Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-9809 | mautic/core | Mautic has Stored Cross-Site Scripting (XSS) in Projects Component | high | 7.6 | 0% |
| CVE-2024-8094 | ntz-atispam (WordPress plugin) | The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 6.5 | 0% |
| CVE-2024-8286 | gdpr-cookie-consent (WordPress plugin) | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers | medium | 6.5 | 0% |
| CVE-2025-3527 | eventon (WordPress plugin) | The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib | medium | 6.4 | 0% |
| CVE-2024-1954 | oliver-pos (WordPress plugin) | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a | medium | 6.3 | 0% |
| CVE-2026-55599 | phpseclib/phpseclib | phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information | medium | 5.8 | 0% |
| CVE-2024-5285 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attack | medium | 5.5 | 0% |
| CVE-2024-12414 | themify-store-locator (WordPress plugin) | The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This | medium | 4.3 | 0% |
| CVE-2024-6852 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2024-6855 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make | medium | 4.3 | 0% |
| CVE-2024-6856 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2026-53634 | code16/sharp | Sharp Missing Authorization Check in Quick Creation Command Endpoints | medium | 4.3 | 0% |
| CVE-2026-96392 | drupal/ai_ckeditor | This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig | unknown | 0.0 | 0% |
| CVE-2023-31218 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Edito | high | 7.1 | 0% |
| CVE-2024-3903 | add-custom-css-and-js (WordPress plugin) | The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as esca | high | 7.1 | 0% |
| CVE-2025-12119 | mongodb/mongodb-extension | MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory | medium | 6.8 | 0% |
| CVE-2024-9993 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2024-9994 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2024-9943 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 6.3 | 0% |
| CVE-2024-0660 | formidable (WordPress plugin) | The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cros | medium | 6.1 | 0% |
| CVE-2024-5155 | inquiry-cart (WordPress plugin) | The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, wh | medium | 6.1 | 0% |
| CVE-2024-8054 | mm-breaking-news (WordPress plugin) | The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping | medium | 6.1 | 0% |
| CVE-2024-1360 | colibri (WordPress theme) | The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to | medium | 4.3 | 0% |
| CVE-2024-1361 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. Thi | medium | 4.3 | 0% |
| CVE-2024-1362 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. Thi | medium | 4.3 | 0% |
| CVE-2024-41597 | processwire/processwire | ProcessWire Cross Site Request Forgery vulnerability | medium | 4.2 | 0% |
| CVE-2026-108514 | drupal/core | The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) v | unknown | 0.0 | 0% |
| CVE-2026-108515 | drupal/core | The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not | unknown | 0.0 | 0% |
| CVE-2026-35202 | pterodactyl/panel | Pterodactyl has a database resource limit bypass via race condition in Client API | low | 0.0 | 0% |
| CVE-2026-61807 | snipe/snipe-it | Snipe-IT: Stored DOM XSS via table selected-count IDs | medium | 0.0 | 0% |
| CVE-2026-87949 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2024-5287 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow atta | high | 7.1 | 0% |
| CVE-2026-55767 | guzzlehttp/guzzle | guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts | medium | 5.8 | 0% |
| CVE-2025-14761 | aws/aws-sdk-php | AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue | medium | 5.3 | 0% |
| CVE-2026-8204 | concrete5/concrete5 | Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog | medium | 5.3 | 0% |
| CVE-2026-8205 | concrete5/concrete5 | Concrete CMS is vulnerable to authorization bypass in the Calendar Block | medium | 5.3 | 0% |
| CVE-2024-5280 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as esca | medium | 4.7 | 0% |
| CVE-2025-0522 | likebot (WordPress plugin) | The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | medium | 4.7 | 0% |
| CVE-2025-63522 | feehi/feehicms | FeehiCMS is vulnerable to reverse tabnabbing | medium | 4.6 | 0% |
| CVE-2024-2959 | svs-pricing-tables (WordPress plugin) | The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is | medium | 4.3 | 0% |
| CVE-2024-2960 | svs-pricing-tables (WordPress plugin) | The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is | medium | 4.3 | 0% |
| CVE-2024-3631 | hl-twitter (WordPress plugin) | The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2024-4751 | prayer (WordPress plugin) | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-7892 | adstxt (WordPress plugin) | The adstxt Plugin WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 4.3 | 0% |
| CVE-2026-45009 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ | medium | 4.3 | 0% |
| CVE-2026-5370 | krayin/laravel-crm | Krayin CRM is vulnerable to Cross-site Scripting (XSS) | low | 3.5 | 0% |
| CVE-2026-31821 | sylius/sylius | Sylius is Missing Authorization in API v2 Add Item Endpoint | medium | 0.0 | 0% |
| CVE-2026-49260 | pontedilana/php-weasyprint | php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/sna | high | 8.2 | 0% |
| CVE-2026-61823 | code16/sharp | code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute | high | 7.3 | 0% |
| CVE-2023-32960 | updraftplus (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions lea | high | 7.1 | 0% |