Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-49744 | gift-up-gift-cards-for-wordpress-and-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Gift Up Gift Up Gift Cards for WordPress and WooCommerce.This issue affects Gift Up Gift | medium | 5.4 | 0% |
| CVE-2025-5256 | mautic/core | Mautic has an Open Redirect vulnerability on user unlock path. | medium | 5.4 | 0% |
| CVE-2024-55892 | typo3/cms-core | TYPO3 Potential Open Redirect via Parsing Differences | medium | 4.8 | 0% |
| CVE-2025-6236 | hostel (WordPress plugin) | The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2023-7290 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2023-7293 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2025-67737 | azuracast/azuracast | AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE | low | 3.1 | 0% |
| CVE-2025-3733 | drupal/baguettebox | The baguetteBox.js module provides integration with baguetteBox.js library. The module doesn't sufficiently sanitize us | unknown | 0.0 | 0% |
| CVE-2026-104473 | yeswiki/yeswiki | YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities | medium | 0.0 | 0% |
| CVE-2026-46683 | knplabs/knp-snappy | Snappy : SSRF and local file read via the xsl-style-sheet option | medium | 0.0 | 0% |
| CVE-2026-50888 | koillection/koillection | Koillection has an authenticated Server-Side Request Forgery issue | high | 8.1 | 0% |
| CVE-2023-6029 | eazydocs (WordPress plugin) | The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they | high | 7.5 | 0% |
| CVE-2023-7269 | artplacer-widget (WordPress plugin) | The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping | high | 7.5 | 0% |
| CVE-2026-48555 | spatie/laravel-medialibrary | Spatie Laravel Media Library contains a server-side request forgery vulnerability | high | 7.4 | 0% |
| CVE-2024-13461 | autoship-cloud (WordPress plugin) | The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 0% |
| CVE-2022-4936 | wc-multivendor-marketplace (WordPress plugin) | The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missin | medium | 6.3 | 0% |
| CVE-2022-4938 | wc-frontend-manager (WordPress plugin) | The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to mi | medium | 6.3 | 0% |
| CVE-2025-48203 | clickstorm/cs-seo | [clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability | medium | 5.5 | 0% |
| CVE-2023-37968 | falang (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Faboba Falang multilanguage for WordPress plugin <= 1.3.39 versions. | medium | 5.4 | 0% |
| CVE-2025-67559 | online-booking-\&-scheduling-calendar (WordPress plugin) | Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows E | medium | 5.4 | 0% |
| CVE-2023-6980 | wp-sms (WordPress plugin) | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Req | medium | 4.3 | 0% |
| CVE-2026-34754 | mantisbt/mantisbt | MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API | medium | 4.3 | 0% |
| CVE-2026-16648 | drupal/symfony_mailer_log | This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports > | unknown | 0.0 | 0% |
| CVE-2026-41128 | craftcms/cms | Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action | medium | 0.0 | 0% |
| CVE-2026-87951 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2025-69198 | pterodactyl/panel | Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted | medium | 6.5 | 0% |
| CVE-2025-0450 | betheme (WordPress plugin) | The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to | medium | 6.4 | 0% |
| CVE-2025-6068 | foogallery (WordPress plugin) | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Si | medium | 6.4 | 0% |
| CVE-2026-48167 | filament/infolists, filament/tables | Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS | medium | 6.4 | 0% |
| CVE-2025-5528 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon | medium | 6.1 | 0% |
| CVE-2026-34247 | wwbn/avideo | AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notificat | medium | 5.4 | 0% |
| CVE-2024-6171 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all vers | medium | 5.3 | 0% |
| CVE-2025-5125 | custom-post-carousels-with-owl (WordPress plugin) | The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attri | medium | 4.8 | 0% |
| CVE-2024-0653 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and in | medium | 4.4 | 0% |
| CVE-2024-12045 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 4.4 | 0% |
| CVE-2020-8934 | site-kit (WordPress plugin) | The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This i | medium | 4.3 | 0% |
| CVE-2023-0831 | under-construction-page (WordPress plugin) | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due | medium | 4.3 | 0% |
| CVE-2023-1414 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow a | medium | 4.3 | 0% |
| CVE-2023-2627 | kivicare (WordPress plugin) | The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenti | medium | 4.3 | 0% |
| CVE-2023-48323 | awesome-support (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin allows Cross S | medium | 4.3 | 0% |
| CVE-2024-13724 | wallet-system-for-woocommerce (WordPress plugin) | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2024-2429 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow atta | medium | 4.3 | 0% |
| CVE-2025-49597 | handcraftedinthealps/goodby-csv | handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution | low | 3.9 | 0% |
| CVE-2026-41498 | kimai/kimai | Kimai has Missing Object-Level Authorization in the Team API | low | 3.3 | 0% |
| CVE-2025-62365 | librenms/librenms | LibreNMS is vulnerable to Reflected-XSS in `report_this` function | medium | 0.0 | 0% |
| CVE-2025-66309 | getgrav/grav | Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in | medium | 0.0 | 0% |
| CVE-2026-33517 | mantisbt/mantisbt | MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation | high | 0.0 | 0% |
| CVE-2026-48747 | symfony/mailomat-mailer, symfony/symfony | Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade | medium | 0.0 | 0% |
| CVE-2024-13315 | shopwarden (WordPress plugin) | The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | high | 8.8 | 0% |
| CVE-2024-12038 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | medium | 6.4 | 0% |