Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-31688 | drupal/config_split | This module enables you to create super sets of configuration and enable them conditionally, for example have some modul | medium | 6.8 | 0% |
| CVE-2026-100854 | azuracast/azuracast | AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption | medium | 6.3 | 0% |
| CVE-2024-7574 | christmasify (WordPress plugin) | The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to m | medium | 6.1 | 0% |
| CVE-2025-3153 | concrete5/concrete5 | Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) | medium | 0.0 | 0% |
| CVE-2026-8239 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR | medium | 0.0 | 0% |
| CVE-2026-8240 | concrete5/concrete5 | Concrete CMS is vulnerable to unauthenticated page metadata disclosure | medium | 0.0 | 0% |
| CVE-2024-9450 | easync (WordPress plugin) | The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updat | medium | 6.5 | 0% |
| CVE-2025-10927 | drupal/plausible_tracking | This module integrates Plausible Analytics on a site. The module did not properly filter output in certain cases. This | medium | 6.1 | 0% |
| CVE-2026-42877 | facturascripts/facturascripts | FacturaScripts vulnerable to stored XSS via product reference in sales/purchases | medium | 5.4 | 0% |
| CVE-2024-13683 | automate-hub-free-by-sperse-io (WordPress plugin) | The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2025-1530 | tripetto (WordPress plugin) | The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to mi | medium | 4.3 | 0% |
| CVE-2023-45023 | in2code/femanager | TYPO3 extension femanager Broken Access Control vulnerability | medium | 0.0 | 0% |
| CVE-2025-9550 | drupal/facets | This module enables you to to easily create and manage faceted search interfaces. The module doesn’t sufficiently filte | unknown | 0.0 | 0% |
| CVE-2026-107257 | drupal/actstream | Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-use | unknown | 0.0 | 0% |
| CVE-2026-3525 | drupal/file_access_fix | This module moves files to and from private storage depending on the access of its owning entities. The module does no | unknown | 0.0 | 0% |
| CVE-2026-5362 | pimcore/pimcore | Pimcore has an authenticated Cross-site Scripting issue | medium | 0.0 | 0% |
| CVE-2026-8337 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR in surveys | medium | 0.0 | 0% |
| CVE-2023-49087 | simplesamlphp/saml2, simplesamlphp/xml-security | Validation of SignedInfo | high | 7.5 | 0% |
| CVE-2026-1900 | link-whisper (WordPress plugin) | The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates. | medium | 6.5 | 0% |
| CVE-2026-4079 | sql-chart-builder (WordPress plugin) | The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possib | medium | 6.5 | 0% |
| CVE-2025-3075 | elementor (WordPress plugin) | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-8092 | accordion-image-menu (WordPress plugin) | The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as esca | medium | 5.4 | 0% |
| CVE-2026-45620 | wwbn/avideo | AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024 | medium | 5.3 | 0% |
| CVE-2024-8120 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.7 | 0% |
| CVE-2024-13118 | ip-based-login (WordPress plugin) | The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in use | medium | 4.3 | 0% |
| CVE-2024-2040 | himer (WordPress plugin) | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private grou | medium | 4.3 | 0% |
| CVE-2024-2233 | himer (WordPress plugin) | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform | medium | 4.3 | 0% |
| CVE-2024-2235 | himer (WordPress plugin) | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls | medium | 4.3 | 0% |
| CVE-2026-107850 | contao/core-bundle | Contao: Improper access control in the preview links module | medium | 4.3 | 0% |
| CVE-2026-107851 | contao/core-bundle | Contao: Improper access control in the table access voter | medium | 4.3 | 0% |
| CVE-2026-107306 | drupal/menu_link_attributes | This module enables you to add HTML attributes to menu links and their container elements (`<li>`). The module doesn't | unknown | 0.0 | 0% |
| CVE-2026-118541 | drupal/commerce | This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a | unknown | 0.0 | 0% |
| CVE-2026-42051 | getkirby/cms | Kirby CMS's system API endpoint leaks installed version and license data to authenticated users | medium | 0.0 | 0% |
| CVE-2026-55878 | symfony/ux-toolkit | symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest | high | 7.8 | 0% |
| CVE-2023-7174 | abitgone-commentsafe (WordPress plugin) | The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as esca | high | 7.1 | 0% |
| CVE-2024-2858 | simple-buttons-creator (WordPress plugin) | The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logge | medium | 4.8 | 0% |
| CVE-2024-3993 | azan (WordPress plugin) | The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 4.6 | 0% |
| CVE-2026-22210 | wpdiscuz (WordPress plugin) | wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attach | medium | 4.4 | 0% |
| CVE-2026-47760 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs | high | 8.7 | 0% |
| CVE-2026-41669 | admidio/admidio | Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests | high | 8.2 | 0% |
| CVE-2026-41570 | phpunit/phpunit | PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes | high | 7.8 | 0% |
| CVE-2024-1747 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any au | medium | 6.5 | 0% |
| CVE-2026-43876 | wwbn/avideo | AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers | medium | 6.4 | 0% |
| CVE-2026-6745 | bagisto/bagisto | Bagisto affected by Cross-site Scripting | low | 3.5 | 0% |
| CVE-2025-23081 | mediawiki/data-transfer | Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) | medium | 0.0 | 0% |
| CVE-2026-107261 | drupal/auth_login_plus | This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for | unknown | 0.0 | 0% |
| CVE-2026-114526 | drupal/black_hole | The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Aw | unknown | 0.0 | 0% |
| CVE-2026-118549 | drupal/ai | This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop | unknown | 0.0 | 0% |
| CVE-2025-65960 | contao/core-bundle | Contao is vulnerable to remote code execution in template closures | medium | 6.6 | 0% |
| CVE-2024-12005 | wp-bibtex (WordPress plugin) | The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to m | medium | 6.1 | 0% |