Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3058 | enl-newsletter (WordPress plugin) | The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, | medium | 5.4 | 0% |
| CVE-2026-40479 | kimai/kimai | Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget | medium | 5.4 | 0% |
| CVE-2026-31824 | sylius/sylius | Sylius has a Promotion Usage Limit Bypass via Race Condition | high | 8.2 | 0% |
| CVE-2025-3076 | elementor-page-builder (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all v | medium | 6.4 | 0% |
| CVE-2024-12385 | wp-abstracts-manuscripts-manager (WordPress plugin) | The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due t | medium | 6.1 | 0% |
| CVE-2026-44306 | statamic/cms | Statamic CMS vulnerable to email enumeration via forgot password endpoint | medium | 5.3 | 0% |
| CVE-2025-58759 | datahihi1/tiny-env | TinyEnv: Inline comments not stripped properly in .env values | medium | 5.1 | 0% |
| CVE-2025-5275 | charitable (WordPress plugin) | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cr | medium | 4.4 | 0% |
| CVE-2026-52841 | alextselegidis/easyappointments | Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync | low | 3.1 | 0% |
| CVE-2026-15917 | drupal/core | Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently saniti | unknown | 0.0 | 0% |
| CVE-2026-34613 | wwbn/avideo | AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins | medium | 6.5 | 0% |
| CVE-2024-8052 | review-ratings (WordPress plugin) | The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, wh | medium | 6.1 | 0% |
| CVE-2025-5921 | sureforms (WordPress plugin) | The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 5.8 | 0% |
| CVE-2024-13555 | 1-click-migration (WordPress plugin) | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in al | medium | 5.3 | 0% |
| CVE-2021-41106 | lcobucci/jwt | File reference keys leads to incorrect hashes on HMAC algorithms | medium | 4.4 | 0% |
| CVE-2026-31819 | sylius/sylius | Sylius has an Open Redirect via Referer Header | medium | 0.0 | 0% |
| CVE-2026-7881 | concrete5/concrete5 | Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block | medium | 0.0 | 0% |
| CVE-2026-84915 | drupal/component_blocks | This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validat | unknown | 0.0 | 0% |
| CVE-2026-84919 | drupal/photoswipe | This module enables you to add dynamic caption support to PhotoSwipe image galleries. The module doesn't sufficiently s | unknown | 0.0 | 0% |
| CVE-2026-87942 | drupal/safedelete | This module enables you to manage content deletion and provides reports for identifying orphaned content. The module do | unknown | 0.0 | 0% |
| CVE-2024-3472 | modal-window (WordPress plugin) | The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to | medium | 5.9 | 0% |
| CVE-2024-3824 | base64-encoder\/decoder (WordPress plugin) | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow a | medium | 5.5 | 0% |
| CVE-2026-42549 | flightphp/core | Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root | medium | 4.4 | 0% |
| CVE-2024-13518 | simplepress (WordPress plugin) | The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.12. This | medium | 4.3 | 0% |
| CVE-2025-1506 | wp-social (WordPress plugin) | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-3629 | hl-twitter (WordPress plugin) | The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers | low | 2.4 | 0% |
| CVE-2024-13250 | drupal/symfony_mailer_lite | The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into | unknown | 0.0 | 0% |
| CVE-2025-6383 | wp-photonav (WordPress plugin) | The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2026-39367 | wwbn/avideo | WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page | medium | 5.4 | 0% |
| CVE-2023-6625 | product-enquiry-for-woocommerce (WordPress plugin) | The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could all | medium | 4.3 | 0% |
| CVE-2025-2168 | ultimate-store-kit (WordPress plugin) | The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce | medium | 4.3 | 0% |
| CVE-2025-65622 | snipe/snipe-it | Snipe-IT allows stored XSS via the Locations "Country" field | medium | 0.0 | 0% |
| CVE-2025-9549 | drupal/facets | This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently check | unknown | 0.0 | 0% |
| CVE-2026-29113 | craftcms/cms | Craft CMS has a potential information disclosure vulnerability in preview tokens | low | 0.0 | 0% |
| CVE-2026-96362 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2024-8091 | enhanced-search-box (WordPress plugin) | The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attac | medium | 6.5 | 0% |
| CVE-2025-10926 | drupal/json_field | This module enables you to store and display JSON data using optional 3rd party libraries. The module doesn't sufficien | medium | 6.1 | 0% |
| CVE-2025-12083 | drupal/civictheme | CivicTheme is a design system and theme framework used to build content-rich Drupal websites. It includes editorial work | medium | 6.1 | 0% |
| CVE-2025-8280 | contact-form-7-recaptcha (WordPress plugin) | The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back | medium | 5.8 | 0% |
| CVE-2015-10130 | circle-image-slider-with-lightbox (WordPress plugin) | The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to m | medium | 5.3 | 0% |
| CVE-2024-1592 | complianz-gdpr (WordPress plugin) | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1906 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due t | medium | 4.3 | 0% |
| CVE-2024-1907 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due t | medium | 4.3 | 0% |
| CVE-2024-1909 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due t | medium | 4.3 | 0% |
| CVE-2024-1910 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due t | medium | 4.3 | 0% |
| CVE-2024-1912 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due t | medium | 4.3 | 0% |
| CVE-2024-1976 | marketing-optimizer (WordPress plugin) | The Marketing Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20200925. Thi | medium | 4.3 | 0% |
| CVE-2024-4543 | snippet-shortcodes (WordPress plugin) | The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is | medium | 4.3 | 0% |
| CVE-2024-13244 | drupal/migrate_tools | The Migrate Tools module provides tools for running and managing Drupal migrations. The module doesn't sufficiently pro | unknown | 0.0 | 0% |
| CVE-2024-13260 | drupal/migrate_queue_importer | The Migrate queue importer module enables you to create cron migrations(configuration entities) with a reference towards | unknown | 0.0 | 0% |