Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-31690 | drupal/cache_utility | The Cache Utility module provides an ability to view status and flush various caches. The module doesn't sufficiently p | high | 8.8 | 0% |
| CVE-2026-27892 | facturascripts/facturascripts | FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download | medium | 6.5 | 0% |
| CVE-2024-0667 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 5.4 | 0% |
| CVE-2026-30964 | web-auth/webauthn-framework, web-auth/webauthn-lib, web-auth/webauthn-symfony-bundle | Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation | medium | 5.4 | 0% |
| CVE-2023-1918 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1919 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1920 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1921 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1922 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1923 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1924 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1925 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1926 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-1927 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due t | medium | 4.3 | 0% |
| CVE-2023-3254 | wp-reviews-plugin-for-google (WordPress plugin) | The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This | medium | 4.3 | 0% |
| CVE-2023-48652 | concrete5/concrete5 | Concrete CMS Cross Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2026-53675 | buddypress/buddypress | BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR | medium | 4.3 | 0% |
| CVE-2026-80201 | kimai/kimai | Kimai leaks API Token Hash via Invoice Twig Template | low | 2.0 | 0% |
| CVE-2025-48009 | drupal/single_content_sync | This module enables you to seamlessly migrate and deploy content across environments, eliminating manual steps. It simpl | unknown | 0.0 | 0% |
| CVE-2024-12301 | jsp-store-locator (WordPress plugin) | The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in u | medium | 6.5 | 0% |
| CVE-2024-13400 | kona-instagram-feed-for-gutenberg (WordPress plugin) | The Kona Gallery Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Kona: Instagram for Gutenberg" Block, spec | medium | 6.4 | 0% |
| CVE-2024-13460 | we-testimonial-slider (WordPress plugin) | The WE – Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Testimonial Author Names in all versions u | medium | 6.4 | 0% |
| CVE-2024-13527 | philantro (WordPress plugin) | The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes | medium | 6.4 | 0% |
| CVE-2024-13642 | stratum (WordPress plugin) | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hotspot widget in a | medium | 6.4 | 0% |
| CVE-2024-13664 | wp-post-list-table (WordPress plugin) | The WP Post List Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpb_post_list_table' shortcode in | medium | 6.4 | 0% |
| CVE-2024-13670 | music-sheet-viewer (WordPress plugin) | The Music Sheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pn_msv' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-13700 | embed-swagger-ui (WordPress plugin) | The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2025-3468 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th | medium | 6.4 | 0% |
| CVE-2026-34396 | wwbn/avideo | AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel | medium | 6.1 | 0% |
| CVE-2023-6788 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu | medium | 5.4 | 0% |
| CVE-2024-1306 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in user | medium | 5.4 | 0% |
| CVE-2026-33500 | wwbn/avideo | AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization | medium | 5.4 | 0% |
| CVE-2026-54242 | statamic/cms | Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) | medium | 4.9 | 0% |
| CVE-2024-10045 | transients-manager (WordPress plugin) | The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is | medium | 4.3 | 0% |
| CVE-2024-12436 | wp-customer-area (WordPress plugin) | The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in | medium | 4.3 | 0% |
| CVE-2024-3163 | easy-property-listings (WordPress plugin) | The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attacker | medium | 4.3 | 0% |
| CVE-2024-6925 | truebooker (WordPress plugin) | The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2024-8200 | reviews-feed (WordPress plugin) | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2024-9351 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | 0% |
| CVE-2024-9352 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | 0% |
| CVE-2024-9649 | wp-ulike (WordPress plugin) | The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2025-8891 | oceanwp (WordPress plugin) | The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect | medium | 4.3 | 0% |
| CVE-2026-15083 | drupal/eca | The Events, Conditions, Actions (ECA) module's Render submodule enables you to build render arrays and render inline Twi | unknown | 0.0 | 0% |
| CVE-2026-55805 | drupal/core | The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-sit | unknown | 0.0 | 0% |
| CVE-2024-6720 | light-poll (WordPress plugin) | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |
| CVE-2026-34236 | auth0/auth0-php | Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption | high | 8.2 | 0% |
| CVE-2024-13684 | reset (WordPress plugin) | The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing | high | 8.1 | 0% |
| CVE-2024-1231 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged | medium | 6.8 | 0% |
| CVE-2025-6729 | woocommerce-paymaster-gateway-019 (WordPress plugin) | The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 | medium | 6.4 | 0% |
| CVE-2024-7647 | ota-sync-booking-engine-widget (WordPress plugin) | The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. | medium | 6.1 | 0% |