Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13600 | majestic-support (WordPress plugin) | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Expo | high | 7.5 | 0% |
| CVE-2024-13611 | bp-better-messages (WordPress plugin) | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitiv | high | 7.5 | 0% |
| CVE-2024-4977 | index-wp-mysql-for-speed (WordPress plugin) | The Index WP MySQL For Speed WordPress plugin before 1.4.18 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.8 | 0% |
| CVE-2024-5555 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2023-2399 | qubot (WordPress plugin) | The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashb | medium | 6.1 | 0% |
| CVE-2024-1956 | wpb-show-core (WordPress plugin) | The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an un | medium | 6.1 | 0% |
| CVE-2023-46068 | maileon (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XQueue GmbH Maileon for WordPress plugin <= 2.16.0 versions. | medium | 5.9 | 0% |
| CVE-2022-28612 | m-wp-popup (WordPress plugin) | Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) | medium | 5.4 | 0% |
| CVE-2024-31447 | shopware/core, shopware/platform | Shopware Improper Session Handling in store-api account logout | medium | 5.3 | 0% |
| CVE-2024-1292 | wpb-show-core (WordPress plugin) | The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading | medium | 4.7 | 0% |
| CVE-2025-27192 | magento/community-edition, magento/project-community-edition | Magento does not properly protect credentials | low | 2.7 | 0% |
| CVE-2024-6166 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via th | high | 8.8 | 0% |
| CVE-2024-7717 | wp-events-manager (WordPress plugin) | The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and in | high | 8.8 | 0% |
| CVE-2024-13473 | ltl-freight-quotes-worldwide-express-edition (WordPress plugin) | The LTL Freight Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_ | high | 7.5 | 0% |
| CVE-2026-61609 | pterodactyl/panel | Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) | high | 7.5 | 0% |
| CVE-2023-0816 | formidable-form-builder (WordPress plugin) | The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leadi | medium | 6.5 | 0% |
| CVE-2023-45640 | wp-ulike (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TechnoWich WP ULike – Most Advanced WordPress Marketing Toolkit plug | medium | 6.5 | 0% |
| CVE-2023-5338 | theme-blvd-shortcodes (WordPress plugin) | The Theme Blvd Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, | medium | 6.4 | 0% |
| CVE-2023-4799 | magic-embeds (WordPress plugin) | The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2023-0734 | wallabag/wallabag | Wallabag Improper Authorization vulnerability | medium | 5.3 | 0% |
| CVE-2024-11181 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inc | medium | 4.3 | 0% |
| CVE-2024-34000 | moodle/moodle | Moodle Cross-site Scripting (XSS) | medium | 4.3 | 0% |
| CVE-2024-10672 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat | low | 2.7 | 0% |
| CVE-2024-13254 | drupal/rest_views | The Rest views module lets site admins create rest exports in views with additional options for serializing data. This | unknown | 0.0 | 0% |
| CVE-2024-13259 | drupal/image_sizes | This module enables you to create responsive image styles that depend on the parent element's width. The module doesn't | unknown | 0.0 | 0% |
| CVE-2025-27617 | pimcore/pimcore | Pimcore Vulnerable to SQL Injection in getRelationFilterCondition | medium | 0.0 | 0% |
| CVE-2026-40597 | mantisbt/mantisbt | MantisBT has a Content Security Policy bypass via attachments | high | 0.0 | 0% |
| CVE-2025-6688 | simple-payment (WordPress plugin) | The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not pro | critical | 9.8 | 0% |
| CVE-2018-16650 | thorsten/phpmyfaq | phpMyFAQ CSRF | high | 8.8 | 0% |
| CVE-2019-7865 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition CSRF Vulnerability | high | 8.8 | 0% |
| CVE-2021-36785 | miniorange/miniorange-saml | Cross-site Scripting in TYPO3 extension | high | 8.5 | 0% |
| CVE-2025-56421 | limesurvey/limesurvey | LimeSurvey is vulnerable to SQL injection | high | 7.5 | 0% |
| CVE-2023-2615 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) in Predefined Properties delete | medium | 6.8 | 0% |
| CVE-2023-2616 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) in Static Routes name field | medium | 6.8 | 0% |
| CVE-2024-0559 | enhanced-text-widget (WordPress plugin) | The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back i | medium | 6.5 | 0% |
| CVE-2024-12615 | passwords-manager (WordPress plugin) | The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb->prefix value in several AJAX actions in all version | medium | 6.5 | 0% |
| CVE-2025-6735 | juzaweb/cms | JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing Import Page component | medium | 6.3 | 0% |
| CVE-2023-33495 | craftcms/cms | Craft CMS vulnerable to HTML injection | medium | 6.1 | 0% |
| CVE-2024-8274 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in a | medium | 6.1 | 0% |
| CVE-2019-25212 | wp-responsive-video-gallery-with-lightbox (WordPress plugin) | The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, an | medium | 4.9 | 0% |
| CVE-2022-3836 | seed-social (WordPress plugin) | The Seed Social WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-3703 | carousel-slider (WordPress plugin) | The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the | medium | 4.7 | 0% |
| CVE-2023-32064 | oro/customer-portal | OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility | medium | 4.3 | 0% |
| CVE-2024-28191 | contao/core-bundle | Contao: Unencoded insert tags in the frontend | low | 3.1 | 0% |
| CVE-2023-2614 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) in name field of Custom Reports | medium | 0.0 | 0% |
| CVE-2023-3082 | post-smtp (WordPress plugin) | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 d | high | 7.2 | 0% |
| CVE-2024-25121 | typo3/cms-core | TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler | high | 7.1 | 0% |
| CVE-2024-7747 | woo-wallet (WordPress plugin) | The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and inclu | medium | 6.5 | 0% |
| CVE-2024-0838 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the side image URL parameter in the Age | medium | 6.4 | 0% |
| CVE-2017-8762 | genix/cms | GeniXCMS Cross-site Scripting (XSS) | medium | 5.4 | 0% |