Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1843 | wp-auto-affiliate-links (WordPress plugin) | The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aa | medium | 4.3 | 1% |
| CVE-2026-62992 | smarty/smarty | Smarty: Symlink path traversal out of trusted directories | medium | 0.0 | 1% |
| CVE-2024-45398 | contao/core-bundle | Contao affected by remote command execution through file upload | high | 8.3 | 1% |
| CVE-2023-1757 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via FAQ News link parameter | high | 8.1 | 1% |
| CVE-2023-1882 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to DOM cross-site scripting (XSS) via configuration privacy note URL parameter | high | 8.1 | 1% |
| CVE-2021-32735 | getkirby/cms | Cross-site scripting (XSS) from field and configuration text displayed in the Panel | high | 7.1 | 1% |
| CVE-2023-3387 | lana-text-to-image (WordPress plugin) | The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lana_text_to_image' and 'lana_text_to_img' | medium | 6.4 | 1% |
| CVE-2024-0700 | simple-tweet (WordPress plugin) | The Simple Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tweet this text value in all versions up to, and | medium | 6.4 | 1% |
| CVE-2024-1074 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the audio widget 'link_url | medium | 6.4 | 1% |
| CVE-2024-1497 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form widget addr2_width attribute in al | medium | 6.4 | 1% |
| CVE-2024-1499 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in the $settings[ | medium | 6.4 | 1% |
| CVE-2024-1541 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htm | medium | 6.4 | 1% |
| CVE-2025-1517 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 1% |
| CVE-2024-2043 | all-contact-form-integration-for-elementor (WordPress plugin) | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due | medium | 5.3 | 1% |
| CVE-2024-8195 | permalink-manager (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug | medium | 5.3 | 1% |
| CVE-2023-1760 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 4.8 | 1% |
| CVE-2024-53864 | ibexa/admin-ui | Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern | medium | 0.0 | 1% |
| CVE-2026-57584 | phalcon/cphalcon | Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS | high | 0.0 | 1% |
| CVE-2024-8621 | daily-prayer-time-for-mosques (WordPress plugin) | The Daily Prayer Time plugin for WordPress is vulnerable to SQL Injection via the 'max_word' attribute of the 'quran_verse' shortcode in all | critical | 9.9 | 1% |
| CVE-2021-4401 | analogwp-templates (WordPress plugin) | The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to miss | high | 8.8 | 1% |
| CVE-2022-2245 | counter-box (WordPress plugin) | The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers t | high | 8.8 | 1% |
| CVE-2022-2381 | e-unlocked---student-result (WordPress plugin) | The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could al | high | 8.8 | 1% |
| CVE-2024-3518 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and inc | high | 8.8 | 1% |
| CVE-2025-1306 | newscrunch (WordPress theme) | The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to m | high | 8.8 | 1% |
| CVE-2022-0269 | yetiforce/yetiforce-crm | Cross-Site Request Forgery in yetiforce | high | 8.0 | 1% |
| CVE-2021-24843 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make | medium | 6.5 | 1% |
| CVE-2021-25072 | social-networks-auto-poster (WordPress plugin) | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing | medium | 6.5 | 1% |
| CVE-2021-25098 | easy-pricing-tables (WordPress plugin) | The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to | medium | 6.5 | 1% |
| CVE-2022-0445 | wordpress-real-cookie-banner (WordPress plugin) | The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place w | medium | 6.5 | 1% |
| CVE-2022-0681 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attacker | medium | 6.5 | 1% |
| CVE-2022-1761 | peter\'s-collaboration-e-mails (WordPress plugin) | The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change o | medium | 6.5 | 1% |
| CVE-2024-12032 | tourfic (WordPress plugin) | The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vuln | medium | 6.5 | 1% |
| CVE-2023-1403 | weaver-xtreme-theme (WordPress theme) | The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name | medium | 6.4 | 1% |
| CVE-2024-0834 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_to parameter in all versions up | medium | 6.4 | 1% |
| CVE-2024-0961 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the code editor in all versions up to, a | medium | 6.4 | 1% |
| CVE-2024-1070 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the features attribute in all versions u | medium | 6.4 | 1% |
| CVE-2024-1498 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Photo Stack Widget in all | medium | 6.4 | 1% |
| CVE-2024-1999 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tes | medium | 6.4 | 1% |
| CVE-2024-3199 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions | medium | 6.4 | 1% |
| CVE-2024-3517 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion Widget | medium | 6.4 | 1% |
| CVE-2024-3819 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Banner widget in all version | medium | 6.4 | 1% |
| CVE-2022-4307 | pardakht-delkhah (WordPress plugin) | The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to s | medium | 6.1 | 1% |
| CVE-2023-5348 | product-catalog-mode-for-woocommerce (WordPress plugin) | The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings value | medium | 6.1 | 1% |
| CVE-2022-40000 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-40001 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-40002 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-40373 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-5237 | memberlite-shortcodes (WordPress plugin) | The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 1% |
| CVE-2022-36399 | booked (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendar | medium | 5.3 | 1% |
| CVE-2023-54394 | pocketmine/pocketmine-mp | PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket' | medium | 5.3 | 1% |