Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3947 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to mi | medium | 4.3 | 0% |
| CVE-2024-9689 | post-from-frontend (WordPress plugin) | The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logg | medium | 4.3 | 0% |
| CVE-2025-13985 | drupal/entity_share | This module enables you to deploy content from one Drupal website to another. The module provides some default configur | unknown | 0.0 | 0% |
| CVE-2024-12386 | wp-abstracts-manuscripts-manager (WordPress plugin) | The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due t | high | 8.1 | 0% |
| CVE-2026-47742 | shopper/framework | Shopper: Missing authorization on Product admin Livewire sub-form components | medium | 6.5 | 0% |
| CVE-2026-47745 | shopper/framework | Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables | medium | 6.5 | 0% |
| CVE-2026-7688 | dolibarr/dolibarr | Dolibarr has an Injection issue | medium | 5.0 | 0% |
| CVE-2023-6501 | splashscreen (WordPress plugin) | The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-11842 | shipping-by-weight-for-woocommerce (WordPress plugin) | The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which co | medium | 4.3 | 0% |
| CVE-2025-1383 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. | medium | 4.3 | 0% |
| CVE-2025-11570 | drupal-pattern-lab/unified-twig-extensions | drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS | low | 0.0 | 0% |
| CVE-2026-107254 | drupal/auth_login_plus | This module provides TOTP-based two-factor authentication (2FA) for Drupal. The module doesn't enforce the second facto | unknown | 0.0 | 0% |
| CVE-2026-34598 | yeswiki/yeswiki | YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter" | high | 0.0 | 0% |
| CVE-2026-55807 | drupal/core | The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via `provide | unknown | 0.0 | 0% |
| CVE-2024-13675 | slingblocks (WordPress plugin) | The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2025-1261 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Cou | medium | 6.4 | 0% |
| CVE-2025-1664 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2025-1441 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 6.1 | 0% |
| CVE-2025-8897 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'fl_builder' param | medium | 6.1 | 0% |
| CVE-2026-50182 | wwbn/avideo | WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination | medium | 6.1 | 0% |
| CVE-2026-42267 | kimai/kimai | Kimai vulnerable to formula Injection via tag names in XLSX export | medium | 5.7 | 0% |
| CVE-2022-30705 | wordpress-ping-optimizer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions. | medium | 5.4 | 0% |
| CVE-2023-25706 | better-robots.txt (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Pagup WordPress Robots.Txt optimization plugin <= 1.4.5 versions. | medium | 5.4 | 0% |
| CVE-2023-37391 | wordpress-mobile-pack (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid | medium | 5.4 | 0% |
| CVE-2023-34029 | disable-wordpress-update-notifications-and-auto-update-email-notifications (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications pl | medium | 4.3 | 0% |
| CVE-2023-34185 | wordpress-nextgen-galleryview (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions. | medium | 4.3 | 0% |
| CVE-2025-57407 | gp247/core, s-cart/core | GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability | low | 0.0 | 0% |
| CVE-2025-6677 | drupal/paragraphs_table | Project Paragraphs table provides a field for a collection table. The module doesn't sufficiently sanitise certain data | unknown | 0.0 | 0% |
| CVE-2026-87948 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2023-6529 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users | medium | 6.1 | 0% |
| CVE-2026-6365 | drupal/core | Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can l | medium | 6.1 | 0% |
| CVE-2026-53723 | guzzlehttp/guzzle-services | guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator | medium | 5.8 | 0% |
| CVE-2026-31352 | feehi/cms | Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Role Management module | medium | 5.4 | 0% |
| CVE-2026-31354 | feehi/cms | Feehi CMS has authenticated stored cross-site scripting (XSS) vulnerabilities via the Permissions module | medium | 5.4 | 0% |
| CVE-2023-2919 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missi | medium | 4.3 | 0% |
| CVE-2024-44020 | wp-free-ssl (WordPress plugin) | Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issu | medium | 4.3 | 0% |
| CVE-2024-5808 | wp-ajax-contact-form (WordPress plugin) | The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which co | medium | 4.3 | 0% |
| CVE-2024-3823 | base64-encoder\/decoder (WordPress plugin) | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation a | low | 2.4 | 0% |
| CVE-2026-100872 | sylius/sylius | CVE-2026-100872: Order total can be inflated after a Payment Request has started a gateway transaction, marking the order fully paid | unknown | 0.0 | 0% |
| CVE-2026-107255 | drupal/restrict_route_by_ip | This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dy | unknown | 0.0 | 0% |
| CVE-2026-33161 | craftcms/cms | Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users | low | 0.0 | 0% |
| CVE-2026-87952 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2026-96380 | drupal/css_usage_analyzer | This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statisti | unknown | 0.0 | 0% |
| CVE-2026-96386 | drupal/smart_content | This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visi | unknown | 0.0 | 0% |
| CVE-2025-65956 | getformwork/formwork | Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags | medium | 6.5 | 0% |
| CVE-2026-39368 | wwbn/avideo | WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services | medium | 6.5 | 0% |
| CVE-2025-11160 | page-builder (WordPress plugin) | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, | medium | 6.4 | 0% |
| CVE-2025-11161 | page-builder (WordPress plugin) | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_custom_heading shortcode in all versi | medium | 6.4 | 0% |
| CVE-2021-24559 | qyrr (WordPress plugin) | The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-S | medium | 5.4 | 0% |
| CVE-2026-46365 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags | medium | 5.4 | 0% |