Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-15305 | typo3/cms-form | TYPO3 CMS - Unrestricted File Upload in Form Framework | medium | 0.0 | 0% |
| CVE-2025-5034 | wp-file-download (WordPress plugin) | The wp-file-download WordPress plugin before 6.2.6 does not sanitise and escape a parameter before outputting it back in the page, leading t | high | 7.1 | 0% |
| CVE-2025-8281 | wp-talroo (WordPress plugin) | The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | high | 7.1 | 0% |
| CVE-2024-2843 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make | medium | 6.5 | 0% |
| CVE-2024-7859 | visual-sound (WordPress plugin) | The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 6.5 | 0% |
| CVE-2024-7864 | favicon-generator (WordPress plugin) | The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, | medium | 6.5 | 0% |
| CVE-2024-13549 | all-bootstrap-blocks (WordPress plugin) | The All Bootstrap Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Accordion" widget in all versions up to, | medium | 6.4 | 0% |
| CVE-2025-0469 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | 0% |
| CVE-2025-5488 | wp-masonry-infinite-scroll (WordPress plugin) | The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all | medium | 6.4 | 0% |
| CVE-2025-6350 | wpvr (WordPress plugin) | The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t | medium | 6.4 | 0% |
| CVE-2025-3745 | wp-lightbox-2 (WordPress plugin) | The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, w | medium | 6.3 | 0% |
| CVE-2023-5532 | imagemapper (WordPress plugin) | The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to mis | medium | 6.1 | 0% |
| CVE-2026-43878 | wwbn/avideo | Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal | medium | 6.1 | 0% |
| CVE-2022-45846 | interactive-svg-image-map-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 ver | medium | 5.4 | 0% |
| CVE-2025-3247 | contact-form-7 (WordPress plugin) | The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip | medium | 5.3 | 0% |
| CVE-2026-31888 | shopware/core, shopware/platform | Shopware has user enumeration via distinct error codes on Store API login endpoint | medium | 5.3 | 0% |
| CVE-2024-3919 | openpgp-form-encryption (WordPress plugin) | The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputtin | medium | 4.6 | 0% |
| CVE-2024-35191 | verbb/formie | verbb/formie Server-Side Template Injection for variable-enabled settings | medium | 4.4 | 0% |
| CVE-2025-2076 | binlayerpress (WordPress plugin) | The binlayerpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, | medium | 4.4 | 0% |
| CVE-2025-2078 | blogbuzztime-for-wp (WordPress plugin) | The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and incl | medium | 4.4 | 0% |
| CVE-2024-1325 | woomotiv (WordPress plugin) | The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up t | medium | 4.3 | 0% |
| CVE-2024-9778 | image-gallery (WordPress plugin) | The ImagePress – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. | medium | 4.3 | 0% |
| CVE-2025-47709 | drupal/miniorange_2fa | The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't | unknown | 0.0 | 0% |
| CVE-2025-64027 | snipe/snipe-it | Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow | medium | 0.0 | 0% |
| CVE-2026-118556 | drupal/commerce_shipping | This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment. | unknown | 0.0 | 0% |
| CVE-2026-13231 | drupal/admin_feedback | This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and prov | unknown | 0.0 | 0% |
| CVE-2026-13234 | drupal/ai | The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the abi | unknown | 0.0 | 0% |
| CVE-2026-16638 | drupal/media_folders | This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't su | unknown | 0.0 | 0% |
| CVE-2026-16640 | drupal/search_api_autocomplete | This module enables you to add autocomplete suggestions for search forms created with the [Search API module](/project/s | unknown | 0.0 | 0% |
| CVE-2026-3527 | drupal/ajax_dashboard | AJAX Dashboard: Entity Dashboards enables you to create configurable dashboards attached to entities which include AJAX- | unknown | 0.0 | 0% |
| CVE-2026-45753 | symfony/html-sanitizer, symfony/symfony | Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) | low | 0.0 | 0% |
| CVE-2026-47346 | typo3/cms-core, typo3/cms-form | TYPO3 CMS has Broken Access Control in its Form Framework | high | 0.0 | 0% |
| CVE-2026-60092 | wwbn/avideo | AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel | medium | 0.0 | 0% |
| CVE-2026-81160 | drupal/slick | Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previ | unknown | 0.0 | 0% |
| CVE-2024-8507 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is d | high | 8.8 | 0% |
| CVE-2024-1161 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes for blocks in | medium | 6.4 | 0% |
| CVE-2024-1164 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error messag | medium | 6.4 | 0% |
| CVE-2024-11780 | site-search-360 (WordPress plugin) | The Site Search 360 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ss360-resultblock' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-13542 | wp-google-street-view (WordPress plugin) | The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-13547 | athemes-addons-for-elementor-lite (WordPress plugin) | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all ver | medium | 6.4 | 0% |
| CVE-2024-13590 | ketchup-shortcodes (WordPress plugin) | The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-5221 | qi-blocks (WordPress plugin) | The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and in | medium | 6.4 | 0% |
| CVE-2021-24870 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not saniti | medium | 6.1 | 0% |
| CVE-2025-47946 | symfony/ux-live-component, symfony/ux-twig-component | Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes | medium | 6.1 | 0% |
| CVE-2024-13848 | reaction-buttons (WordPress plugin) | The Reaction Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includi | medium | 5.5 | 0% |
| CVE-2023-37996 | gtmetrix (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.7 versions. | medium | 5.4 | 0% |
| CVE-2023-45831 | google-amp (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin <= 1.5.15 versions. | medium | 5.4 | 0% |
| CVE-2026-24906 | october/system | October CMS has Stored XSS in Backend Editor Markup Classes | medium | 5.4 | 0% |
| CVE-2026-34362 | wwbn/avideo | AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() | medium | 5.4 | 0% |
| CVE-2026-47132 | thorsten/phpmyfaq | phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration | medium | 5.4 | 0% |