 | multiparcels-shipping-for-woocommerce (WordPress plugin) | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attacke | medium | 4.3 | 0% |
| CVE-2026-40486 | kimai/kimai | Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate | medium | 4.3 | 0% |
| CVE-2024-10558 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege | low | 3.5 | 0% |
| CVE-2024-12769 | simple-banner (WordPress plugin) | The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users s | low | 3.5 | 0% |
| CVE-2024-13122 | advanced-form-integration (WordPress plugin) | The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as a | low | 3.5 | 0% |
| CVE-2024-13123 | advanced-form-integration (WordPress plugin) | The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as a | low | 3.5 | 0% |
| CVE-2024-13124 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privile | low | 3.5 | 0% |
| CVE-2024-13615 | social-snap (WordPress plugin) | The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not | low | 3.5 | 0% |
| CVE-2025-1062 | slider\,-gallery\,-and-carousel (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which cou | low | 3.5 | 0% |
| CVE-2025-1452 | favorites (WordPress plugin) | The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such a | low | 3.5 | 0% |
| CVE-2025-1623 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privile | low | 3.5 | 0% |
| CVE-2025-1624 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privile | low | 3.5 | 0% |
| CVE-2026-45755 | symfony/mailtrap-mailer, symfony/symfony | Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection | medium | 0.0 | 0% |
| CVE-2026-72785 | craftcms/cms | Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element | medium | 0.0 | 0% |
| CVE-2026-96387 | drupal/stop_admin | This module enables sites to block access for the administrative user account (user 1) or users with the administrator r | unknown | 0.0 | 0% |
| CVE-2025-2929 | order-delivery-date-for-woocommerce (WordPress plugin) | The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leadi | high | 7.1 | 0% |
| CVE-2026-45008 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins | medium | 6.5 | 0% |
| CVE-2025-4774 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Count | medium | 6.4 | 0% |
| CVE-2022-1617 | wp-invoice (WordPress plugin) | The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as w | medium | 6.1 | 0% |
| CVE-2022-1618 | coru-lfmember (WordPress plugin) | The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as we | medium | 6.1 | 0% |
| CVE-2023-3178 | post-smtp (WordPress plugin) | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to mak | medium | 4.3 | 0% |
| CVE-2024-39639 | wordpress-file-upload (WordPress plugin) | Broken Access Control vulnerability in Nickolas Bossinas WordPress File Upload allows Exploiting Incorrectly Configured Access Control Secur | medium | 4.3 | 0% |
| CVE-2025-13828 | mautic/core | Mautic user without privileged access to the Marketplace can install and uninstall composer packages | critical | 0.0 | 0% |
| CVE-2025-5682 | drupal/klaro | Klaro Cookie & Consent Management module is used for consent management for cookies and external sources. It makes chang | unknown | 0.0 | 0% |
| CVE-2025-7392 | drupal/cookies_addons | This module provides a format filter, which allows you to "disable" iframes (e.g. remove their src attribute) specified | unknown | 0.0 | 0% |
| CVE-2025-7716 | drupal/yoast_seo | This module enables you to analyze the content that you're authoring for a website. It shows you a preview of what a sea | unknown | 0.0 | 0% |
| CVE-2026-13239 | drupal/wisski | The module adds support for the mirador viewer in WissKI and enables annotations on images via the mirador viewer. It d | unknown | 0.0 | 0% |
| CVE-2026-3526 | drupal/file_access_fix | This module moves files to and from private storage depending on the access of its owning entities. The module does not | unknown | 0.0 | 0% |
| CVE-2026-81163 | drupal/media_library_importer | A module to import media files into media library. The import folder is a plain textfield with no validation. Point it | unknown | 0.0 | 0% |
| CVE-2024-7568 | favicon-generator (WordPress plugin) | The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to | critical | 9.6 | 0% |
| CVE-2026-33882 | statamic/cms | Statamic's Markdown preview endpoint exposes sensitive user data | medium | 6.5 | 0% |
| CVE-2025-3813 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ paramet | medium | 6.4 | 0% |
| CVE-2021-21264 | october/cms | Bypass of fix for CVE-2020-26231, Twig sandbox escape | medium | 5.2 | 0% |
| CVE-2022-4103 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not | medium | 4.3 | 0% |
| CVE-2023-2495 | greeklish-permalink (WordPress plugin) | The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX | medium | 4.3 | 0% |
| CVE-2023-5383 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to | medium | 4.3 | 0% |
| CVE-2025-3634 | moodle/moodle | Moodle self enrollment available before completing second factor with MFA enabled | medium | 4.3 | 0% |
| CVE-2024-24764 | october/system | October System module has an Open Redirect for Administrator Accounts | low | 3.5 | 0% |
| CVE-2025-26532 | moodle/moodle | Moodle allows teachers to evade trusttext config when restoring glossary entries | low | 3.1 | 0% |
| CVE-2026-47761 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection | high | 8.7 | 0% |
| CVE-2024-4758 | muslim-prayer-time-bd (WordPress plugin) | The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attac | high | 7.6 | 0% |
| CVE-2026-46359 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields | high | 7.5 | 0% |
| CVE-2025-67849 | moodle/moodle | Moodle Cross-site Scripting (XSS) vulnerability | high | 7.3 | 0% |
| CVE-2024-0428 | mihdan-index-now (WordPress plugin) | The Index Now plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.3. This is due to m | high | 7.1 | 0% |
| CVE-2024-6230 | pardakht-delkhah (WordPress plugin) | The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow | medium | 6.5 | 0% |
| CVE-2025-5291 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_ | medium | 6.4 | 0% |
| CVE-2025-5703 | stageshow (WordPress plugin) | The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2022-38356 | pearl-header-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions. | medium | 5.4 | 0% |