Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-23705 | wordpress-books-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions. | medium | 4.3 | 0% |
| CVE-2023-23706 | wordpress-social-login-and-register-\(discord\,-google\,-twitter\,-linkedin\) (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugi | medium | 4.3 | 0% |
| CVE-2023-25708 | wp-vr (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 vers | medium | 4.3 | 0% |
| CVE-2023-34028 | wolf---wordpress-posts-bulk-editor-and-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 ve | medium | 4.3 | 0% |
| CVE-2023-41131 | spotify-play-button (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.10 versions. | medium | 4.3 | 0% |
| CVE-2023-5802 | wp-knowledgebase (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1 | medium | 4.3 | 0% |
| CVE-2021-3841 | sylius/sylius | Cross site scripting in sylius/sylius | medium | 4.1 | 0% |
| CVE-2025-27400 | openmage/magento-lts | Magento LTS vulnerable to stored XSS in theme config fields | low | 2.9 | 0% |
| CVE-2026-10770 | drupal/cleantalk | This module provides spam protection using the CleanTalk cloud service. The module doesn't sufficiently sanitize API re | unknown | 0.0 | 0% |
| CVE-2026-58587 | drupal/canvas | The Canvas AI submodule allows you to upload image files via a custom API to use within the AI web chat. These file upl | unknown | 0.0 | 0% |
| CVE-2026-58588 | drupal/canvas | The Canvas module allow you to upload image files via a custom API. The validation rules check the file extension of th | unknown | 0.0 | 0% |
| CVE-2026-81159 | drupal/commerce_cybersource | This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the i | unknown | 0.0 | 0% |
| CVE-2026-81201 | drupal/monster_menus | This module enables you to create one or more multisites with highly granular page permissions. The module doesn't suff | unknown | 0.0 | 0% |
| CVE-2024-29338 | anchorcms/anchor-cms | Cross-Site Request Forgery in Anchor CMS | high | 7.4 | 0% |
| CVE-2026-39971 | s9y/serendipity | Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header | high | 7.2 | 0% |
| CVE-2024-56364 | shuchkin/simplexlsx | Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx | medium | 6.8 | 0% |
| CVE-2022-41615 | agile-store-locator (WordPress plugin) | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress. | medium | 6.1 | 0% |
| CVE-2023-25065 | wp-tabs (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions. | medium | 5.4 | 0% |
| CVE-2023-6326 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl | medium | 5.4 | 0% |
| CVE-2026-75834 | getgrav/grav | Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate | medium | 5.4 | 0% |
| CVE-2024-4755 | google-cse (WordPress plugin) | The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2026-3531 | drupal/openid_connect | This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. | unknown | 0.0 | 0% |
| CVE-2025-5817 | import-products-to-wc (WordPress plugin) | The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1 | high | 7.2 | 0% |
| CVE-2024-3642 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make log | medium | 6.9 | 0% |
| CVE-2024-35738 | kognetiks-chatbot (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kognetiks Kognetiks Chatbot for | medium | 6.5 | 0% |
| CVE-2024-43335 | responsive-blocks (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks – | medium | 6.5 | 0% |
| CVE-2024-43935 | wp-delicious (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Delicious Delicious Recipes | medium | 6.5 | 0% |
| CVE-2024-51682 | ht-builder (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Builder – WordPress Theme | medium | 6.5 | 0% |
| CVE-2024-11132 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due t | medium | 6.4 | 0% |
| CVE-2025-1324 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'p | medium | 6.4 | 0% |
| CVE-2025-4367 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all | medium | 6.4 | 0% |
| CVE-2025-4479 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image compar | medium | 6.4 | 0% |
| CVE-2025-5143 | posts-table-filterable (WordPress plugin) | The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_po | medium | 6.4 | 0% |
| CVE-2025-5234 | gutenverse-news (WordPress plugin) | The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, a | medium | 6.4 | 0% |
| CVE-2025-5289 | interactive-3d-flipbook-powered-physics-engine (WordPress plugin) | The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 6.4 | 0% |
| CVE-2025-5338 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and | medium | 6.4 | 0% |
| CVE-2025-5940 | osomblocks (WordPress plugin) | The Osom Blocks – Custom Post Type listing block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ para | medium | 6.4 | 0% |
| CVE-2025-5950 | indieblocks (WordPress plugin) | The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2025-6537 | namasha-by-mdesign (WordPress plugin) | The Namasha By Mdesign plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘playicon_title’ parameter in all versions | medium | 6.4 | 0% |
| CVE-2025-6687 | magic-buttons-for-elementor (WordPress plugin) | The Magic Buttons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's magic-button shortcode in | medium | 6.4 | 0% |
| CVE-2025-6756 | ultimate-addons-for-contact-form-7 (WordPress plugin) | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS s | medium | 6.4 | 0% |
| CVE-2026-34245 | wwbn/avideo | AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking | medium | 6.3 | 0% |
| CVE-2022-4368 | wp-csv (WordPress plugin) | The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a | medium | 6.1 | 0% |
| CVE-2025-1626 | qi-blocks (WordPress plugin) | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a | medium | 5.4 | 0% |
| CVE-2025-1627 | qi-blocks (WordPress plugin) | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post | medium | 5.4 | 0% |
| CVE-2026-107380 | enshrined/svg-sanitize | enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision | medium | 5.4 | 0% |
| CVE-2024-35770 | vimeography (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin.This issue affects Vimeograph | medium | 4.3 | 0% |
| CVE-2022-4102 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not | low | 3.1 | 0% |
| CVE-2024-13301 | drupal/miniorange_oauth_client | This module enables you to authenticate users through an Identity Provider (IdP) or OAuth Server, allowing them to log i | unknown | 0.0 | 0% |
| CVE-2025-8362 | drupal/gtm | This module enables you to integrate Google Tag Manager (GTM) into your Drupal site by allowing administrators to config | unknown | 0.0 | 0% |