Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-6982 | showdoc/showdoc | ShowDoc has an Injection vulnerability | medium | 6.3 | 0% |
| CVE-2025-9822 | mautic/core | Mautic vulnerable to secret data extraction via elfinder | medium | 5.5 | 0% |
| CVE-2023-2893 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-2894 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-2895 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-2896 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-3408 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing o | medium | 4.3 | 0% |
| CVE-2024-30457 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress | medium | 4.3 | 0% |
| CVE-2026-2897 | funadmin/funadmin | funadmin: XSS through Value argument in Backend Interface component | low | 2.4 | 0% |
| CVE-2026-3573 | drupal/ai | The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the abi | unknown | 0.0 | 0% |
| CVE-2026-4933 | drupal/unpublished_node_permissions | This module creates permissions per node content type to control access to unpublished nodes per content type. The modu | unknown | 0.0 | 0% |
| CVE-2026-96370 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-96372 | drupal/webform | The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently rest | unknown | 0.0 | 0% |
| CVE-2024-13146 | booknetic (WordPress plugin) | The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logge | high | 8.8 | 0% |
| CVE-2026-32818 | admidio/admidio | Admidio is Missing Authorization on Forum Topic and Post Deletion | medium | 6.5 | 0% |
| CVE-2026-41658 | admidio/admidio | Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items | medium | 6.5 | 0% |
| CVE-2025-6997 | addons (WordPress plugin) | The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2025-65186 | getgrav/grav | Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor | medium | 6.1 | 0% |
| CVE-2026-33499 | wwbn/avideo | AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php | medium | 6.1 | 0% |
| CVE-2025-66578 | robrichards/xmlseclibs | robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation | medium | 6.0 | 0% |
| CVE-2025-3130 | drupal/obfuscate | This module enables you to obfuscate email addresses, to avoid them being easily available to spammers. The module does | medium | 5.4 | 0% |
| CVE-2026-33628 | invoiceninja/invoiceninja | Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items | medium | 5.4 | 0% |
| CVE-2022-51016 | pocketmine/pocketmine-mp | Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP | medium | 4.7 | 0% |
| CVE-2022-4309 | subscribe2 (WordPress plugin) | The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in a | low | 3.1 | 0% |
| CVE-2026-8347 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog | low | 0.0 | 0% |
| CVE-2024-7688 | azindex (WordPress plugin) | The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin del | medium | 6.5 | 0% |
| CVE-2024-7817 | misiek-photo-album (WordPress plugin) | The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged i | medium | 6.5 | 0% |
| CVE-2024-13402 | buddyboss-platform (WordPress plugin) | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up t | medium | 6.4 | 0% |
| CVE-2025-1459 | siteorigin-panels (WordPress plugin) | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded Video(PB) widget in all ve | medium | 6.4 | 0% |
| CVE-2022-38075 | mantenimiento-web (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPres | medium | 6.1 | 0% |
| CVE-2026-47741 | shopper/cart | shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption | medium | 5.9 | 0% |
| CVE-2026-39390 | ci4-cms-erp/ci4ms | CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting | medium | 5.5 | 0% |
| CVE-2023-0520 | rapidexpcart (WordPress plugin) | The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it | medium | 5.4 | 0% |
| CVE-2024-1213 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all | medium | 5.4 | 0% |
| CVE-2026-54256 | winter/wn-backend-module | Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata | medium | 5.4 | 0% |
| CVE-2025-5194 | wp-map-block (WordPress plugin) | The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page | medium | 4.8 | 0% |
| CVE-2024-1214 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all | medium | 4.3 | 0% |
| CVE-2024-1489 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-13283 | drupal/facets | This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently filte | unknown | 0.0 | 0% |
| CVE-2025-13986 | drupal/disable_login | This module enables you to disable the standard Drupal login form (`/user/login`) so site owners can prevent interactive | unknown | 0.0 | 0% |
| CVE-2025-32427 | verbb/formie | Formie has XSS vulnerability for importing forms | medium | 0.0 | 0% |
| CVE-2026-42612 | getgrav/grav | Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes | high | 8.5 | 0% |
| CVE-2025-10006 | page-builder (WordPress plugin) | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rev_slider_vc' shortcode in al | medium | 6.4 | 0% |
| CVE-2024-13816 | aiomatic (WordPress plugin) | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unaut | medium | 5.4 | 0% |
| CVE-2026-3241 | concrete5/concrete5 | Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability | medium | 4.8 | 0% |
| CVE-2025-47702 | drupal/oembed_providers | This module extends the core Media module and allows site creators to permit oEmbed providers in addition to YouTube and | unknown | 0.0 | 0% |
| CVE-2025-47703 | drupal/cookies | The COOKIES module protects users from executing JavaScript code provided by third parties, e.g., to display ads or trac | unknown | 0.0 | 0% |
| CVE-2025-47704 | drupal/klaro | Klaro Cookie & Consent Management module is used for consent management for cookies and external sources. It makes chang | unknown | 0.0 | 0% |
| CVE-2026-11607 | typo3/cms-core, typo3/cms-form | TYPO3 CMS has Broken Access Control in its Form Framework | high | 0.0 | 0% |
| CVE-2026-118540 | drupal/commerce | This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal | unknown | 0.0 | 0% |