Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-25013 | in2code/femanager | Broken Access Control in 3rd party TYPO3 extension "femanager" | high | 8.6 | 1% |
| CVE-2023-25014 | in2code/femanager | Broken Access Control in 3rd party TYPO3 extension "femanager" | high | 8.6 | 1% |
| CVE-2024-4611 | apppresser (WordPress plugin) | The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCoo | high | 8.1 | 1% |
| CVE-2026-33681 | wwbn/avideo | AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name | high | 7.2 | 1% |
| CVE-2024-3669 | web-directory-free (WordPress plugin) | The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.8 | 1% |
| CVE-2025-27794 | flarum/core, flarum/framework | Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite | medium | 6.8 | 1% |
| CVE-2021-3728 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2024-13117 | share-buttons (WordPress plugin) | The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path wher | medium | 6.5 | 1% |
| CVE-2023-5071 | sitekit (WordPress plugin) | The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekit_iframe' shortcode in versions up to, and includin | medium | 6.4 | 1% |
| CVE-2024-0896 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link parameter | medium | 6.4 | 1% |
| CVE-2024-0966 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions u | medium | 6.4 | 1% |
| CVE-2024-1326 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all versions up to, and i | medium | 6.4 | 1% |
| CVE-2024-1391 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eae_custom_overlay_switcher’ attribu | medium | 6.4 | 1% |
| CVE-2024-1393 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content | medium | 6.4 | 1% |
| CVE-2024-1450 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions u | medium | 6.4 | 1% |
| CVE-2024-1585 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) i | medium | 6.4 | 1% |
| CVE-2024-1723 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to | medium | 6.4 | 1% |
| CVE-2024-2026 | content-protector (WordPress plugin) | The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortcode in all versions | medium | 6.4 | 1% |
| CVE-2020-36608 | tribalsystems/zenario | Tribal Systems Zenario CMS vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-37251 | craftcms/cms | Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts | medium | 5.4 | 1% |
| CVE-2024-1846 | responsive-tabs (WordPress plugin) | The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2020-36831 | social-networks-auto-poster (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on | medium | 5.0 | 1% |
| CVE-2023-1400 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 1% |
| CVE-2023-1525 | site-reviews (WordPress plugin) | The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2023-1614 | wp-custom-author-url (WordPress plugin) | The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 1% |
| CVE-2023-2711 | ultimate-product-catalog (WordPress plugin) | The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 1% |
| CVE-2023-3130 | short-url (WordPress plugin) | The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 1% |
| CVE-2024-25982 | moodle/moodle | Cross-Site Request Forgery in moodle | high | 8.8 | 0% |
| CVE-2024-9235 | mapster-wp-maps (WordPress plugin) | The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an | high | 8.8 | 0% |
| CVE-2026-44741 | pimcore/admin-ui-classic-bundle | Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter | high | 8.8 | 0% |
| CVE-2024-48231 | funadmin/funadmin | SQL injection in funadmin | high | 7.2 | 0% |
| CVE-2024-4742 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL | medium | 6.5 | 0% |
| CVE-2020-36704 | fruitful-theme (WordPress theme) | The Fruitful Theme for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters stored via the fruitful_theme_options_a | medium | 6.4 | 0% |
| CVE-2024-13183 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions u | medium | 6.4 | 0% |
| CVE-2024-1422 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the modal popup widget's effect setting i | medium | 6.4 | 0% |
| CVE-2016-15022 | mos/cimage | CImage Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2022-3516 | librenms/librenms | Cross-site Scripting in librenms/librenms | medium | 6.1 | 0% |
| CVE-2020-36396 | lavalite/cms | Stored XSS in LavaLite 5.8.0 | medium | 5.4 | 0% |
| CVE-2022-1340 | yetiforce/yetiforce-crm | Cross site scripting in yetiforce/yetiforce-crm | medium | 5.4 | 0% |
| CVE-2023-3746 | activitypub (WordPress plugin) | The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and ab | medium | 5.4 | 0% |
| CVE-2024-2836 | super-socializer (WordPress plugin) | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings | medium | 4.8 | 0% |
| CVE-2014-10382 | feature-comments (WordPress plugin) | The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment. | medium | 4.3 | 0% |
| CVE-2018-14519 | getkirby/cms | Kirby CMS 2.5.12 Cross-site Request Forgery | medium | 4.3 | 0% |
| CVE-2026-33770 | wwbn/avideo | AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables | high | 0.0 | 0% |
| CVE-2025-67165 | pagekit/pagekit | Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component | critical | 9.8 | 0% |
| CVE-2019-10642 | contao/contao, contao/core-bundle | Contao CSRF Token Bypass | high | 8.8 | 0% |
| CVE-2024-24796 | event-manager-and-tickets-selling-for-woocommerce (WordPress plugin) | Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – Wo | high | 8.2 | 0% |
| CVE-2026-28425 | statamic/cms | Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs | high | 8.0 | 0% |
| CVE-2023-5644 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role | high | 7.6 | 0% |
| CVE-2024-12315 | wp-ultimate-exporter (WordPress plugin) | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions | high | 7.5 | 0% |