Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-58590 | drupal/flowdrop | This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't | unknown | 0.0 | 0% |
| CVE-2026-81164 | drupal/entity_pdf | The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view a | unknown | 0.0 | 0% |
| CVE-2026-84924 | drupal/otp_verification | This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently fi | unknown | 0.0 | 0% |
| CVE-2026-26274 | october/october | October CMS has Safe Mode Bypass via Twig Database Write Operations | medium | 6.6 | 0% |
| CVE-2024-8047 | visual-sound (WordPress plugin) | The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 0% |
| CVE-2025-28094 | shopxo/shopxo | ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) | medium | 6.5 | 0% |
| CVE-2025-60868 | alt-design/alt-redirect | Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw | medium | 6.5 | 0% |
| CVE-2024-3063 | wpb-elementor-addons (WordPress plugin) | The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the output of 'tags' added to widgets in all | medium | 6.4 | 0% |
| CVE-2026-42879 | facturascripts/facturascripts | FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images | medium | 6.3 | 0% |
| CVE-2022-45847 | countdown-widget (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.Me WordPress Countdown Widget allows Cross-Site Scripting (XSS).This issue affec | medium | 6.1 | 0% |
| CVE-2026-31825 | sylius/sylius | Sylius has a DQL Injection via API Order Filters | medium | 5.3 | 0% |
| CVE-2023-0420 | custom-post-type-and-taxonomy-gui-manager (WordPress plugin) | The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping | medium | 4.8 | 0% |
| CVE-2026-55766 | guzzlehttp/psr7 | guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization | medium | 4.8 | 0% |
| CVE-2022-38468 | nextgen-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail al | medium | 4.3 | 0% |
| CVE-2023-6243 | eventon-lite (WordPress plugin) | The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u | medium | 4.3 | 0% |
| CVE-2024-3972 | similarity (WordPress plugin) | The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 4.3 | 0% |
| CVE-2024-6853 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2024-3471 | button-generator (WordPress plugin) | The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make | low | 3.4 | 0% |
| CVE-2024-13238 | drupal/typogrify | The Typogrify module brings the typographic refinements of Typogrify to Drupal. It provides a text filter and a Twig fil | unknown | 0.0 | 0% |
| CVE-2024-13245 | drupal/ckeditor_lts | The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a [ | unknown | 0.0 | 0% |
| CVE-2024-13247 | drupal/coffee | The Coffee module helps you to navigate through the Drupal admin menus faster with a shortcut popup. The module doesn't | unknown | 0.0 | 0% |
| CVE-2024-13252 | drupal/tacjs | This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficientl | unknown | 0.0 | 0% |
| CVE-2025-63828 | backdrop/backdrop | Backdrop CMS Host Header Injection vulnerability | medium | 0.0 | 0% |
| CVE-2025-66308 | getgrav/grav | Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]` | medium | 0.0 | 0% |
| CVE-2025-66310 | getgrav/grav | Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab | medium | 0.0 | 0% |
| CVE-2025-66311 | getgrav/grav | Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters | medium | 0.0 | 0% |
| CVE-2025-66312 | getgrav/grav | Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName] | medium | 0.0 | 0% |
| CVE-2026-0948 | drupal/social_auth_entra_id | This module enables Drupal sites to authenticate users via Microsoft Entra ID (formerly Azure AD) using OAuth 2.0. The | unknown | 0.0 | 0% |
| CVE-2026-118582 | drupal/captcha | The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on lat | unknown | 0.0 | 0% |
| CVE-2026-1323 | cpsit/typo3-mailqueue | The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class | high | 8.8 | 0% |
| CVE-2026-41235 | froxlor/froxlor | Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement | high | 8.8 | 0% |
| CVE-2026-33723 | wwbn/avideo | AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter | high | 7.1 | 0% |
| CVE-2026-55651 | alextselegidis/easyappointments | Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure | high | 7.1 | 0% |
| CVE-2024-6490 | master-slider (WordPress plugin) | During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to m | medium | 6.5 | 0% |
| CVE-2023-7202 | fatal-error-notify (WordPress plugin) | The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any | medium | 6.1 | 0% |
| CVE-2022-4529 | security-antivirus-firewall (WordPress plugin) | The Security, Antivirus, Firewall – S.A.F plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.3.5. | medium | 5.3 | 0% |
| CVE-2024-13748 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions u | medium | 4.4 | 0% |
| CVE-2024-45270 | carousel-slider (WordPress plugin) | WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feat | medium | 4.3 | 0% |
| CVE-2025-62394 | moodle/moodle | Moodle sends quiz-related messages to inactive/suspended users | medium | 4.3 | 0% |
| CVE-2025-14457 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a m | low | 3.7 | 0% |
| CVE-2025-48916 | drupal/bookable_calendar | This module enables you to setup a repeating date rule that users can "book" different dates, allowing you to let users | unknown | 0.0 | 0% |
| CVE-2026-107267 | drupal/dkan | The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports t | unknown | 0.0 | 0% |
| CVE-2026-114530 | drupal/dopup | The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient | unknown | 0.0 | 0% |
| CVE-2026-114533 | drupal/agora_theme | This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV file | unknown | 0.0 | 0% |
| CVE-2026-114535 | drupal/swiper_formatter | Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and | unknown | 0.0 | 0% |
| CVE-2026-114537 | drupal/view_unpublished | This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished trans | unknown | 0.0 | 0% |
| CVE-2026-11908 | drupal/tagify | This module integrates the Tagify JavaScript library to enhance entity reference selection in entity reference widgets. | unknown | 0.0 | 0% |
| CVE-2026-3244 | concrete5/concrete5 | Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability | medium | 0.0 | 0% |
| CVE-2026-58591 | drupal/colorbox | The Colorbox module integrates with the Colorbox JavaScript library to display content in an overlay above the page. Th | unknown | 0.0 | 0% |
| CVE-2025-31677 | drupal/ai | The Drupal AI module provides a framework for easily integrating Artificial Intelligence on any Drupal site using any ki | high | 8.8 | 0% |