Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5467 | geo-my-wp (WordPress plugin) | The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 | medium | 6.4 | 0% |
| CVE-2023-5618 | modern-footnotes (WordPress plugin) | The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-13803 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2024-10878 | sugar-calendar-lite (WordPress plugin) | The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer | medium | 6.1 | 0% |
| CVE-2024-9356 | yotpo-social-reviews-for-woocommerce (WordPress plugin) | The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpo_user_ | medium | 6.1 | 0% |
| CVE-2023-1869 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2. | medium | 5.5 | 0% |
| CVE-2023-0076 | download-attachments (WordPress plugin) | The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2024-0616 | content-protector (WordPress plugin) | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to | medium | 5.3 | 0% |
| CVE-2024-0620 | password-protect-page (WordPress plugin) | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 0% |
| CVE-2024-0855 | spiffy-calendar (WordPress plugin) | The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an | medium | 5.3 | 0% |
| CVE-2024-0868 | coreactivity (WordPress plugin) | The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to | medium | 5.3 | 0% |
| CVE-2024-0965 | simple-page-access-restriction (WordPress plugin) | The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including | medium | 5.3 | 0% |
| CVE-2024-0969 | armember-membership (WordPress plugin) | The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST | medium | 5.3 | 0% |
| CVE-2024-7412 | no-update-nag (WordPress plugin) | The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to th | medium | 5.3 | 0% |
| CVE-2024-9475 | poll-maker (WordPress plugin) | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by par | medium | 4.9 | 0% |
| CVE-2024-13126 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unaut | medium | 4.6 | 0% |
| CVE-2023-2436 | blog-in-blog (WordPress plugin) | The Blog-in-Blog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blog_in_blog' shortcode in versions up to, and i | medium | 4.4 | 0% |
| CVE-2023-4271 | photospace-responsive (WordPress plugin) | The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘psres_button_size’ parameter in version | medium | 4.4 | 0% |
| CVE-2023-5621 | wp-responsive-slider-with-lightbox (WordPress plugin) | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions u | medium | 4.4 | 0% |
| CVE-2023-5819 | amazonify (WordPress plugin) | The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8 | medium | 4.4 | 0% |
| CVE-2024-10778 | stax-buddy-builder (WordPress plugin) | The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and in | medium | 4.3 | 0% |
| CVE-2024-33670 | passbolt/passbolt_api | Passbolt API allows HTML injection | medium | 4.3 | 0% |
| CVE-2026-35537 | roundcube/roundcubemail | Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler | low | 3.7 | 0% |
| CVE-2023-5386 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_d | medium | 6.5 | 0% |
| CVE-2023-6225 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta sh | medium | 6.4 | 0% |
| CVE-2024-0442 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via element URL parameters in all | medium | 6.4 | 0% |
| CVE-2023-0043 | add-user (WordPress plugin) | The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 0% |
| CVE-2024-39322 | aimeos/ai-admin-jsonadm | aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records | medium | 5.5 | 0% |
| CVE-2024-1640 | bit-form (WordPress plugin) | The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulne | medium | 5.3 | 0% |
| CVE-2024-5939 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing cap | medium | 5.3 | 0% |
| CVE-2024-47526 | librenms/librenms | LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Templates" feature | low | 3.5 | 0% |
| CVE-2024-38909 | studio-42/elfinder | Studio 42 elFinder vulnerable to Incorrect Access Control | critical | 9.8 | 0% |
| CVE-2026-41229 | froxlor/froxlor | Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) | critical | 9.1 | 0% |
| CVE-2024-13617 | downloadable-by-american-osteopathic-association (WordPress plugin) | The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attacker | high | 8.6 | 0% |
| CVE-2022-23976 | access-demo-importer (WordPress plugin) | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media) | high | 8.1 | 0% |
| CVE-2024-41964 | getkirby/cms | Kirby has insufficient permission checks in the language settings | high | 8.1 | 0% |
| CVE-2021-25092 | link-library (WordPress plugin) | The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged | medium | 6.5 | 0% |
| CVE-2023-47438 | reportico-web/reportico | SQL Injection vulnerability in Reportico Till | medium | 6.5 | 0% |
| CVE-2024-13341 | multiloca (WordPress plugin) | The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to SQL Injection via the 'data-id' param | medium | 6.5 | 0% |
| CVE-2024-4565 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display c | medium | 6.5 | 0% |
| CVE-2020-36703 | website-builder (WordPress plugin) | The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and | medium | 6.4 | 0% |
| CVE-2024-0873 | watu-quiz (WordPress plugin) | The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'watu-basic-chart' shortcode in all version | medium | 6.4 | 0% |
| CVE-2024-4003 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-1484 | ameliabooking (WordPress plugin) | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date | medium | 6.1 | 0% |
| CVE-2024-8850 | mailchimp-for-wp (WordPress plugin) | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a pla | medium | 6.1 | 0% |
| CVE-2024-4203 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons Pro for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maps widget in all versions u | medium | 5.4 | 0% |
| CVE-2023-51406 | fastdup (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.Th | medium | 5.3 | 0% |
| CVE-2023-51408 | wp-optin-wheel (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Too | medium | 5.3 | 0% |
| CVE-2023-51688 | ecommerce-product-catalog (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This is | medium | 5.3 | 0% |
| CVE-2023-6591 | popup-box (WordPress plugin) | The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |