Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-96368 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2026-96382 | drupal/diba_carousel | The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or cus | unknown | 0.0 | 0% |
| CVE-2025-0687 | spiritual-gifts-survey-\(and-optional-s.h.a.p.e-survey\) (WordPress plugin) | The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before o | medium | 6.1 | 0% |
| CVE-2025-0688 | spiritual-gifts-survey-\(and-optional-s.h.a.p.e-survey\) (WordPress plugin) | The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before o | medium | 6.1 | 0% |
| CVE-2025-1288 | wooexim (WordPress plugin) | The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 6.1 | 0% |
| CVE-2026-47234 | admidio/admidio | Admidio writes session IDs and auto-login cookie values to application logs | medium | 4.4 | 0% |
| CVE-2026-4202 | ayacoo/redirect-tab | Broken Access Control in extension "Redirect Tab" (redirect_tab) | medium | 4.3 | 0% |
| CVE-2025-13984 | drupal/next | This module enables integration between Next.js and Drupal for headless CMS functionality. When installed, the module a | unknown | 0.0 | 0% |
| CVE-2026-114534 | drupal/block_attributes | This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the blo | unknown | 0.0 | 0% |
| CVE-2026-7887 | concrete5/concrete5 | Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status | low | 0.0 | 0% |
| CVE-2026-55746 | cotonti/cotonti | Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module | high | 7.6 | 0% |
| CVE-2024-13522 | magayo-lottery-results (WordPress plugin) | The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. Th | medium | 6.1 | 0% |
| CVE-2025-4580 | file-provider (WordPress plugin) | The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 4.3 | 0% |
| CVE-2026-118545 | drupal/ai | This module enables you to use AI on the website. The module does not sufficiently restrict HTML rendering, allowing cr | unknown | 0.0 | 0% |
| CVE-2026-118546 | drupal/ai | This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot. Un | unknown | 0.0 | 0% |
| CVE-2026-118552 | drupal/ai | This module provides a framework for integrating AI providers and features into Drupal. The module doesn't sufficiently | unknown | 0.0 | 0% |
| CVE-2026-8421 | concrete5/concrete5 | Concrete CMS contains a CSRF vulnerability | high | 0.0 | 0% |
| CVE-2026-8426 | concrete5/concrete5 | Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>` | high | 0.0 | 0% |
| CVE-2026-32313 | robrichards/xmlseclibs | xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption | high | 8.2 | 0% |
| CVE-2026-31823 | sylius/sylius | Sylius Vulnerable to Authenticated Stored XSS | medium | 4.8 | 0% |
| CVE-2024-13580 | xv-random-quotes (WordPress plugin) | The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2025-1762 | event-tickets-with-ticket-scanner (WordPress plugin) | The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which coul | medium | 4.3 | 0% |
| CVE-2026-50552 | phanan/koel | Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail | medium | 6.3 | 0% |
| CVE-2024-8032 | smooth-gallery-replacement (WordPress plugin) | The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as | medium | 6.1 | 0% |
| CVE-2024-8085 | peoplepond (WordPress plugin) | The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whic | medium | 6.1 | 0% |
| CVE-2024-8095 | babeiz (WordPress plugin) | The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | medium | 6.1 | 0% |
| CVE-2025-1362 | url-shortener-\|-conversion-tracking-\|-ab-testing-\|-woocommerce (WordPress plugin) | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk a | medium | 4.3 | 0% |
| CVE-2026-49262 | aimeos/pagible | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy | low | 3.0 | 0% |
| CVE-2024-6405 | floating-social-buttons (WordPress plugin) | The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This | medium | 6.1 | 0% |
| CVE-2025-2247 | wp-pmanager (WordPress plugin) | The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2026-63220 | codeigniter4/framework | CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() | medium | 4.8 | 0% |
| CVE-2025-1926 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2026-33884 | statamic/cms | Statamic's live preview token bypasses content protection for unrelated entries | medium | 4.3 | 0% |
| CVE-2026-107258 | drupal/inline_entity_form_dialog | This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relie | unknown | 0.0 | 0% |
| CVE-2026-107263 | drupal/gutenberg | This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not suffi | unknown | 0.0 | 0% |
| CVE-2026-3530 | drupal/openid_connect | This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. | unknown | 0.0 | 0% |
| CVE-2026-87953 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2026-6553 | typo3/cms-backend | TYPO3 CMS Stores Cleartext Password in User Settings Module | high | 7.5 | 0% |
| CVE-2025-4966 | wp-online-users-stats (WordPress plugin) | The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This | medium | 6.1 | 0% |
| CVE-2026-48157 | slim/slim | Slim has Reflected XSS in the HtmlErrorRenderer | medium | 6.1 | 0% |
| CVE-2026-53760 | admidio/admidio | Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests | medium | 5.2 | 0% |
| CVE-2026-59883 | guzzlehttp/guzzle | Guzzle: Cookie Disclosure and Injection via IP-Address Domains | medium | 4.7 | 0% |
| CVE-2024-10581 | directorypress-frontend (WordPress plugin) | The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. Th | medium | 4.3 | 0% |
| CVE-2024-13336 | disable-auto-updates (WordPress plugin) | The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is | medium | 4.3 | 0% |
| CVE-2024-13438 | speedsize-ai-image-optimizer (WordPress plugin) | The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-13494 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. Thi | medium | 4.3 | 0% |
| CVE-2024-13718 | flexible-wishlist-for-woocommerce (WordPress plugin) | The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-28850 | johnbillion/wp-crontrol, wp-crontrol (WordPress plugin) | WP Crontrol vulnerable to possible RCE when combined with a pre-condition | high | 8.1 | 0% |
| CVE-2026-40926 | wwbn/avideo | WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script) | high | 7.1 | 0% |
| CVE-2024-6751 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is du | medium | 6.3 | 0% |