Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13562 | import-wp (WordPress plugin) | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all | high | 7.5 | 0% |
| CVE-2024-13796 | post-grid (WordPress plugin) | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 5.3 | 0% |
| CVE-2024-8483 | mas-static-content (WordPress plugin) | The MAS Static Content plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.8 via the static | medium | 4.3 | 0% |
| CVE-2026-54133 | mtdowling/jmespath.php | jmespath.php has CompilerRuntime code injection via unescaped function names | critical | 9.8 | 0% |
| CVE-2023-45824 | oro/platform | Pinned entity creation form shows wrong data | medium | 4.3 | 0% |
| CVE-2023-48296 | oro/customer-portal | Storefront user can access history and most viewed data from matching back-office user with the same ID | medium | 4.3 | 0% |
| CVE-2024-8516 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 v | medium | 4.3 | 0% |
| CVE-2024-11083 | wp-user-avatar (WordPress plugin) | The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the | medium | 5.3 | 0% |
| CVE-2024-6499 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7. | medium | 5.3 | 0% |
| CVE-2024-7415 | remember-me-controls (WordPress plugin) | The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due | medium | 5.3 | 0% |
| CVE-2024-10312 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including | medium | 4.3 | 0% |
| CVE-2024-7394 | concrete5/concrete5 | Concrete CMS Stored XSS in getAttributeSetName | low | 2.0 | 0% |
| CVE-2023-6551 | verot/class.upload.php | class.upload.php allows cross-site scripting attacks via uploaded files | medium | 6.5 | 0% |
| CVE-2026-56831 | shopper/framework | Shopper: Negative discount values accepted and propagated through order calculation pipeline | medium | 6.5 | 0% |
| CVE-2024-13568 | fluent-support (WordPress plugin) | The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all v | high | 7.5 | 0% |
| CVE-2024-13606 | js-support-ticket (WordPress plugin) | The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi | high | 7.5 | 0% |
| CVE-2024-10356 | element-ready-lite (WordPress plugin) | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | medium | 4.3 | 0% |
| CVE-2022-39314 | getkirby/cms | Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms | medium | 4.8 | 0% |
| CVE-2024-1854 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2024-2027 | real-media-library-lite (WordPress plugin) | The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style | medium | 6.4 | 0% |
| CVE-2024-2165 | wp-seopress (WordPress plugin) | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-3747 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versio | medium | 6.4 | 0% |
| CVE-2023-6738 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagel | medium | 5.4 | 0% |
| CVE-2026-59943 | dompdf/dompdf | Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem | medium | 0.0 | 0% |
| CVE-2025-4798 | wp-downloadmanager (WordPress plugin) | The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due | medium | 4.9 | 0% |
| CVE-2024-34009 | moodle/moodle | Moodle ReCAPTCHA can be bypassed on the login page | high | 7.5 | 0% |
| CVE-2024-43257 | leopard (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects L | medium | 6.5 | 0% |
| CVE-2024-13540 | byconsole-woo-order-delivery-time (WordPress plugin) | The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all ver | medium | 5.3 | 0% |
| CVE-2025-30151 | shopware/core, shopware/platform | Shopware allows Denial Of Service via password length | high | 7.5 | 0% |
| CVE-2024-13539 | aforms-eats (WordPress plugin) | The AForms Eats plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.3.1. This is due the /ven | medium | 5.3 | 0% |
| CVE-2026-76089 | verbb/formie | Formie: Missing authorization on sent notification resend modal exposes submission PII | high | 7.7 | 0% |
| CVE-2024-6687 | ctt-expresso-para-woocommerce (WordPress plugin) | The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3 | medium | 5.3 | 0% |
| CVE-2024-10329 | ultimate-bootstrap-elements-for-elementor (WordPress plugin) | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an | medium | 4.3 | 0% |
| CVE-2024-7417 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2024-8801 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3. | medium | 4.3 | 0% |
| CVE-2026-49208 | symfony/ux-live-component | ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor | medium | 0.0 | 0% |
| CVE-2025-66304 | getgrav/grav | Grav Exposes Password Hashes Leading to privilege escalation | medium | 6.2 | 0% |
| CVE-2024-11282 | content-protector (WordPress plugin) | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to | medium | 5.3 | 0% |
| CVE-2024-3679 | premium-seo-pack (WordPress plugin) | The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi | medium | 5.3 | 0% |
| CVE-2026-55072 | pimcore/pimcore | Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name | high | 8.5 | 0% |
| CVE-2026-72698 | getgrav/grav | Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths | medium | 6.5 | 0% |
| CVE-2026-41890 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess | medium | 0.0 | 0% |
| CVE-2026-24422 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Public API endpoints expose emails and invisible questions | medium | 5.3 | 0% |
| CVE-2024-8899 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via t | medium | 4.3 | 0% |
| CVE-2025-12558 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-29885 | silverstripe/reports | Silverstripe Reports are still accessible even when `canView()` returns false | medium | 4.3 | 0% |
| CVE-2023-6781 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions | medium | 6.4 | 0% |
| CVE-2024-9538 | woolentor-addons (WordPress plugin) | The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'ren | medium | 4.3 | 0% |
| CVE-2026-47198 | paymenter/paymenter | Paymenter has URL parameter injection that bypasses paid plan limits at checkout | high | 8.5 | 0% |
| CVE-2026-47732 | twig/twig | Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points | high | 0.0 | 0% |