Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0096 | happyforms (WordPress plugin) | The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/p | medium | 5.4 | 0% |
| CVE-2022-2350 | disable-user-login (WordPress plugin) | The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unaut | medium | 5.3 | 0% |
| CVE-2024-0682 | pagerestrict (WordPress plugin) | The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to t | medium | 5.3 | 0% |
| CVE-2024-2974 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Se | medium | 5.3 | 0% |
| CVE-2024-3733 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Se | medium | 5.3 | 0% |
| CVE-2023-4808 | wp-post-popup (WordPress plugin) | The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-4970 | pubydoc (WordPress plugin) | The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-0872 | watu-quiz (WordPress plugin) | The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu- | medium | 4.3 | 0% |
| CVE-2025-48882 | phpoffice/math | PHPOffice Math allows XXE when processing an XML file in the MathML format | high | 0.0 | 0% |
| CVE-2026-52819 | kimai/kimai | Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the targ | medium | 0.0 | 0% |
| CVE-2026-54004 | getkirby/cms | Kirby: Access to files of top-level drafts is not protected by permissions | medium | 0.0 | 0% |
| CVE-2022-3911 | iubenda-cookie-law-solution (WordPress plugin) | The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options | high | 8.8 | 0% |
| CVE-2024-4902 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ para | high | 7.2 | 0% |
| CVE-2024-5207 | post-smtp (WordPress plugin) | The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerab | high | 7.2 | 0% |
| CVE-2025-1321 | teachpress (WordPress plugin) | The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up | medium | 6.5 | 0% |
| CVE-2024-1412 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘message’ and 'error' parameters in all version | medium | 6.1 | 0% |
| CVE-2024-2200 | contact-form-plugin (WordPress plugin) | The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ para | medium | 6.1 | 0% |
| CVE-2022-3983 | checkout-for-paypal (WordPress plugin) | The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2022-3984 | flowplayer-video-player (WordPress plugin) | The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2022-3985 | videojs-html5-player (WordPress plugin) | The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2022-3986 | wp-stripe-checkout (WordPress plugin) | The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2022-3987 | responsive-lightbox2 (WordPress plugin) | The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2024-1849 | wp-customer-reviews (WordPress plugin) | The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page | medium | 5.4 | 0% |
| CVE-2024-8254 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | medium | 5.4 | 0% |
| CVE-2022-46158 | prestashop/prestashop | PrestaShop has potential Information exposure in the upload directory | medium | 5.3 | 0% |
| CVE-2024-2428 | presto-player (WordPress plugin) | The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via | medium | 4.7 | 0% |
| CVE-2023-5715 | plerdy-heatmap (WordPress plugin) | The Website Optimization – Plerdy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tracking code settings | medium | 4.4 | 0% |
| CVE-2024-0597 | seo-plugin-by-squirrly-seo (WordPress plugin) | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to an | medium | 4.4 | 0% |
| CVE-2024-0612 | content-views (WordPress plugin) | The Content Views – Post Grid, Slider, Accordion (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 4.4 | 0% |
| CVE-2024-7418 | the-post-grid (WordPress plugin) | The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Sensitive Informatio | medium | 4.3 | 0% |
| CVE-2026-75837 | getgrav/grav | Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin | critical | 9.1 | 0% |
| CVE-2024-54141 | thorsten/phpmyfaq | phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available | high | 8.6 | 0% |
| CVE-2022-23975 | access-demo-importer (WordPress plugin) | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin. | medium | 6.5 | 0% |
| CVE-2024-4863 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-12238 | ninja-forms (WordPress plugin) | The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in al | medium | 6.3 | 0% |
| CVE-2024-8665 | yith-custom-login (WordPress plugin) | The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria | medium | 6.1 | 0% |
| CVE-2024-9347 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' | medium | 6.1 | 0% |
| CVE-2023-2735 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gh_form' shortcode in versions up to, and includin | medium | 4.9 | 0% |
| CVE-2022-0833 | church-admin (WordPress plugin) | The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allo | medium | 4.3 | 0% |
| CVE-2023-6922 | coming-soon-maintenance-mode-from-acurax (WordPress plugin) | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to | medium | 4.3 | 0% |
| CVE-2022-0279 | anycomment (WordPress plugin) | The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any a | low | 3.1 | 0% |
| CVE-2025-3061 | drupal/material_admin | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2025-3062 | drupal/druadmin_lte_theme | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2024-5973 | masterstudy-lms (WordPress plugin) | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which coul | high | 8.8 | 0% |
| CVE-2026-86428 | league/commonmark | league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension | high | 7.5 | 0% |
| CVE-2026-86430 | league/commonmark | league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters | high | 7.5 | 0% |
| CVE-2023-1881 | microweber/microweber | Microweber vulnerable to stored cross-site scripting (XSS) via X-Forwarded-For header | high | 7.4 | 0% |
| CVE-2023-6279 | sites-library (WordPress plugin) | The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, su | high | 7.1 | 0% |
| CVE-2024-6479 | sip-reviews-shortcode-woocommerce (WordPress plugin) | The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'no_of_reviews' attribute in the wooco | medium | 6.5 | 0% |
| CVE-2024-2792 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in all versions up to, and includ | medium | 6.4 | 0% |