Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-6787 | smart-docs (WordPress plugin) | The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartdocs_search' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2026-35539 | roundcube/roundcubemail | Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode | medium | 6.1 | 0% |
| CVE-2026-32612 | statamic/cms | Statamic vulnerable to privilege escalation via stored cross-site scripting | medium | 5.4 | 0% |
| CVE-2026-54179 | backpack/crud | Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk | medium | 4.4 | 0% |
| CVE-2026-45007 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Auth | medium | 4.3 | 0% |
| CVE-2025-48010 | drupal/one_time_password | This module enables you to allow users to include a second authentication method in addition to password authentication. | unknown | 0.0 | 0% |
| CVE-2025-48012 | drupal/one_time_password | This module enables you to allow users to include a second authentication method in addition to password authentication. | unknown | 0.0 | 0% |
| CVE-2025-7715 | drupal/block_attributes | This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the blo | unknown | 0.0 | 0% |
| CVE-2026-56738 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion | high | 0.0 | 0% |
| CVE-2026-72787 | craftcms/cms | Craft CMS: Stored XSS in the control panel via unescaped draft name | medium | 0.0 | 0% |
| CVE-2026-87954 | drupal/term_glossary | This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on t | unknown | 0.0 | 0% |
| CVE-2024-12589 | finale-woocommerce-sales-countdown-timer-discount (WordPress plugin) | The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-2090 | remote-content-shortcode (WordPress plugin) | The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via | medium | 6.4 | 0% |
| CVE-2025-1527 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2025-2560 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2025-2561 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2022-47447 | wp-advanced-search (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions. | medium | 4.3 | 0% |
| CVE-2024-11143 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2 | medium | 4.3 | 0% |
| CVE-2026-42071 | mantisbt/mantisbt | MantisBT has a Private Bugnote Attachment Content Leak via REST API | high | 0.0 | 0% |
| CVE-2026-33354 | wwbn/avideo | AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php` | high | 7.6 | 0% |
| CVE-2026-42224 | ipl/web | ipl/web is vulnerable to reflected XSS by malformed search requests | high | 7.6 | 0% |
| CVE-2021-4446 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to m | medium | 6.3 | 0% |
| CVE-2025-3662 | fancybox (WordPress plugin) | The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' capti | medium | 6.1 | 0% |
| CVE-2023-5982 | updraftplus (WordPress plugin) | The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, | medium | 5.4 | 0% |
| CVE-2025-28010 | modx/revolution | MODX allows cross-site scripting (XSS) via an SVG file | medium | 5.4 | 0% |
| CVE-2023-41694 | realbig (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Realbig Team Realbig For WordPress plugin <= 1.0.3 versions. | medium | 4.3 | 0% |
| CVE-2023-5772 | debug-log-manager (WordPress plugin) | The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is | medium | 4.3 | 0% |
| CVE-2024-1504 | secupress (WordPress plugin) | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2026-10215 | dolibarr/dolibarr | Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API | medium | 4.3 | 0% |
| CVE-2020-13673 | drupal/core, drupal/entity_embed | The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, t | unknown | 0.0 | 0% |
| CVE-2025-3900 | drupal/colorbox | Colorbox is a module that allows Images, and iframed or inline content to be displayed in a modal above the current page | unknown | 0.0 | 0% |
| CVE-2026-45802 | setasign/fpdi | FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service | medium | 0.0 | 0% |
| CVE-2026-96367 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-47740 | shopper/framework | shopper/framework: Authorization bypass in multiple Livewire admin components | high | 8.1 | 0% |
| CVE-2024-3405 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to ma | high | 7.6 | 0% |
| CVE-2025-9318 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_lin | medium | 6.5 | 0% |
| CVE-2025-63520 | feehi/feehicms | FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function | medium | 6.1 | 0% |
| CVE-2024-13505 | survey-maker (WordPress plugin) | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter | medium | 5.5 | 0% |
| CVE-2024-13845 | gravity-forms-webhooks (WordPress plugin) | The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via | medium | 5.5 | 0% |
| CVE-2024-1321 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and inclu | medium | 5.3 | 0% |
| CVE-2025-5813 | import-products-to-wc (WordPress plugin) | The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.3 | 0% |
| CVE-2025-12469 | wp-marketing-automations (WordPress plugin) | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Aut | medium | 4.3 | 0% |
| CVE-2025-9111 | wpbot (WordPress plugin) | The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privil | low | 3.5 | 0% |
| CVE-2026-41659 | admidio/admidio | Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment | low | 2.7 | 0% |
| CVE-2025-30166 | pimcore/admin-ui-classic-bundle | Pimcore's Admin Classic Bundle allows HTML Injection | low | 0.0 | 0% |
| CVE-2026-33051 | craftcms/cms | Craft CMS Vulnerable to Stored XSS in Revision Context Menu | medium | 0.0 | 0% |
| CVE-2026-42070 | mantisbt/mantisbt | MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API | medium | 0.0 | 0% |
| CVE-2026-45069 | symfony/security-http, symfony/symfony | Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | medium | 0.0 | 0% |
| CVE-2026-48820 | cakephp/cakephp | CakePHP: View::element() is missing a path containment check | medium | 0.0 | 0% |
| CVE-2024-31503 | dolibarr/dolibarr | Dolibarr vulnerable to Cross-Site Request Forgery | high | 7.5 | 0% |