Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3894 | oauth-server (WordPress plugin) | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensur | medium | 4.3 | 0% |
| CVE-2023-0498 | wp-education (WordPress plugin) | The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged | medium | 4.3 | 0% |
| CVE-2023-0499 | quickswish (WordPress plugin) | The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2023-0503 | free-woocommerce-theme-99fy-extension (WordPress plugin) | The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow | medium | 4.3 | 0% |
| CVE-2023-0504 | ht-politic (WordPress plugin) | The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2023-0505 | ever-compare (WordPress plugin) | The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged | medium | 4.3 | 0% |
| CVE-2023-1087 | wc-sales-notification (WordPress plugin) | The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to mak | medium | 4.3 | 0% |
| CVE-2023-1088 | wp-plugin-manager (WordPress plugin) | The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make lo | medium | 4.3 | 0% |
| CVE-2023-2271 | tiempo (WordPress plugin) | The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logg | medium | 4.3 | 0% |
| CVE-2023-3356 | subscribers-text-counter (WordPress plugin) | The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow a | medium | 4.3 | 0% |
| CVE-2023-4150 | user-activity-tracking-and-log (WordPress plugin) | The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could all | medium | 4.3 | 0% |
| CVE-2023-4209 | poeditor (WordPress plugin) | The POEditor WordPress plugin before 0.9.8 does not have CSRF checks in various places, which could allow attackers to make logged in admins | medium | 4.3 | 0% |
| CVE-2023-4307 | lock-user-account (WordPress plugin) | The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow at | medium | 4.3 | 0% |
| CVE-2023-4318 | herd-effects (WordPress plugin) | The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in adm | medium | 4.3 | 0% |
| CVE-2026-35541 | roundcube/roundcubemail | Roundcube Webmail: Incorrect password comparison in the password plugin | medium | 4.2 | 0% |
| CVE-2024-13272 | drupal/paragraphs_table | This module enables field collections to be displayed as tables. It supports display suite and field permissions and pro | unknown | 0.0 | 0% |
| CVE-2026-3528 | drupal/calculation_fields | This module extends the Drupal form API adding "Calculation element" form element types, which can evaluate a maths expr | unknown | 0.0 | 0% |
| CVE-2026-3529 | drupal/ga4_google_analytics | The Google Analytics GA4 module enables users to add custom attributes to the script tag used to load the Google Analyti | unknown | 0.0 | 0% |
| CVE-2024-29499 | anchorcms/anchor-cms | Cross-Site Request Forgery in Anchor CMS | high | 7.4 | 0% |
| CVE-2023-5934 | travelpayouts (WordPress plugin) | The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings f | high | 7.3 | 0% |
| CVE-2023-6244 | eventon (WordPress plugin), eventon-lite (WordPress plugin) | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 6.5 | 0% |
| CVE-2025-5692 | wp-leads-builder-any-crm (WordPress plugin) | The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several | medium | 6.3 | 0% |
| CVE-2023-3411 | image-map-pro-lite (WordPress plugin) | The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 6.1 | 0% |
| CVE-2026-34729 | phpmyfaq/phpmyfaq | phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() | medium | 6.1 | 0% |
| CVE-2025-5490 | football-pool (WordPress plugin) | The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, | medium | 5.5 | 0% |
| CVE-2026-39392 | ci4-cms-erp/ci4ms | CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization | medium | 5.5 | 0% |
| CVE-2026-84188 | librenms/librenms | LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users | medium | 4.8 | 0% |
| CVE-2024-55893 | typo3/cms-belog | TYPO3 Cross-Site Request Forgery in Log Module | medium | 4.3 | 0% |
| CVE-2024-55894 | typo3/cms-beuser | TYPO3 Cross-Site Request Forgery in Backend User Module | medium | 4.3 | 0% |
| CVE-2025-7900 | in2code/femanager | Femanager extension for TYPO3 allows Insecure Direct Object Reference | medium | 0.0 | 0% |
| CVE-2025-9552 | drupal/sync_composer_with_contrib | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2025-9553 | drupal/api_key_manager | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2025-9554 | drupal/owlcarousel2 | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2024-4531 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | high | 7.1 | 0% |
| CVE-2024-4422 | comparison-slider (WordPress plugin) | The Comparison Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider title parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2025-32027 | yiisoft/yii | Yii does not prevent XSS in scenarios where fallback error renderer is used | medium | 6.1 | 0% |
| CVE-2026-105829 | league/commonmark | league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal | medium | 6.1 | 0% |
| CVE-2026-40908 | wwbn/avideo | WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version | medium | 5.3 | 0% |
| CVE-2022-35730 | sticky-header (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress. | medium | 4.3 | 0% |
| CVE-2024-13335 | sastra-essential-addons-for-elementor (WordPress plugin) | The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due | medium | 4.3 | 0% |
| CVE-2025-60796 | phppgadmin/phppgadmin | phppgadmin vulnerable to Cross-site Scripting | low | 0.0 | 0% |
| CVE-2026-26991 | librenms/librenms | LibreNMS /device-groups name Stored Cross-Site Scripting | medium | 0.0 | 0% |
| CVE-2026-26992 | librenms/librenms | LibreNMS /port-groups name Stored Cross-Site Scripting | medium | 0.0 | 0% |
| CVE-2026-33347 | league/commonmark | league/commonmark has an embed extension allowed_domains bypass | medium | 0.0 | 0% |
| CVE-2026-84916 | drupal/islandora | This `islandora_advanced_search` sub module enables AJAX updates for advanced search, facet, and search result blocks. | unknown | 0.0 | 0% |
| CVE-2026-45293 | wp-coding-standards/wpcs | WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability | high | 8.6 | 0% |
| CVE-2026-38527 | krayin/laravel-crm | Webkul Krayin CRM has Server-Side Request Forgery (SSRF) | high | 8.5 | 0% |
| CVE-2026-29199 | phpbb/phpbb | phpBB has Password Reset Link Poisoning via Host Header injection | high | 8.1 | 0% |
| CVE-2026-46367 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering | high | 7.6 | 0% |
| CVE-2025-7502 | page-builder (WordPress plugin) | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all vers | medium | 6.4 | 0% |