Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2239 | microweber/microweber | Information exposure in microweber | medium | 6.5 | 1% |
| CVE-2024-4448 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 1% |
| CVE-2024-10880 | jobboardwp (WordPress plugin) | The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of a | medium | 6.1 | 1% |
| CVE-2024-31828 | lavalite/cms | Lavalite CMS Cross Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2024-8797 | wp-booking-system (WordPress plugin) | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_ar | medium | 6.1 | 1% |
| CVE-2023-4024 | radio-player (WordPress plugin) | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_pla | medium | 5.3 | 1% |
| CVE-2024-11606 | tabs-shortcode (WordPress plugin) | The Tabs Shortcode WordPress plugin through 2.0.2 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.3 | 1% |
| CVE-2021-24570 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The | medium | 4.3 | 1% |
| CVE-2022-40216 | bp-better-messages (WordPress plugin) | Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress. | medium | 4.3 | 1% |
| CVE-2023-37890 | kb-support (WordPress plugin) | Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Proper | medium | 4.3 | 1% |
| CVE-2024-9828 | taskbuilder (WordPress plugin) | The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, | medium | 4.1 | 1% |
| CVE-2023-2191 | azuracast/azuracast | AzuraCast/AzuraCast vulnerable to cross-site scripting | low | 3.5 | 1% |
| CVE-2025-24429 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | low | 3.5 | 1% |
| CVE-2025-61922 | prestashop/ps_checkout | PrestaShop Checkout allows customer account takeover via email | critical | 9.1 | 1% |
| CVE-2025-56588 | dolibarr/dolibarr | Dolibarr vulnerable to RCE via the computed field parameter | high | 8.8 | 1% |
| CVE-2022-31037 | oro/commerce | OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration | medium | 6.9 | 1% |
| CVE-2023-2102 | alextselegidis/easyappointments | alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting | medium | 6.8 | 1% |
| CVE-2024-4359 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.5 | 1% |
| CVE-2024-6120 | sparkle-demo-importer (WordPress plugin) | The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability | medium | 6.5 | 1% |
| CVE-2022-33155 | ameos/ameos_tarteaucitron | Cross site scripting in ameos_tarteaucitron | medium | 5.4 | 1% |
| CVE-2023-0272 | nex-forms (WordPress plugin) | The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 1% |
| CVE-2023-0274 | url-params (WordPress plugin) | The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a pa | medium | 5.4 | 1% |
| CVE-2023-0537 | product-slider-for-woocommerce (WordPress plugin) | The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before | medium | 5.4 | 1% |
| CVE-2023-0604 | wp-food-manager (WordPress plugin) | The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 5.4 | 1% |
| CVE-2023-3053 | page-builder-by-azexo (WordPress plugin) | The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ' | medium | 5.4 | 1% |
| CVE-2024-2950 | boldgrid-easy-seo (WordPress plugin) | The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inclu | medium | 5.3 | 1% |
| CVE-2023-2028 | call-now-accessibility-button (WordPress plugin) | The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privil | medium | 4.8 | 1% |
| CVE-2023-5861 | microweber/microweber | Cross-site Scripting (XSS) in microweber/microweber | medium | 4.8 | 1% |
| CVE-2026-55890 | getgrav/grav | Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr | medium | 4.8 | 1% |
| CVE-2023-0584 | vk-blocks (WordPress plugin) | The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and inc | medium | 4.3 | 1% |
| CVE-2023-1844 | subscribe2 (WordPress plugin) | The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sendi | medium | 4.3 | 1% |
| CVE-2023-2764 | draw-attention (WordPress plugin) | The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_set | medium | 4.3 | 1% |
| CVE-2023-2869 | wp-members (WordPress plugin) | The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the | medium | 4.3 | 1% |
| CVE-2023-3957 | navz-photo-gallery (WordPress plugin) | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on th | medium | 4.3 | 1% |
| CVE-2023-4792 | duplicate-post-page-menu-custom-post-type (WordPress plugin) | The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missin | medium | 4.3 | 1% |
| CVE-2024-1158 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | medium | 4.3 | 1% |
| CVE-2025-1315 | injob (WordPress plugin) | The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. T | critical | 9.8 | 1% |
| CVE-2024-9018 | wp-easy-gallery (WordPress plugin) | The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all | high | 8.8 | 1% |
| CVE-2024-13926 | wp-syntax (WordPress plugin) | The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number o | high | 7.5 | 1% |
| CVE-2022-41135 | customizable-wordpress-gallery-plugin---modula-image-gallery (WordPress plugin) | Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress. | medium | 6.5 | 1% |
| CVE-2025-29788 | sylius/paypal-plugin | Sylius PayPal Plugin Payment Amount Manipulation Vulnerability | medium | 6.5 | 1% |
| CVE-2024-1128 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and includi | medium | 5.4 | 1% |
| CVE-2024-2765 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.4 | 1% |
| CVE-2024-28190 | contao/core-bundle | Contao: Cross site scripting in the file manager | medium | 5.4 | 1% |
| CVE-2024-34356 | typo3/cms-core | TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module | medium | 5.4 | 1% |
| CVE-2024-34357 | typo3/cms-core | TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController | medium | 5.4 | 1% |
| CVE-2025-31675 | drupal/core | Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2026-25525 | openmage/magento-lts | OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module | medium | 4.9 | 1% |
| CVE-2026-84361 | composer/composer | Composer arbitrary command execution via a malicious package's Perforce source URL | high | 0.0 | 1% |
| CVE-2024-12171 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capabili | high | 8.8 | 1% |