Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-40296 | phpoffice/phpspreadsheet | PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer | medium | 5.4 | 0% |
| CVE-2024-5029 | cm-table-of-contents (WordPress plugin) | The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as | medium | 4.8 | 0% |
| CVE-2023-6385 | wordpress-ping-optimizer (WordPress plugin) | The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2025-9294 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missi | medium | 4.3 | 0% |
| CVE-2026-2728 | librenms/librenms | LibreNMS: Cross-Site Scripting in ShowConfigController | low | 3.5 | 0% |
| CVE-2025-29790 | contao/core-bundle | Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads | medium | 0.0 | 0% |
| CVE-2026-56393 | craftcms/cms | Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options | low | 0.0 | 0% |
| CVE-2026-87946 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2026-4776 | mautic/core | Mautic has SQL Injection in API Contact Filtering | high | 7.1 | 0% |
| CVE-2026-39963 | s9y/serendipity | Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php | medium | 6.9 | 0% |
| CVE-2024-5028 | cm-search-and-replace (WordPress plugin) | The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attacke | medium | 6.5 | 0% |
| CVE-2024-8044 | infolinks-ad-wrap (WordPress plugin) | The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 0% |
| CVE-2025-2299 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. | medium | 6.1 | 0% |
| CVE-2025-60799 | phppgadmin/phppgadmin | phppgadmin contains an incorrect access control vulnerability | medium | 6.1 | 0% |
| CVE-2026-34739 | wwbn/avideo | AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php | medium | 6.1 | 0% |
| CVE-2024-1407 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.4 | 0% |
| CVE-2025-62401 | moodle/moodle | Moodle has a time restriction bypass | medium | 5.4 | 0% |
| CVE-2026-7317 | getgrav/grav | Grav has Insecure Deserialization in File Cache | medium | 5.0 | 0% |
| CVE-2021-25117 | wp-postratings (WordPress plugin) | The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.ph | medium | 4.8 | 0% |
| CVE-2024-3582 | ungallery (WordPress plugin) | The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 4.8 | 0% |
| CVE-2024-0512 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-31430 | bear---woocommerce-bulk-editor-and-products-manager-professional (WordPress plugin), wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional, realmag777 BEAR – | medium | 4.3 | 0% |
| CVE-2024-13286 | drupal/svg_embed | This module enables you to embed the content of an SVG file into the body html of a node and optionally allows to transl | unknown | 0.0 | 0% |
| CVE-2024-13287 | drupal/views_svg_animation | This module enables you to animate an SVG graphic by selecting certain rows in a view. The module doesn't sufficiently | unknown | 0.0 | 0% |
| CVE-2025-48917 | drupal/eu_cookie_compliance | This module addresses the General Data Protection Regulation (GDPR) and the EU Directive on Privacy and Electronic Commu | unknown | 0.0 | 0% |
| CVE-2025-48919 | drupal/simple_klaro | The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to configure it acco | unknown | 0.0 | 0% |
| CVE-2026-27621 | typicms/core | TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload | medium | 0.0 | 0% |
| CVE-2026-33295 | wwbn/avideo | AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php | high | 0.0 | 0% |
| CVE-2026-7879 | concrete5/concrete5 | Concrete CMS has an unauthorized file access issue | medium | 0.0 | 0% |
| CVE-2025-11823 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Store | medium | 6.4 | 0% |
| CVE-2024-3478 | herd-effects (WordPress plugin) | The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged i | medium | 6.1 | 0% |
| CVE-2023-3510 | ftp-access (WordPress plugin) | The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisati | medium | 5.4 | 0% |
| CVE-2024-0516 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability | medium | 5.3 | 0% |
| CVE-2026-35179 | wwbn/avideo | AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php | medium | 5.3 | 0% |
| CVE-2023-51538 | awesome-support (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue aff | medium | 4.3 | 0% |
| CVE-2023-52119 | icegram-engage (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email | medium | 4.3 | 0% |
| CVE-2023-52128 | white-label (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.Thi | medium | 4.3 | 0% |
| CVE-2024-13883 | wpupper-share-buttons (WordPress plugin) | The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This | medium | 4.3 | 0% |
| CVE-2026-33764 | wwbn/avideo | AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions | medium | 4.3 | 0% |
| CVE-2026-48011 | shopware/core, shopware/platform | Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames | low | 3.7 | 0% |
| CVE-2025-1622 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privile | low | 3.5 | 0% |
| CVE-2026-52838 | alextselegidis/easyappointments | Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS | low | 2.6 | 0% |
| CVE-2025-71177 | lavalite/cms | LavaLite CMS affected by a stored cross-site scripting vulnerability | medium | 0.0 | 0% |
| CVE-2026-49992 | kimai/kimai | Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes | medium | 0.0 | 0% |
| CVE-2026-96359 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-49284 | simplesamlphp/simplesamlphp | SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking | high | 7.1 | 0% |
| CVE-2025-1458 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2022-4014 | feehi/feehicms | Cross-Site Request Forgery in feehi/feehicms | medium | 4.3 | 0% |
| CVE-2024-3943 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to mi | medium | 4.3 | 0% |
| CVE-2024-3945 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to mi | medium | 4.3 | 0% |