Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4533 | limit-login-attempts-plus (WordPress plugin) | The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due | medium | 5.3 | 0% |
| CVE-2026-40935 | wwbn/avideo | CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure | medium | 5.3 | 0% |
| CVE-2023-25170 | prestashop/prestashop | Possible CSRF token fixation | medium | 5.0 | 0% |
| CVE-2026-44831 | snipe/snipe-it | Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) | medium | 4.8 | 0% |
| CVE-2023-6633 | side-notes (WordPress plugin) | The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make | medium | 4.3 | 0% |
| CVE-2024-1503 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, | medium | 4.3 | 0% |
| CVE-2025-48923 | drupal/toc_js | This module enables you to generate Table of content of your pages given a configuration. The module doesn't sufficient | unknown | 0.0 | 0% |
| CVE-2025-6674 | drupal/ckeditor5_youtube | The CKEditor5 Youtube module enhances content creation in Drupal by seamlessly integrating YouTube video embedding into | unknown | 0.0 | 0% |
| CVE-2025-6676 | drupal/simple_sitemap | [Simple XML sitemap](https://www.drupal.org/project/simple_sitemap) is a SEO module that allows creating various XML sit | unknown | 0.0 | 0% |
| CVE-2026-114572 | drupal/domain_login_restrict | This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users can o | unknown | 0.0 | 0% |
| CVE-2026-118554 | drupal/oidc | The module enables authentication via the OpenID Connect (oAuth2) protocol. When a new user logs in via OpenID Connect, | unknown | 0.0 | 0% |
| CVE-2026-56383 | craftcms/cms | Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type | low | 0.0 | 0% |
| CVE-2026-87945 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2026-96357 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-96358 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-96361 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2024-11916 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due t | high | 7.4 | 0% |
| CVE-2025-6378 | responsive-food-and-drink-menu (WordPress plugin) | The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shor | medium | 6.4 | 0% |
| CVE-2023-7203 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as l | medium | 6.1 | 0% |
| CVE-2026-25133 | october/rain | October Rain has Stored XSS via SVG Filter Bypass | medium | 4.8 | 0% |
| CVE-2023-6292 | ecwid-ecommerce-shopping-cart (WordPress plugin) | The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could a | medium | 4.3 | 0% |
| CVE-2026-13237 | drupal/ai_agents | This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools. Under certain circ | unknown | 0.0 | 0% |
| CVE-2026-13238 | drupal/commerce_realex | This module enables you to take payments through the Global Payments / Realex Hosted Payment Page (HPP), either via a li | unknown | 0.0 | 0% |
| CVE-2024-5077 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 6.8 | 0% |
| CVE-2023-6197 | audio-merchant (WordPress plugin) | The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due | medium | 5.4 | 0% |
| CVE-2025-62798 | code16/sharp | Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax | medium | 5.4 | 0% |
| CVE-2026-41063 | wwbn/avideo | WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS | medium | 5.4 | 0% |
| CVE-2025-3479 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions u | medium | 5.3 | 0% |
| CVE-2025-6680 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 4.3 | 0% |
| CVE-2026-72701 | getgrav/grav | Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection | low | 3.7 | 0% |
| CVE-2026-31859 | craftcms/cms | CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization | medium | 0.0 | 0% |
| CVE-2026-55885 | getgrav/grav | Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets | medium | 6.8 | 0% |
| CVE-2023-4000 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. | medium | 6.3 | 0% |
| CVE-2024-12545 | scratch-win-giveaways-for-website-facebook (WordPress plugin) | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vu | medium | 5.4 | 0% |
| CVE-2023-2285 | wp-security-audit-log (WordPress plugin) | The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This i | medium | 4.3 | 0% |
| CVE-2024-2110 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2025-48922 | drupal/glightbox | GLightbox module is a pure Javascript lightbox for CKEditor. The module doesn't sufficiently filter user-supplied text | unknown | 0.0 | 0% |
| CVE-2026-49740 | typo3/cms-core | TYPO3 CMS has Insecure Deserialization via Core API | medium | 0.0 | 0% |
| CVE-2026-39370 | wwbn/avideo | WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix | high | 7.1 | 0% |
| CVE-2024-13469 | pricingtable (WordPress plugin) | The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to | medium | 6.4 | 0% |
| CVE-2024-13702 | crm-customer-relationship-management-by-vcita (WordPress plugin) | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingSchedul | medium | 6.4 | 0% |
| CVE-2024-9019 | secupress (WordPress plugin) | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's secupress_check_b | medium | 6.4 | 0% |
| CVE-2025-1439 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all ve | medium | 6.4 | 0% |
| CVE-2023-6503 | wp-plugin-lister (WordPress plugin) | The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping | medium | 5.4 | 0% |
| CVE-2026-55219 | paymenter/paymenter | Paymenter has race condition in payWithCredit() that enables credit double-spend | medium | 5.3 | 0% |
| CVE-2026-43882 | wwbn/avideo | AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing | medium | 4.3 | 0% |
| CVE-2026-12202 | intelliants/subrion | Subrion CMS vulnerable to Cross-site Scripting | low | 2.4 | 0% |
| CVE-2026-118542 | drupal/commerce | This module enables you to sell goods and services to customers through a shopping cart and checkout form. Sites can als | unknown | 0.0 | 0% |
| CVE-2026-31822 | sylius/sylius | Sylius has a XSS vulnerability in checkout login form | medium | 0.0 | 0% |
| CVE-2026-8491 | drupal/node_view_permissions | Node view permissions module enables permissions "View own content" and "View any content" for each content type on perm | unknown | 0.0 | 0% |