Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-49358 | pontedilana/php-weasyprint | PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles | low | 3.0 | 0% |
| CVE-2025-13983 | drupal/tagify | This module enables you to use the Tagify library to enhance text input fields with tag-style UI elements. The module d | unknown | 0.0 | 0% |
| CVE-2023-7197 | marketing-twitter-bot (WordPress plugin) | The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as esca | high | 7.1 | 0% |
| CVE-2024-8243 | wordpress\/plugin-upgrade-time-out-plugin (WordPress plugin) | The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisati | medium | 6.3 | 0% |
| CVE-2023-2438 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing | medium | 6.1 | 0% |
| CVE-2024-13826 | email-keep (WordPress plugin) | The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to mak | medium | 5.4 | 0% |
| CVE-2025-2248 | wp-pmanager (WordPress plugin) | The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to | medium | 5.4 | 0% |
| CVE-2026-1553 | drupal/canvas | This Drupal Canvas module is a new visual page builder for Drupal. You can create reusable components that match your de | unknown | 0.0 | 0% |
| CVE-2026-33731 | wwbn/avideo | AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data | medium | 6.5 | 0% |
| CVE-2026-44833 | snipe/snipe-it | Snipe-IT has an open redirect vulnerability | medium | 5.9 | 0% |
| CVE-2025-55155 | mantisbt/mantisbt | MantisBT lacks verification when changing a user's email address | medium | 5.4 | 0% |
| CVE-2025-0808 | houzez-property-feed (WordPress plugin) | The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This | medium | 4.3 | 0% |
| CVE-2026-44584 | paymenter/paymenter | Paymenter doesn't reset email verification status after email change | medium | 4.3 | 0% |
| CVE-2025-66843 | getgrav/grav | Grav is vulnerable to Stored XSS through authenticated user-edited content | medium | 5.4 | 0% |
| CVE-2026-47694 | wwbn/avideo | WWBN AVideo: Stored XSS via unescaped Gallery category description | medium | 5.4 | 0% |
| CVE-2025-10498 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions | medium | 4.3 | 0% |
| CVE-2025-10499 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versi | medium | 4.3 | 0% |
| CVE-2025-13982 | drupal/login_time_restriction | This module enables you to apply time-based login restrictions and display related warning or logout confirmation pages. | unknown | 0.0 | 0% |
| CVE-2026-47228 | admidio/admidio | Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords | medium | 5.2 | 0% |
| CVE-2026-107260 | drupal/sector | Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Dr | unknown | 0.0 | 0% |
| CVE-2026-110738 | drupal/gin | Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administr | unknown | 0.0 | 0% |
| CVE-2026-114529 | drupal/csv_field | This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table | unknown | 0.0 | 0% |
| CVE-2026-114531 | drupal/swiper_formatter | The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide wi | unknown | 0.0 | 0% |
| CVE-2026-114532 | drupal/ui_icons | This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed | unknown | 0.0 | 0% |
| CVE-2026-114536 | drupal/uswds_paragraph_components | This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates d | unknown | 0.0 | 0% |
| CVE-2026-34611 | wwbn/avideo | AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users | medium | 6.5 | 0% |
| CVE-2024-8043 | vikinghammer-tweet (WordPress plugin) | The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escapi | medium | 5.4 | 0% |
| CVE-2024-43428 | moodle/moodle | Moodle vulnerable to cache poisoning via injection into storage | high | 7.7 | 0% |
| CVE-2026-32755 | admidio/admidio | Admidio is Missing CSRF Protection on Role Membership Date Changes | medium | 5.7 | 0% |
| CVE-2025-14163 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11 | medium | 4.3 | 0% |
| CVE-2026-96389 | drupal/xray_audit | This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and conf | unknown | 0.0 | 0% |
| CVE-2024-13338 | clearfy (WordPress plugin) | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request For | medium | 5.3 | 0% |
| CVE-2026-118543 | drupal/commerce | This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an i | unknown | 0.0 | 0% |
| CVE-2026-118575 | drupal/sign_widget | This module enables users to create and save signatures as SVG images. The module did not sufficiently sanitize user-su | unknown | 0.0 | 0% |
| CVE-2026-32600 | simplesamlphp/xml-security | simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption | high | 8.2 | 0% |
| CVE-2025-1436 | limit-bio (WordPress plugin) | The Limit Bio WordPress plugin through 1.0 does not have CSRF check when updating its settings, and is missing sanitisation as well as escap | high | 7.1 | 0% |
| CVE-2026-84918 | drupal/monobank | The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Mo | unknown | 0.0 | 0% |
| CVE-2024-12115 | poll-maker (WordPress plugin) | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 0% |
| CVE-2025-14472 | drupal/acquia_contenthub | This module provides a centralized content distribution and syndication solution so thta customers can publish, reuse, a | unknown | 0.0 | 0% |
| CVE-2026-65954 | phpcsstandards/phpcsutils | PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() | high | 8.6 | 0% |
| CVE-2024-58383 | froxlor/froxlor | Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD> | high | 7.3 | 0% |
| CVE-2026-33883 | statamic/cms | Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag | medium | 6.1 | 0% |
| CVE-2021-48006 | pocketmine/pocketmine-mp | Inability to de-op players if listed in ops.txt with non-lowercase letters | low | 3.3 | 0% |
| CVE-2026-2349 | drupal/ui_icons | This module enables you to integrate and manage icons with Drupal. The module doesn't sufficiently sanitize user input | unknown | 0.0 | 0% |
| CVE-2026-33867 | wwbn/avideo | AVideo has Plaintext Video Password Storage | critical | 0.0 | 0% |
| CVE-2026-7888 | concrete5/concrete5 | Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components | high | 0.0 | 0% |
| CVE-2025-3907 | drupal/search_api_solr | This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. | unknown | 0.0 | 0% |
| CVE-2024-13339 | debounce-io-email-validator (WordPress plugin) | The DeBounce Email Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.8.0. T | medium | 6.1 | 0% |
| CVE-2025-55744 | unopim/unopim | UnoPim vulnerable to CSRF on Product edit feature and creation of other types | medium | 0.0 | 0% |
| CVE-2026-42206 | roadiz/openid | OpenID Connect nonce generated but never validated — ID token replay attack | medium | 0.0 | 0% |