Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12282 | wp-connect (WordPress plugin) | The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, w | medium | 6.1 | 0% |
| CVE-2024-13115 | wp-projects-portfolio-with-client-testimonials (WordPress plugin) | The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sani | medium | 6.1 | 0% |
| CVE-2024-6712 | mapfig-studio (WordPress plugin) | The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, w | medium | 6.1 | 0% |
| CVE-2025-1382 | contact-us (WordPress plugin) | The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as es | medium | 6.1 | 0% |
| CVE-2024-1446 | social-networks-auto-poster-facebook-twitter-g (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc | medium | 5.4 | 0% |
| CVE-2024-4426 | comparison-slider (WordPress plugin) | The Comparison Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is | medium | 4.3 | 0% |
| CVE-2024-8050 | custom-author-base (WordPress plugin) | The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attack | medium | 4.3 | 0% |
| CVE-2024-8398 | simple-nav-archives (WordPress plugin) | The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attac | medium | 4.3 | 0% |
| CVE-2024-8477 | mailin (WordPress plugin) | The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Cross-Site Req | medium | 4.3 | 0% |
| CVE-2025-65961 | contao/core-bundle | Contao is vulnerable to cross-site scripting in templates | low | 3.3 | 0% |
| CVE-2026-117537 | redaxo/source | REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required) | low | 0.0 | 0% |
| CVE-2026-117538 | redaxo/source | REDAXO has reflected XSS backend packages API via function parameter (CSRF token required) | low | 0.0 | 0% |
| CVE-2026-3215 | drupal/islandora | This module integrates with Islandora, an open-source digital asset management (DAM) framework. Islandora integrates wit | unknown | 0.0 | 0% |
| CVE-2026-61815 | zbateson/mail-mime-parser | zbateson/mail-mime-parser has CRLF header injection via attachment filename | high | 7.2 | 0% |
| CVE-2024-3246 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is | medium | 6.1 | 0% |
| CVE-2026-33690 | wwbn/avideo | AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() | medium | 5.3 | 0% |
| CVE-2025-3635 | moodle/moodle | Moodle has a CSRF risk in user tours manager that allows tour duplication | low | 3.5 | 0% |
| CVE-2026-52839 | alextselegidis/easyappointments | Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass | low | 3.3 | 0% |
| CVE-2024-13304 | drupal/minifyjs | The Minify JS module allows a site administrator to minify all javascript files that exist in the site's code base and u | unknown | 0.0 | 0% |
| CVE-2026-118567 | drupal/bulk_update_user_roles | This module provides a bulk form for assigning or removing roles on multiple user accounts at once. The bulk update for | unknown | 0.0 | 0% |
| CVE-2024-3593 | ubermenu (WordPress plugin) | The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to mi | high | 7.2 | 0% |
| CVE-2026-81890 | studio-42/elfinder | elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections | medium | 5.4 | 0% |
| CVE-2026-118569 | drupal/fasttoggle | This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication | unknown | 0.0 | 0% |
| CVE-2026-49215 | symfony/ux-live-component | symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted | low | 0.0 | 0% |
| CVE-2026-8493 | drupal/colorbox_inline | This module enables you to open content already on the page within a colorbox. The module doesn't sufficiently sanitize | unknown | 0.0 | 0% |
| CVE-2026-39366 | wwbn/avideo | WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php | medium | 6.5 | 0% |
| CVE-2023-6008 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing | medium | 6.3 | 0% |
| CVE-2024-11141 | sailthru-triggermail (WordPress plugin) | The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which | medium | 6.1 | 0% |
| CVE-2024-11719 | tarteaucitron-wp (WordPress plugin) | The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, | medium | 6.1 | 0% |
| CVE-2026-31350 | feehi/cms | Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Page Sign parameter | medium | 5.4 | 0% |
| CVE-2026-31353 | feehi/cms | Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Category module | medium | 5.4 | 0% |
| CVE-2026-40098 | openmage/magento-lts | OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure | medium | 5.4 | 0% |
| CVE-2026-34384 | admidio/admidio | Admidio has Missing CSRF Protection on Registration Approval Actions | medium | 4.5 | 0% |
| CVE-2026-33649 | wwbn/avideo | AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification | high | 8.1 | 0% |
| CVE-2025-8427 | beaver-builder (WordPress plugin) | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter | medium | 6.4 | 0% |
| CVE-2026-42207 | openmage/magento-lts | Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` | medium | 6.1 | 0% |
| CVE-2026-45138 | ci4-cms-erp/ci4ms | CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule | medium | 5.4 | 0% |
| CVE-2024-12709 | bulk-me-now\! (WordPress plugin) | The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users | medium | 4.3 | 0% |
| CVE-2026-116891 | mediawiki/semantic-media-wiki | Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354) | medium | 6.1 | 0% |
| CVE-2024-13096 | wp-finance (WordPress plugin) | The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 4.6 | 0% |
| CVE-2025-5932 | homerunner-smartcheckout (WordPress plugin) | The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to | medium | 4.3 | 0% |
| CVE-2025-5937 | paid-membership (WordPress plugin) | The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Reques | medium | 4.3 | 0% |
| CVE-2026-1554 | drupal/cas_server | This module enables you to turn a Drupal install into the Central Authentication System (CAS). It makes your database th | unknown | 0.0 | 0% |
| CVE-2026-3213 | drupal/cleantalk | This module enables you to block bots by Firewall. The module doesn't sufficiently sanitize user input leading to a ref | unknown | 0.0 | 0% |
| CVE-2026-40925 | wwbn/avideo | WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials | high | 8.3 | 0% |
| CVE-2026-41061 | wwbn/avideo | WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver | medium | 5.4 | 0% |
| CVE-2026-9811 | mautic/core | Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector | medium | 5.4 | 0% |
| CVE-2024-13647 | sakolawp-lite (WordPress plugin) | The School Management System – SakolaWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2026-0947 | drupal/pianoanalytics | This module integrates the AT Internet Piano Analytics service. The module does not filter administrator-entered text l | unknown | 0.0 | 0% |
| CVE-2026-118576 | drupal/stage_file_proxy | Stage File Proxy is a general solution for getting production files on a development server on demand. **It is not inten | unknown | 0.0 | 0% |