Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-5539 | wp-easy-contact (WordPress plugin) | The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu | medium | 6.4 | 0% |
| CVE-2026-6626 | cockpit-hq/cockpit | Cockpit has NoSQL Injection Through Content Aggregation Pipelines | medium | 6.3 | 0% |
| CVE-2025-2808 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Phone Num | medium | 5.4 | 0% |
| CVE-2024-55945 | typo3/cms-lowlevel | TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2026-52840 | alextselegidis/easyappointments | Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network | low | 2.7 | 0% |
| CVE-2026-61825 | code16/sharp | code16/sharp has a stored XSS via data-html-content Sanitizer Bypass | high | 8.7 | 0% |
| CVE-2024-12774 | altra-side-menu (WordPress plugin) | The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in adm | medium | 6.5 | 0% |
| CVE-2026-33886 | statamic/cms | Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields | medium | 6.5 | 0% |
| CVE-2024-3590 | letterpress (WordPress plugin) | The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in user | medium | 6.1 | 0% |
| CVE-2024-54356 | online-booking-\&-scheduling-calendar (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vc | medium | 5.4 | 0% |
| CVE-2026-3242 | concrete5/concrete5 | Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability | medium | 4.8 | 0% |
| CVE-2023-4059 | profile-builder (WordPress plugin) | The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated us | medium | 4.3 | 0% |
| CVE-2024-0373 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 4.3 | 0% |
| CVE-2024-0374 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 4.3 | 0% |
| CVE-2024-0827 | play-ht (WordPress plugin) | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | 0% |
| CVE-2024-1162 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. T | medium | 4.3 | 0% |
| CVE-2025-8944 | oceanwp (WordPress plugin) | The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request hand | medium | 4.3 | 0% |
| CVE-2026-3210 | drupal/material_icons | This module enables you to add icons to CKEditor. The module doesn't sufficiently add custom permissions to the dialog | unknown | 0.0 | 0% |
| CVE-2026-45701 | sulu/sulu | Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens | medium | 0.0 | 0% |
| CVE-2026-87940 | drupal/key_auth | This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, poten | unknown | 0.0 | 0% |
| CVE-2026-24739 | symfony/process, symfony/symfony | Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows | medium | 6.3 | 0% |
| CVE-2024-6136 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make | medium | 5.4 | 0% |
| CVE-2026-41232 | froxlor/froxlor | Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing | medium | 5.0 | 0% |
| CVE-2024-10521 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including | medium | 4.3 | 0% |
| CVE-2024-6628 | all-contact-form-integration-for-elementor (WordPress plugin) | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in al | medium | 4.3 | 0% |
| CVE-2024-8157 | alphabetical-list (WordPress plugin) | The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2024-8476 | easy-paypal-events-tickets (WordPress plugin) | The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is | medium | 4.3 | 0% |
| CVE-2025-4415 | drupal/piwik_pro | This module enables you to add the Piwik Pro web statistics tracking system to your website. The module does not check | unknown | 0.0 | 0% |
| CVE-2026-10769 | drupal/commerce | The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited | unknown | 0.0 | 0% |
| CVE-2026-15082 | drupal/siteimprove_analytics | The module doesn't sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tra | unknown | 0.0 | 0% |
| CVE-2026-15084 | drupal/ui_patterns | This module enables you to use Single Directory Components in site building (views, field formatters, blocks, layouts) a | unknown | 0.0 | 0% |
| CVE-2026-15085 | drupal/ai_seo | The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity (including its comment | unknown | 0.0 | 0% |
| CVE-2026-23622 | alextselegidis/easyappointments | alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass | high | 0.0 | 0% |
| CVE-2026-42069 | getkirby/cms | Kirby CMS's read access to site, user and role information is not gated by permissions | high | 0.0 | 0% |
| CVE-2026-96373 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-96378 | drupal/commerce_decoupled_checkout | This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The modul | unknown | 0.0 | 0% |
| CVE-2023-2892 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 6.5 | 0% |
| CVE-2025-5142 | simple-page-access-restriction (WordPress plugin) | The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. | medium | 6.5 | 0% |
| CVE-2024-12043 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) plugin for WordPress is vuln | medium | 6.4 | 0% |
| CVE-2024-12477 | avada-builder (WordPress plugin) | The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and i | medium | 6.4 | 0% |
| CVE-2024-12504 | videowhisper-live-streaming-integration (WordPress plugin) | The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2024-13354 | responsive-addons-for-elementor (WordPress plugin) | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cros | medium | 6.4 | 0% |
| CVE-2024-13389 | cliptakes (WordPress plugin) | The Cliptakes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cliptakes_input_email' shortcode in all ve | medium | 6.4 | 0% |
| CVE-2024-13458 | notice-faq (WordPress plugin) | The WordPress SEO Friendly Accordion FAQ with AI assisted content generation plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-13572 | precious-metals-chart-and-widgets (WordPress plugin) | The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfu | medium | 6.4 | 0% |
| CVE-2024-13586 | masy-gallery (WordPress plugin) | The Masy Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'justified-gallery' shortcode in all ver | medium | 6.4 | 0% |
| CVE-2026-39960 | mantisbt/mantisbt | MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values | medium | 5.4 | 0% |
| CVE-2023-5534 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is d | medium | 4.3 | 0% |
| CVE-2026-21896 | getkirby/cms | Kirby is missing permission checks in the content changes API | medium | 0.0 | 0% |
| CVE-2026-58589 | drupal/flowdrop | This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't | unknown | 0.0 | 0% |