Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12096 | exhibit-to-wp-gallery (WordPress plugin) | The Exhibit to WP Gallery WordPress plugin through 0.0.2 does not sanitise and escape a parameter before outputting it back in the page, lea | medium | 6.1 | 0% |
| CVE-2024-3519 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up t | medium | 6.1 | 0% |
| CVE-2024-6667 | kbucket (WordPress plugin) | The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the | medium | 6.1 | 0% |
| CVE-2024-8734 | lucas-string-replace (WordPress plugin) | The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without approp | medium | 6.1 | 0% |
| CVE-2025-6977 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘pm_get | medium | 6.1 | 0% |
| CVE-2024-53277 | silverstripe/framework | Silverstripe Framework has a XSS in form messages | medium | 5.4 | 0% |
| CVE-2024-8397 | gdpr-cookie-consent (WordPress plugin) | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allo | medium | 5.4 | 0% |
| CVE-2024-7355 | organization-chart (WordPress plugin) | The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parame | medium | 4.9 | 0% |
| CVE-2024-10054 | happyforms (WordPress plugin) | The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-10107 | rafflepress (WordPress plugin) | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could al | medium | 4.8 | 0% |
| CVE-2024-10143 | mb-custom-post-types-\&-custom-taxonomies (WordPress plugin) | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could al | medium | 4.8 | 0% |
| CVE-2024-10144 | robo-gallery (WordPress plugin) | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, whi | medium | 4.8 | 0% |
| CVE-2024-10145 | social-pug (WordPress plugin) | The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-10149 | social-slider-widget (WordPress plugin) | The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2024-10475 | contact-form-\&-lead-form-elementor-builder (WordPress plugin) | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings | medium | 4.8 | 0% |
| CVE-2024-10639 | auto-prune-posts (WordPress plugin) | The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-11109 | wp-google-review-slider (WordPress plugin) | The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-11189 | social-share-and-social-locker (WordPress plugin) | The Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2024-11266 | geocache-stat-bar-widget (WordPress plugin) | The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | 0% |
| CVE-2024-11843 | panorama (WordPress plugin) | The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-12679 | google-website-translator (WordPress plugin) | The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-12680 | google-website-translator (WordPress plugin) | The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-12716 | simple-basic-contact-form (WordPress plugin) | The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2024-12739 | mobile-contact-bar (WordPress plugin) | The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2024-12800 | ip-based-login (WordPress plugin) | The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as adm | medium | 4.8 | 0% |
| CVE-2024-12808 | wp-erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not san | medium | 4.8 | 0% |
| CVE-2024-13053 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-13127 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-13313 | aweber (WordPress plugin) | The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-13357 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-13382 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2024-13383 | hd-quiz (WordPress plugin) | The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-13384 | robo-gallery (WordPress plugin) | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, whi | medium | 4.8 | 0% |
| CVE-2024-13486 | icegram-engage (WordPress plugin) | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-13616 | vikbooking-hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow | medium | 4.8 | 0% |
| CVE-2024-13621 | gdpr-framework (WordPress plugin) | The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | 0% |
| CVE-2024-13729 | podlove-podcast-publisher (WordPress plugin) | The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privi | medium | 4.8 | 0% |
| CVE-2024-13730 | podlove-podcast-publisher (WordPress plugin) | The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | 0% |
| CVE-2024-1663 | ultimate-noindex-nofollow-tool-ii (WordPress plugin) | The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow hig | medium | 4.8 | 0% |
| CVE-2024-2869 | easy-property-listings (WordPress plugin) | The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-3062 | save-as-pdf (WordPress plugin) | The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2024-5026 | cm-tooltip-glossary (WordPress plugin) | The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-6478 | ctt-expresso-para-woocommerce (WordPress plugin) | The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high p | medium | 4.8 | 0% |
| CVE-2024-7758 | stylish-price-list (WordPress plugin) | The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-7759 | pwa-for-wp-\&-amp (WordPress plugin) | The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-8426 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-8617 | quiz-maker (WordPress plugin) | The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users suc | medium | 4.8 | 0% |
| CVE-2024-8620 | mappress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-8701 | events-calendar (WordPress plugin) | The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-9182 | maspik (WordPress plugin) | The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |