Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8090 | javascript-logic (WordPress plugin) | The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, | medium | 6.1 | 0% |
| CVE-2023-2334 | easy-digital-downloads-google-sheet-connector (WordPress plugin), edd-gsheetconnector (WordPress plugin) | The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 | medium | 5.4 | 0% |
| CVE-2024-41811 | ipl/web | ipl/web's `ipl\Web\Common\CsrfCounterMeasure` is susceptible to CSRF | medium | 5.0 | 0% |
| CVE-2025-59013 | typo3/cms-core | TYPO3 CMS has an open‑redirect vulnerability | medium | 0.0 | 0% |
| CVE-2026-0859 | typo3/cms-core | TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool | medium | 0.0 | 0% |
| CVE-2026-114555 | drupal/datafield | Data Field allows you to create custom fields with multiple values under the default table form. The `file_uri` formatt | unknown | 0.0 | 0% |
| CVE-2026-118572 | drupal/oauth_login_oauth2 | This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider. | unknown | 0.0 | 0% |
| CVE-2025-6459 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all ver | high | 8.8 | 0% |
| CVE-2025-2163 | zoorum-comments (WordPress plugin) | The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due | medium | 6.1 | 0% |
| CVE-2026-33885 | statamic/cms | Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential | medium | 6.1 | 0% |
| CVE-2024-9709 | ekc-tournament-manager (WordPress plugin) | The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 5.4 | 0% |
| CVE-2024-9711 | ekc-tournament-manager (WordPress plugin) | The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 5.4 | 0% |
| CVE-2026-34974 | thorsten/phpmyfaq | phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation | medium | 5.4 | 0% |
| CVE-2026-42842 | getgrav/grav | Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel | medium | 5.4 | 0% |
| CVE-2024-13795 | ecwid-shopping-cart (WordPress plugin) | The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-43269 | backup-and-restore-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: | medium | 4.3 | 0% |
| CVE-2024-4475 | wp-logs-book (WordPress plugin) | The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in | medium | 4.3 | 0% |
| CVE-2026-107259 | drupal/linked_field | This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't suf | unknown | 0.0 | 0% |
| CVE-2026-107264 | drupal/inline_formatter_field | The Inline Formatter Field module allows site builders to template and style entities with a field. This module does no | unknown | 0.0 | 0% |
| CVE-2026-114542 | drupal/simple_oauth | This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with a | unknown | 0.0 | 0% |
| CVE-2024-13774 | wish-list-for-woocommerce (WordPress plugin) | The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 6.1 | 0% |
| CVE-2024-6859 | wp-multitasking (WordPress plugin) | The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2024-9588 | wp-custom-taxonomy-meta (WordPress plugin) | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0 | medium | 5.4 | 0% |
| CVE-2026-1217 | yoast/duplicate-post | Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite | medium | 5.4 | 0% |
| CVE-2025-69277 | paragonie/sodium_compat | libsodium has Incomplete List of Disallowed Inputs | medium | 4.5 | 0% |
| CVE-2024-7687 | azindex (WordPress plugin) | The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | medium | 4.3 | 0% |
| CVE-2025-24856 | causal/oidc | TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) | medium | 4.2 | 0% |
| CVE-2025-3131 | drupal/eca | This module enables you to define automations on your Drupal site. The module doesn't sufficiently protect certain rout | unknown | 0.0 | 0% |
| CVE-2026-48488 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing | low | 0.0 | 0% |
| CVE-2026-8197 | concrete5/concrete5 | Concrete CMS is vulnerable to Stored XSS via OAuth integration name | high | 0.0 | 0% |
| CVE-2026-8327 | concrete5/concrete5 | Concrete CMS has a session-hardening bypass and allows password change without reauthorization | medium | 0.0 | 0% |
| CVE-2026-41661 | admidio/admidio | Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion | medium | 6.1 | 0% |
| CVE-2025-47939 | typo3/cms-core | TYPO3 Allows Unrestricted File Upload in File Abstraction Layer | medium | 5.4 | 0% |
| CVE-2024-12526 | arena-liveblog-and-chat-tool (WordPress plugin) | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, an | medium | 4.3 | 0% |
| CVE-2025-13979 | drupal/minisite | This module allows uploading a zip file and extracting its content in the public file directory to serve this content fr | unknown | 0.0 | 0% |
| CVE-2026-0946 | drupal/atsmarttag | This module integrates the AT Internet SmartTag service. The module does not filter administrator-entered text leading | unknown | 0.0 | 0% |
| CVE-2026-56381 | craftcms/cms | Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page | low | 0.0 | 0% |
| CVE-2024-2395 | bulgarisation-for-woocommerce (WordPress plugin) | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0 | high | 7.3 | 0% |
| CVE-2025-31680 | drupal/matomo | This module enables you to add the Matomo web statistics tracking system to your website. The Matomo Analytics Tag Mana | medium | 6.8 | 0% |
| CVE-2025-31683 | drupal/google_tag | This module enables you to integrate the site with the Google Tag Manager (GTM) application. The module doesn't suffici | medium | 6.8 | 0% |
| CVE-2025-31684 | drupal/oauth2_client | This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth prote | medium | 6.8 | 0% |
| CVE-2023-7229 | illi-link-party\! (WordPress plugin) | The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 5.5 | 0% |
| CVE-2026-33683 | wwbn/avideo | AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field | medium | 5.4 | 0% |
| CVE-2026-107265 | drupal/leaflet | The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaf | unknown | 0.0 | 0% |
| CVE-2026-114525 | drupal/abc | The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome i | unknown | 0.0 | 0% |
| CVE-2026-114527 | drupal/ui_icons | This module provides a user interface to select and configure icons, including a form element, a text format filter and | unknown | 0.0 | 0% |
| CVE-2026-114528 | drupal/zeropoint | The ZeroPoint theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awe | unknown | 0.0 | 0% |
| CVE-2026-114538 | drupal/bootstrap | Provides the Bootstrap front-end framework as a Drupal theme. Bootstrap theme did not sufficiently filter certain attri | unknown | 0.0 | 0% |
| CVE-2026-54736 | phalcon/cphalcon | Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel) | high | 0.0 | 0% |
| CVE-2023-2447 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing | medium | 6.1 | 0% |