Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3965 | pray-for-me (WordPress plugin) | The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 5.4 | 0% |
| CVE-2024-55922 | typo3/cms-form | TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery | medium | 5.4 | 0% |
| CVE-2025-5570 | ai-engine (WordPress plugin) | The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all version | medium | 5.4 | 0% |
| CVE-2026-24907 | october/system | October CMS has Stored XSS in Event Log Mail Preview | medium | 5.4 | 0% |
| CVE-2026-48998 | guzzlehttp/psr7 | guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation | medium | 5.3 | 0% |
| CVE-2026-107251 | drupal/entity_reference_manager | Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, an | unknown | 0.0 | 0% |
| CVE-2026-118555 | drupal/commerce_license | This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content. | unknown | 0.0 | 0% |
| CVE-2026-87939 | drupal/feed_block | The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module | unknown | 0.0 | 0% |
| CVE-2024-52305 | unopim/unopim | UnoPim Stored XSS : Cookie hijacking through Create User function | high | 7.3 | 0% |
| CVE-2026-116890 | mediawiki/semantic-media-wiki | Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks | high | 7.3 | 0% |
| CVE-2024-11937 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Me | medium | 6.4 | 0% |
| CVE-2025-4965 | page-builder (WordPress plugin) | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feat | medium | 6.4 | 0% |
| CVE-2025-5559 | timezonecalculator (WordPress plugin) | The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortc | medium | 6.4 | 0% |
| CVE-2025-5585 | siteorigin-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM Element Attribute in | medium | 6.4 | 0% |
| CVE-2025-6290 | tournament-bracket-generator (WordPress plugin) | The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in a | medium | 6.4 | 0% |
| CVE-2025-6538 | post-rating-and-review (WordPress plugin) | The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2025-6546 | drive-folder-embeder (WordPress plugin) | The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all version | medium | 6.4 | 0% |
| CVE-2025-6689 | fl3r-accessibility-suite (WordPress plugin) | The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite short | medium | 6.4 | 0% |
| CVE-2024-13523 | memorialday (WordPress plugin) | The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to | medium | 6.1 | 0% |
| CVE-2024-4480 | prayer (WordPress plugin) | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its email settings, which could allow attack | medium | 6.1 | 0% |
| CVE-2026-43879 | wwbn/avideo | AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass | medium | 5.4 | 0% |
| CVE-2026-63001 | redaxo/source | REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` | medium | 4.8 | 0% |
| CVE-2026-63002 | redaxo/source | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames | medium | 4.8 | 0% |
| CVE-2026-50183 | wwbn/avideo | WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section | medium | 4.7 | 0% |
| CVE-2026-30913 | flarum/nicknames | flarum/nicknames extension has display name injection in notification emails (autolink & markdown) | medium | 4.6 | 0% |
| CVE-2024-13248 | drupal/private_content | This module gives each node a 'private' checkbox. If it's set, the node can only be seen by the node author, or users wi | unknown | 0.0 | 0% |
| CVE-2026-107307 | drupal/smartlinker_ai | This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the | unknown | 0.0 | 0% |
| CVE-2026-107309 | drupal/easy_breadcrumb | This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check | unknown | 0.0 | 0% |
| CVE-2026-107310 | drupal/freelinking | This module enables you to configure a WIKI-like input filter that allows users to create links to site and external con | unknown | 0.0 | 0% |
| CVE-2026-114547 | drupal/tinypng | TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficien | unknown | 0.0 | 0% |
| CVE-2026-114554 | drupal/ai_file_to_text | The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and | unknown | 0.0 | 0% |
| CVE-2026-118544 | drupal/commerce | This module enables you to sell goods and services to customers through a shopping cart and checkout form. The module d | unknown | 0.0 | 0% |
| CVE-2026-118548 | drupal/ai | This module enables you to use AI on the website. It also enables you to interact with AI providers. The module does no | unknown | 0.0 | 0% |
| CVE-2026-33296 | wwbn/avideo | AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php | low | 0.0 | 0% |
| CVE-2026-72783 | craftcms/cms | Craft CMS: Incorrect path validation could potentially lead to path traversal | low | 0.0 | 0% |
| CVE-2023-6968 | the-moneytizer (WordPress plugin) | The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due | high | 8.1 | 0% |
| CVE-2022-4363 | wholesale-market (WordPress plugin), wholesale-market-for-woocommerce (WordPress plugin) | The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check | medium | 6.5 | 0% |
| CVE-2023-3409 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing o | medium | 5.4 | 0% |
| CVE-2023-6984 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 5.3 | 0% |
| CVE-2023-6493 | depicter (WordPress plugin) | The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery i | medium | 4.3 | 0% |
| CVE-2024-0511 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-1777 | admin-side-data-storage-for-contact-form-7 (WordPress plugin) | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i | medium | 4.3 | 0% |
| CVE-2025-65012 | getkirby/cms | Kirby CMS has cross-site scripting (XSS) in the changes dialog | medium | 0.0 | 0% |
| CVE-2026-15916 | drupal/core | The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image | unknown | 0.0 | 0% |
| CVE-2026-27128 | craftcms/cms | Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit | medium | 0.0 | 0% |
| CVE-2026-3217 | drupal/miniorange_saml | This module enables you to perform SAML protocol-based single sign-on (SSO) on a Drupal site. The module doesn't suffic | unknown | 0.0 | 0% |
| CVE-2026-6095 | drupal/orejime | The IframeConsent element writes HTML attributes without escaping their value. This module has a XSS vulnerability. If | unknown | 0.0 | 0% |
| CVE-2026-61453 | getgrav/grav | Grav: XSS Blueprint Validation Bypass via Twig String Concatenation | medium | 0.0 | 0% |
| CVE-2026-6871 | drupal/obfuscate | This module enables you to obfuscate email addresses in content. The module doesn't sufficiently sanitize user input vi | unknown | 0.0 | 0% |
| CVE-2026-96384 | drupal/mermaid_diagram_field | This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The m | unknown | 0.0 | 0% |