Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-3721 | wp-email (WordPress plugin) | The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2023-4022 | herd-effects (WordPress plugin) | The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-4388 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | medium | 4.8 | 0% |
| CVE-2023-4502 | translate-wordpress-with-gtranslate (WordPress plugin) | The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow h | medium | 4.8 | 0% |
| CVE-2023-4725 | simple-posts-ticker (WordPress plugin) | The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2023-4862 | filester (WordPress plugin) | The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege use | medium | 4.8 | 0% |
| CVE-2024-3138 | francoisjacquet/rosariosis | RosarioSIS cross site scripting vulnerability | low | 3.5 | 0% |
| CVE-2026-8135 | concrete5/concrete5 | Concrete CMS Vulnerable to Deserialization of Untrusted Data | high | 0.0 | 0% |
| CVE-2026-41058 | wwbn/avideo | WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal | high | 8.1 | 0% |
| CVE-2024-11135 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees' function in all ver | high | 7.5 | 0% |
| CVE-2024-43431 | moodle/moodle | Moodle's IDOR in badges allows deletion of arbitrary badges | high | 7.5 | 0% |
| CVE-2025-47941 | typo3/cms-backend | The TYPO3 CMS Backend has Broken Authentication in Backend MFA | high | 7.2 | 0% |
| CVE-2021-24993 | ultimate-product-catalog (WordPress plugin) | The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could al | medium | 6.5 | 0% |
| CVE-2024-1236 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-1510 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip | medium | 6.4 | 0% |
| CVE-2024-2042 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all ver | medium | 6.4 | 0% |
| CVE-2024-13736 | pure-chat (WordPress plugin) | The Pure Chat – Live Chat & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘purechatWidgetName’ parameter i | medium | 6.1 | 0% |
| CVE-2024-9231 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg withou | medium | 6.1 | 0% |
| CVE-2023-6488 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button | medium | 5.4 | 0% |
| CVE-2024-13907 | boldgrid-backup (WordPress plugin) | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forg | medium | 4.9 | 0% |
| CVE-2026-45731 | wwbn/avideo | AVideo: Authenticated Arbitrary File Read in view/update.php | medium | 4.9 | 0% |
| CVE-2023-5713 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_va | medium | 4.3 | 0% |
| CVE-2025-47778 | sulu/sulu | Sulu vulnerable to XXE in SVG File upload Inspector | medium | 0.0 | 0% |
| CVE-2026-100856 | azuracast/azuracast | AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field | high | 8.8 | 0% |
| CVE-2026-28805 | devcode-it/openstamanager | OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter | high | 8.8 | 0% |
| CVE-2026-107381 | enshrined/svg-sanitize | svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences | medium | 6.5 | 0% |
| CVE-2024-4360 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-4891 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2022-23499 | typo3/cms, typo3/html-sanitizer, typo3/cms-core | TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting | medium | 6.1 | 0% |
| CVE-2017-20061 | elefant/cms | Cross site scripting in Elefant CMS | medium | 5.4 | 0% |
| CVE-2024-0906 | fx-private-site (WordPress plugin) | The f(x) Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via t | medium | 5.3 | 0% |
| CVE-2025-27206 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control leads to security feature bypass | medium | 5.3 | 0% |
| CVE-2026-62858 | yourls/yourls | YOURLS: Unauthenticated File Inclusion | medium | 5.3 | 0% |
| CVE-2021-24572 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as | medium | 4.3 | 0% |
| CVE-2021-24799 | far-future-expiry-header (WordPress plugin) | The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2023-5710 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants | medium | 4.3 | 0% |
| CVE-2023-6969 | user-shortcodes-plus (WordPress plugin) | The User Shortcodes Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.2 | medium | 4.3 | 0% |
| CVE-2023-6983 | shortcode-to-display-post-and-user-data (WordPress plugin) | The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Insecure Direct Object Refere | medium | 4.3 | 0% |
| CVE-2024-1904 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts | medium | 4.3 | 0% |
| CVE-2022-2986 | moodle/moodle | Moodle Cross-Site Request Forgery (CSRF) | high | 8.8 | 0% |
| CVE-2022-3898 | wp-affiliate-platform (WordPress plugin) | The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is | high | 8.8 | 0% |
| CVE-2024-11087 | social-login (WordPress plugin) | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication | high | 8.1 | 0% |
| CVE-2021-4344 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2. This is due to | medium | 6.4 | 0% |
| CVE-2024-0673 | pz-linkcard (WordPress plugin) | The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 6.1 | 0% |
| CVE-2023-2716 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-50703 | nilsteampassnet/teampass | TeamPass privileges issue | medium | 5.4 | 0% |
| CVE-2024-5561 | popup-maker (WordPress plugin) | The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2023-6506 | wp-2fa (WordPress plugin) | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions | medium | 4.3 | 0% |
| CVE-2026-64850 | getgrav/grav | Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() | high | 0.0 | 0% |
| CVE-2026-23492 | pimcore/pimcore | Pimcore Has an Incomplete Patch for CVE-2023-30848 | high | 8.8 | 0% |