Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-12760 | drupal/email_tfa | The Email TFA module provides additional email-based two-factor authentication for Drupal logins. In certain scenarios, | medium | 5.4 | 0% |
| CVE-2026-36341 | krayin/laravel-crm | Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint | medium | 5.4 | 0% |
| CVE-2024-1943 | yuki (WordPress theme) | The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing | medium | 4.3 | 0% |
| CVE-2026-1917 | drupal/login_disable | The Login Disable module prevents users from logging in to your Drupal site unless they know the access key to add to th | unknown | 0.0 | 0% |
| CVE-2024-31556 | reportico-web/reportico | Reportico Web fails to invalidate cookies upon logout | medium | 6.5 | 0% |
| CVE-2024-4382 | commonsbooking (WordPress plugin) | The CB (legacy) WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged | medium | 6.5 | 0% |
| CVE-2026-100855 | azuracast/azuracast | AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration | medium | 6.5 | 0% |
| CVE-2025-5567 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM elem | medium | 6.4 | 0% |
| CVE-2023-1472 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 6.3 | 0% |
| CVE-2024-4530 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | medium | 6.3 | 0% |
| CVE-2024-5033 | sully (WordPress plugin) | The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which coul | medium | 5.9 | 0% |
| CVE-2024-47058 | mautic/core, mautic/core-lib | Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field) | medium | 4.8 | 0% |
| CVE-2024-12280 | wp-customer-area (WordPress plugin) | The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2023-7048 | mystickymenu (WordPress plugin) | The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due | low | 3.1 | 0% |
| CVE-2026-114544 | drupal/media_bulk_upload | This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user pe | unknown | 0.0 | 0% |
| CVE-2026-114545 | drupal/fullcalendar_view | This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. T | unknown | 0.0 | 0% |
| CVE-2026-114553 | drupal/frontend_editing | This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't su | unknown | 0.0 | 0% |
| CVE-2026-13232 | drupal/admin_feedback | This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach | unknown | 0.0 | 0% |
| CVE-2026-96369 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-96390 | drupal/editoria11y | This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API. | unknown | 0.0 | 0% |
| CVE-2025-31689 | drupal/gdpr | The GDPR Task submodule enables you to create GDPR tasks. The module doesn't sufficiently protect against Cross Site Re | high | 8.1 | 0% |
| CVE-2023-3055 | page-builder-by-azexo (WordPress plugin) | The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This | medium | 6.1 | 0% |
| CVE-2024-22304 | freshmail-for-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a | medium | 5.4 | 0% |
| CVE-2024-24887 | contest-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Shar | medium | 5.4 | 0% |
| CVE-2025-14448 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Se | medium | 5.4 | 0% |
| CVE-2023-4628 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ladiflow_save_hook() functi | medium | 4.3 | 0% |
| CVE-2023-4629 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the save_config() function in v | medium | 4.3 | 0% |
| CVE-2023-4729 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the publish_lp() function hooke | medium | 4.3 | 0% |
| CVE-2023-7195 | wp-reply-notify (WordPress plugin) | The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2023-7196 | ultimate-noindex-nofollow-tool (WordPress plugin) | The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could | medium | 4.3 | 0% |
| CVE-2024-0513 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-0515 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1335 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1336 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1338 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1339 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-2326 | pretty-link (WordPress plugin) | The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request | medium | 4.3 | 0% |
| CVE-2024-43117 | hummingbird (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This is | medium | 4.3 | 0% |
| CVE-2024-49627 | wordpress-image-seo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Noor Alam WordPress Image SEO allows Cross Site Request Forgery.This issue affects WordPr | medium | 4.3 | 0% |
| CVE-2024-50466 | darkmysite (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross S | medium | 4.3 | 0% |
| CVE-2026-107311 | drupal/permissions_by_term | This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently che | unknown | 0.0 | 0% |
| CVE-2026-114546 | drupal/media_alias_display | This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP he | unknown | 0.0 | 0% |
| CVE-2026-114548 | drupal/imageapi_optimize_webp | This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image sty | unknown | 0.0 | 0% |
| CVE-2026-118571 | drupal/media_alias_display | This module allows for direct viewing of a file with the URL alias. This is a followup advisory to [SA-CONTRIB-2026-245 | unknown | 0.0 | 0% |
| CVE-2026-11909 | drupal/examples | The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drup | unknown | 0.0 | 0% |
| CVE-2026-13233 | drupal/ai_provider_openai | This module enables you to use OpenAI as a provider for the AI module. The module doesn't sufficiently sanitize user-su | unknown | 0.0 | 0% |
| CVE-2026-13235 | drupal/ai | This module enables you to utilize an agent to use Drupal core actions tools with bypassed access. Certain Drupal core | unknown | 0.0 | 0% |
| CVE-2026-81161 | drupal/content_moderation_notifications | The module provides a permission that allows users to configure email templates containing Twig code. This permission wa | unknown | 0.0 | 0% |
| CVE-2024-6224 | send-email-only-on-reply-to-my-comment (WordPress plugin) | The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisati | medium | 5.9 | 0% |
| CVE-2023-7083 | voting-record (WordPress plugin) | The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whi | medium | 5.4 | 0% |