Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13284 | drupal/gutenberg | This module provides a new UI experience for node editing using the Gutenberg Editor library. The module did not suffic | unknown | 0.0 | 0% |
| CVE-2026-35453 | phpoffice/phpspreadsheet | PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer | medium | 0.0 | 0% |
| CVE-2026-44167 | phpseclib/phpseclib | phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID() | high | 7.5 | 0% |
| CVE-2026-9808 | mautic/core | Mautic has an Authorization Bypass in API v2 Endpoints | high | 7.1 | 0% |
| CVE-2024-7820 | ilc-thickbox (WordPress plugin) | The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to m | medium | 6.5 | 0% |
| CVE-2024-7862 | blogintroduction-wordpress-plugin (WordPress plugin) | The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which cou | medium | 6.5 | 0% |
| CVE-2026-42202 | almirhodzic/nova-toggle-5 | nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields | medium | 6.5 | 0% |
| CVE-2026-42474 | mix/mix | MixPHP Framework has an SQL injection vulnerability via crafted `data` array | medium | 6.5 | 0% |
| CVE-2026-42475 | mix/mix | MixPHP Framework has an SQL injection vulnerability | medium | 6.5 | 0% |
| CVE-2026-6744 | bagisto/bagisto | Bagisto affected by Server-Side Request Forgery | medium | 6.3 | 0% |
| CVE-2026-6367 | drupal/core | Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5. The suggestions ar | medium | 6.1 | 0% |
| CVE-2024-55920 | typo3/cms-dashboard | TYPO3 Cross-Site Request Forgery in Dashboard Module | medium | 4.3 | 0% |
| CVE-2024-55923 | typo3/cms-indexed-search | TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-6857 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, whi | medium | 4.3 | 0% |
| CVE-2024-6860 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow | medium | 4.3 | 0% |
| CVE-2024-7690 | dn-popup (WordPress plugin) | The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to mak | medium | 4.3 | 0% |
| CVE-2025-12022 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-12023 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-12085 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-12169 | wsdesk (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-10931 | drupal/umami_analytics | This module enables you to add Umami Analytics web statistics tracking system to your website. The "administer umami an | low | 3.8 | 0% |
| CVE-2023-7297 | twitterposts (WordPress plugin) | The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to | low | 3.5 | 0% |
| CVE-2025-47701 | drupal/restrict_route_by_ip | The Restrict route by IP module provides an interface to manage route restriction by IP address. The module doesn't suf | unknown | 0.0 | 0% |
| CVE-2025-47708 | drupal/miniorange_2fa | The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't | unknown | 0.0 | 0% |
| CVE-2026-8238 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR | medium | 0.0 | 0% |
| CVE-2026-32278 | opensource-workshop/connect-cms | Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin | high | 8.2 | 0% |
| CVE-2025-56556 | intelliants/subrion | Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool | medium | 6.5 | 0% |
| CVE-2024-4534 | kkprogressbar2 (WordPress plugin) | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as es | medium | 6.1 | 0% |
| CVE-2026-56347 | wwbn/avideo | AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin | medium | 6.1 | 0% |
| CVE-2024-0756 | insert-or-embed-articulate-content (WordPress plugin) | The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 lacks validation of URLs when adding iframes, allowing att | medium | 5.4 | 0% |
| CVE-2024-13337 | clearfy (WordPress plugin) | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request For | medium | 4.3 | 0% |
| CVE-2024-3971 | similarity (WordPress plugin) | The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2025-0796 | wprequal (WordPress plugin) | The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2. | medium | 4.3 | 0% |
| CVE-2026-43883 | wwbn/avideo | AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements | medium | 4.2 | 0% |
| CVE-2026-46643 | knplabs/knp-snappy | Snappy: Binary path is never shell-escaped due to an inverted is_executable check | high | 0.0 | 0% |
| CVE-2026-69245 | guzzlehttp/guzzle | Guzzle: Noncanonical cookie domain keeps subdomain scope | medium | 6.5 | 0% |
| CVE-2024-13419 | april (WordPress plugin), auteur (WordPress plugin), benaa (WordPress plugin) +1 more | Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability | medium | 6.4 | 0% |
| CVE-2024-12279 | wp-fb-autoconnect (WordPress plugin) | The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This | medium | 6.1 | 0% |
| CVE-2026-33548 | mantisbt/mantisbt | MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline | medium | 6.1 | 0% |
| CVE-2023-6499 | lastunes (WordPress plugin) | The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 5.4 | 0% |
| CVE-2024-5003 | wp-stacker (WordPress plugin) | The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 5.4 | 0% |
| CVE-2024-10480 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2024-4969 | widget-bundle (WordPress plugin) | The Widget Bundle WordPress plugin through 2.0.0 does not have CSRF checks when logging Widgets, which could allow attackers to make logged | medium | 4.3 | 0% |
| CVE-2024-7689 | snapshot-backup (WordPress plugin) | The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, | medium | 4.3 | 0% |
| CVE-2024-5030 | cm-table-of-contents (WordPress plugin) | The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow att | low | 3.8 | 0% |
| CVE-2026-107250 | drupal/eca_helper | The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has | unknown | 0.0 | 0% |
| CVE-2026-107253 | drupal/orphans_media | The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has | unknown | 0.0 | 0% |
| CVE-2025-5537 | foobox-image-lightbox (WordPress plugin) | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative | medium | 6.4 | 0% |
| CVE-2025-6244 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2025-6743 | woodmart (WordPress plugin) | The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attribute in all versions | medium | 6.4 | 0% |