Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-36398 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2021-36399 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-33154 | brotkrueml/schema | brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS | medium | 5.4 | 1% |
| CVE-2024-2091 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up t | medium | 5.4 | 1% |
| CVE-2024-2733 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "Separator" element in all versions | medium | 5.4 | 1% |
| CVE-2024-12255 | accept-stripe-payments-using-contact-form-7 (WordPress plugin) | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and includ | medium | 5.3 | 1% |
| CVE-2024-1526 | social-pug (WordPress plugin) | The Hubbub Lite WordPress plugin before 1.33.1 does not ensure that user have access to password protected post before displaying its conte | medium | 5.3 | 1% |
| CVE-2021-36827 | ninja-forms (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via | medium | 4.8 | 1% |
| CVE-2023-2584 | pixelyoursite (WordPress plugin), pixelyoursite-pro (WordPress plugin) | The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3 | medium | 4.4 | 1% |
| CVE-2024-3549 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter | critical | 9.9 | 1% |
| CVE-2017-15063 | intelliants/subrion | Subrion CMS CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2024-12613 | passwords-manager (WordPress plugin) | The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb->prefix value in several AJAX fuctions in all versio | high | 7.5 | 1% |
| CVE-2026-86429 | league/commonmark | league/commonmark: Denial of service in the SmartPunct and Attributes extensions | high | 7.5 | 1% |
| CVE-2023-2173 | badgeos (WordPress plugin) | The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to | medium | 6.5 | 1% |
| CVE-2016-10865 | lightbox-plus (WordPress plugin) | The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus | medium | 6.1 | 1% |
| CVE-2023-6786 | payment-gateway-for-telcell (WordPress plugin) | The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its va | medium | 6.1 | 1% |
| CVE-2024-0187 | peepso (WordPress plugin) | The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting | medium | 6.1 | 1% |
| CVE-2022-3096 | wp-total-hacks (WordPress plugin) | The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allo | medium | 5.4 | 1% |
| CVE-2023-4282 | embedpress (WordPress plugin) | The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' | medium | 5.4 | 1% |
| CVE-2023-7252 | tickera (WordPress plugin) | The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets. | medium | 5.3 | 1% |
| CVE-2023-5816 | code-explorer (WordPress plugin) | The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is | medium | 4.9 | 1% |
| CVE-2026-63179 | winter/wn-backend-module | Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets | medium | 4.9 | 1% |
| CVE-2022-3618 | spacer (WordPress plugin) | The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as | medium | 4.8 | 1% |
| CVE-2023-1910 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability chec | medium | 4.3 | 1% |
| CVE-2023-2172 | badgeos (WordPress plugin) | The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to | medium | 4.3 | 1% |
| CVE-2023-2353 | chp-ads-block-detector (WordPress plugin) | The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability c | medium | 4.3 | 1% |
| CVE-2023-5134 | easy-registration-forms (WordPress plugin) | The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, a | medium | 4.3 | 1% |
| CVE-2023-50461 | directmailteam/direct-mail | Configuration Injection in extension "Direct Mail" (direct_mail) | high | 8.8 | 1% |
| CVE-2026-33293 | wwbn/avideo | AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter | high | 8.1 | 1% |
| CVE-2025-66302 | getgrav/grav | Grav vulnerable to Path Traversal allowing server files backup | medium | 6.8 | 1% |
| CVE-2024-1318 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unaut | medium | 6.5 | 1% |
| CVE-2024-4390 | depicter (WordPress plugin) | The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and inclu | medium | 6.5 | 1% |
| CVE-2023-4890 | jquery-vertical-accordion-menu (WordPress plugin) | The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in | medium | 6.4 | 1% |
| CVE-2023-5086 | copy-the-code (WordPress plugin) | The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and | medium | 6.4 | 1% |
| CVE-2023-5308 | podcast-subscribe-buttons (WordPress plugin) | The Podcast Subscribe Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'podcast_subscribe' shortcode in version | medium | 6.4 | 1% |
| CVE-2024-1677 | a4-barcode-generator (WordPress plugin) | The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to unauth | medium | 6.3 | 1% |
| CVE-2023-5140 | bonus-for-woo (WordPress plugin) | The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading t | medium | 6.1 | 1% |
| CVE-2023-5609 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, l | medium | 6.1 | 1% |
| CVE-2025-4652 | broadstreet (WordPress plugin) | The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 1% |
| CVE-2023-3213 | wp-mail-smtp (WordPress plugin) | The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_pag | medium | 5.3 | 1% |
| CVE-2024-11219 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all ver | medium | 5.3 | 1% |
| CVE-2023-4157 | omeka/omeka-s | omeka/omeka-s Improper Input Validation vulnerability | medium | 5.2 | 1% |
| CVE-2021-41952 | tribalsystems/zenario | Cross-site Scripting in Zenario CMS | medium | 4.8 | 1% |
| CVE-2021-36865 | quiz-master-next (WordPress plugin) | Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers t | low | 3.8 | 1% |
| CVE-2013-10022 | contact-form (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this | low | 3.5 | 1% |
| CVE-2015-10121 | beeliked (WordPress plugin) | A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic. Affected by this vulnera | low | 3.5 | 1% |
| CVE-2018-21037 | intelliants/subrion | Subrion CMS CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2023-39527 | prestashop/prestashop | PrestaShop XSS injection through Validate::isCleanHTML method | high | 8.3 | 1% |
| CVE-2024-10263 | tickera-event-ticketing-system (WordPress plugin) | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inclu | high | 7.3 | 1% |
| CVE-2024-7349 | lifterlms (WordPress plugin) | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' pa | high | 7.2 | 1% |