Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-47343 | typo3/cms-core | TYPO3 CMS: Destructive Actions on File Mount Folders | high | 0.0 | 0% |
| CVE-2026-47349 | typo3/cms-core, typo3/cms-recycler | TYPO3 CMS has Broken Access Control in the Recycler Module | medium | 0.0 | 0% |
| CVE-2026-47350 | typo3/cms-core | TYPO3 CMS has Broken Access Control in its DataHandler | medium | 0.0 | 0% |
| CVE-2026-47351 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS: Broken Access Control in Media Module | medium | 0.0 | 0% |
| CVE-2026-47352 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS has Broken Access Control in Backend API | medium | 0.0 | 0% |
| CVE-2023-0058 | tiempo (WordPress plugin) | The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation | medium | 6.1 | 0% |
| CVE-2023-1011 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the dashboard, and does not | medium | 6.1 | 0% |
| CVE-2025-0393 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 6.1 | 0% |
| CVE-2026-34368 | wwbn/avideo | AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance | medium | 5.3 | 0% |
| CVE-2024-2262 | woocommerce-product-filter (WordPress plugin) | Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users dele | medium | 4.7 | 0% |
| CVE-2023-7125 | peepso (WordPress plugin) | The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their p | medium | 4.3 | 0% |
| CVE-2026-33177 | statamic/cms | Statamic is missing authorization check on taxonomy term creation via fieldtype | medium | 4.3 | 0% |
| CVE-2026-49400 | october/system | October CMS: PHP Object Injection via Backend Widget Session Storage | low | 3.3 | 0% |
| CVE-2024-13294 | drupal/postfile | The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file i | unknown | 0.0 | 0% |
| CVE-2025-64174 | openmage/magento-lts | OpenMage vulnerable to XSS in Admin Notifications | medium | 0.0 | 0% |
| CVE-2026-2994 | concrete5/concrete5 | Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF) | low | 0.0 | 0% |
| CVE-2026-42174 | getkirby/cms | Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions | medium | 0.0 | 0% |
| CVE-2026-96371 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-42194 | admidio/admidio | Admidio has an incomplete fix for CVE-2026-32812 (SSRF) | medium | 6.8 | 0% |
| CVE-2025-10928 | drupal/access_code | This module enables users to sign in with an access code instead of entering user names and passwords. When users are al | medium | 6.3 | 0% |
| CVE-2024-11405 | wp-front-end-login-and-register (WordPress plugin) | The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_passwo | medium | 6.1 | 0% |
| CVE-2026-32757 | admidio/admidio | Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection | medium | 5.4 | 0% |
| CVE-2025-31682 | drupal/google_tag | This module enables you to integrate the site with the Google Tag Manager (GTM) application. The module doesn't have th | medium | 4.8 | 0% |
| CVE-2025-32426 | verbb/formie | Formie has XSS vulnerability for email notification content for preview | medium | 4.6 | 0% |
| CVE-2026-8492 | drupal/gtranslate | The GTranslate module provides a language switcher widget for Drupal sites. The module’s widget JavaScript did not suff | unknown | 0.0 | 0% |
| CVE-2026-48507 | snipe/snipe-it | Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users | high | 7.1 | 0% |
| CVE-2024-2857 | simple-buttons-creator (WordPress plugin) | The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowin | medium | 6.1 | 0% |
| CVE-2026-45694 | librenms/librenms | LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment | medium | 5.4 | 0% |
| CVE-2026-39391 | ci4-cms-erp/ci4ms | CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List | medium | 4.8 | 0% |
| CVE-2023-5519 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2024-2113 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-5331 | breakdance (WordPress plugin) | The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it | medium | 4.3 | 0% |
| CVE-2025-59016 | typo3/cms-core | TYPO3 CMS exposes sensitive information in an error message | medium | 0.0 | 0% |
| CVE-2025-59019 | typo3/cms-backend, typo3/cms-recordlist | TYPO3 CSV download feature information disclosure | medium | 0.0 | 0% |
| CVE-2025-6675 | drupal/miniorange_2fa | The module enables you to add second-factor authentication on top of the default Drupal login. The module does not suff | unknown | 0.0 | 0% |
| CVE-2026-29175 | craftcms/commerce | Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking | high | 0.0 | 0% |
| CVE-2024-12820 | google-distance-calculator (WordPress plugin) | The MK Google Directions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MKGD' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2025-0839 | zoomsounds (WordPress plugin) | The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due t | medium | 6.4 | 0% |
| CVE-2020-10237 | froxlor/froxlor | Froxlor Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.5 | 0% |
| CVE-2025-5035 | firelight-lightbox (WordPress plugin) | The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, whic | medium | 5.4 | 0% |
| CVE-2025-5093 | responsive-lightbox (WordPress plugin) | The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes | medium | 5.4 | 0% |
| CVE-2025-2799 | wp-event-manager (WordPress plugin) | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | medium | 4.4 | 0% |
| CVE-2026-0944 | drupal/ginvite | This module enables allows group managers to invite people into their group. The module doesn't sufficiently check acce | unknown | 0.0 | 0% |
| CVE-2026-96360 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-34561 | ci4-cms-erp/ci4ms | CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via S | critical | 9.1 | 0% |
| CVE-2024-6719 | offload-videos (WordPress plugin) | The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privil | high | 8.1 | 0% |
| CVE-2024-13356 | dsgvo-all-in-one-for-wp (WordPress plugin) | The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This | medium | 6.5 | 0% |
| CVE-2024-9416 | modula-best-grid-gallery (WordPress plugin) | The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript libr | medium | 6.4 | 0% |
| CVE-2025-1663 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions u | medium | 6.4 | 0% |
| CVE-2025-3276 | skt-blocks (WordPress plugin) | The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block | medium | 6.4 | 0% |