Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-56736 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission | high | 8.2 | 0% |
| CVE-2026-33650 | wwbn/avideo | AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion | high | 7.6 | 0% |
| CVE-2023-2891 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 6.5 | 0% |
| CVE-2024-1232 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged | medium | 4.8 | 0% |
| CVE-2024-0514 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2026-118563 | drupal/cacheflush | The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has | unknown | 0.0 | 0% |
| CVE-2026-118564 | drupal/commerce_payumoney | The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has | unknown | 0.0 | 0% |
| CVE-2026-29177 | craftcms/commerce | Craft Commerce has stored XSS in Craft Commerce Order Details Slideout | low | 0.0 | 0% |
| CVE-2026-49741 | typo3/cms-core, typo3/cms-form | TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework | high | 0.0 | 0% |
| CVE-2026-77131 | syssy/syssy-typo3-extension | TYPO3-EXT-SA-2026-015: Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy) | unknown | 0.0 | 0% |
| CVE-2026-44521 | studio-42/elfinder | elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL) | high | 8.8 | 0% |
| CVE-2026-33512 | wwbn/avideo | AVideo has an unauthenticated decrypt oracle leaking any ciphertext | high | 7.5 | 0% |
| CVE-2025-54676 | online-booking-\&-scheduling-calendar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Cale | medium | 6.5 | 0% |
| CVE-2023-0832 | under-construction-page (WordPress plugin) | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due | medium | 4.3 | 0% |
| CVE-2026-55824 | contao/contao, contao/core-bundle | Contao crawler leaks auth credentials to external hosts | low | 2.6 | 0% |
| CVE-2024-13292 | drupal/tooltip | This module enables you to add any HTML content you want in a tooltip displayed on mouse hover. The module does not suf | unknown | 0.0 | 0% |
| CVE-2024-13298 | drupal/tarte_au_citron | This module integrates Tarte au citron JS library with Drupal and prevent services to be loaded without user consent. Ad | unknown | 0.0 | 0% |
| CVE-2024-13305 | drupal/entity_form_steps | This module allows a site builder to create multi-step entity forms leveraging the Field Group field type plugins. The | unknown | 0.0 | 0% |
| CVE-2025-13082 | drupal/core | By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement. The defacemen | low | 0.0 | 0% |
| CVE-2026-96363 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-34394 | wwbn/avideo | AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking | high | 8.1 | 0% |
| CVE-2024-11832 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JavaScript row | medium | 6.4 | 0% |
| CVE-2024-12304 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via but | medium | 6.4 | 0% |
| CVE-2024-9058 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2025-8046 | injection-guard (WordPress plugin) | The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attr | medium | 6.1 | 0% |
| CVE-2025-8113 | ebook-store (WordPress plugin) | The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribu | medium | 6.1 | 0% |
| CVE-2023-1651 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settin | medium | 5.4 | 0% |
| CVE-2024-13775 | woocommerce-support-ticket-system (WordPress plugin) | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability c | medium | 5.4 | 0% |
| CVE-2025-7205 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes | medium | 5.4 | 0% |
| CVE-2022-4536 | ip-vault-wp-firewall (WordPress plugin) | The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to i | medium | 5.3 | 0% |
| CVE-2024-13420 | april (WordPress plugin), auteur (WordPress plugin), benaa (WordPress plugin) +1 more | Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions | medium | 4.3 | 0% |
| CVE-2025-1326 | homey (WordPress theme) | The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_ | medium | 4.3 | 0% |
| CVE-2025-1327 | homey (WordPress theme) | The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_d | medium | 4.3 | 0% |
| CVE-2025-5730 | contact-form (WordPress plugin) | The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.3 | 0% |
| CVE-2026-34738 | wwbn/avideo | AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter | medium | 4.3 | 0% |
| CVE-2025-48206 | nitsan/ns-backup | The Backup Plus extension for TYPO3 (ns_backup) allows XSS | low | 0.0 | 0% |
| CVE-2025-68954 | pterodactyl/panel | Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced | high | 0.0 | 0% |
| CVE-2026-114571 | drupal/rabbit_hole | Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or | unknown | 0.0 | 0% |
| CVE-2026-18986 | drupal/entity_browser | The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widge | unknown | 0.0 | 0% |
| CVE-2026-19418 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS - Broken Access Control in Backend and Install Tool | high | 0.0 | 0% |
| CVE-2026-30879 | baserproject/basercms | baserCMS has a cross-site scripting vulnerability in blog posts | medium | 0.0 | 0% |
| CVE-2026-3240 | concrete5/concrete5 | Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 0% |
| CVE-2026-33766 | wwbn/avideo | AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints | medium | 0.0 | 0% |
| CVE-2026-49212 | symfony/ux-live-component | symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding | low | 0.0 | 0% |
| CVE-2026-81167 | drupal/address_suggestion | The Address Suggestion module provides address autocomplete functionality using configured address providers. The modul | unknown | 0.0 | 0% |
| CVE-2026-63498 | snipe/snipe-it | Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API | high | 8.7 | 0% |
| CVE-2024-5284 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as esca | medium | 6.8 | 0% |
| CVE-2024-13350 | searchiq (WordPress plugin) | The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortc | medium | 6.4 | 0% |
| CVE-2024-13388 | tcbd-tooltip (WordPress plugin) | The TCBD Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbdtooltip_text' shortcode in all vers | medium | 6.4 | 0% |
| CVE-2025-1407 | amo-team-showcase (WordPress plugin) | The AMO Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's amoteam_skills shortcode in all ver | medium | 6.4 | 0% |