Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-27836 | thorsten/phpmyfaq | phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint | high | 7.5 | 0% |
| CVE-2023-3025 | dropbox-folder-share (WordPress plugin) | The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the ' | high | 7.2 | 0% |
| CVE-2024-7702 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | high | 7.2 | 0% |
| CVE-2024-1983 | simple-ajax-chat (WordPress plugin) | The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will | high | 7.1 | 0% |
| CVE-2024-2655 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post widgets in all vers | medium | 6.4 | 0% |
| CVE-2024-9225 | wp-seopress (WordPress plugin) | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_que | medium | 6.1 | 0% |
| CVE-2022-4218 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to | medium | 5.4 | 0% |
| CVE-2023-5942 | medialist (WordPress plugin) | The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2024-45131 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 5.4 | 0% |
| CVE-2024-0910 | restrict-for-elementor (WordPress plugin) | The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 | medium | 5.3 | 0% |
| CVE-2024-5615 | opengraph (WordPress plugin) | The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'op | medium | 5.3 | 0% |
| CVE-2024-6448 | mollie-payments-for-woocommerce (WordPress plugin) | The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. | medium | 5.3 | 0% |
| CVE-2024-6554 | branda-white-labeling (WordPress plugin) | The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions | medium | 5.3 | 0% |
| CVE-2024-7426 | peepso-core (WordPress plugin) | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure | medium | 5.3 | 0% |
| CVE-2024-8499 | woo-checkout-field-editor-pro (WordPress plugin) | The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘r | medium | 4.7 | 0% |
| CVE-2024-13229 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing c | medium | 4.3 | 0% |
| CVE-2026-119417 | cakephp/cakephp | CakePHP: SmtpTransport vulnerable to CRLF header injection | high | 0.0 | 0% |
| CVE-2025-0177 | javo-core (WordPress plugin) | The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the | critical | 9.8 | 0% |
| CVE-2025-64519 | torrentpier/torrentpier | TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter | high | 8.8 | 0% |
| CVE-2021-25108 | country-blocker (WordPress plugin) | The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX a | high | 7.1 | 0% |
| CVE-2024-7857 | media-library-plus (WordPress plugin) | The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_ | medium | 6.5 | 0% |
| CVE-2023-6807 | generatepress (WordPress plugin) | The GeneratePress Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom meta output in all versi | medium | 6.4 | 0% |
| CVE-2024-2664 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Widget in all | medium | 6.4 | 0% |
| CVE-2024-2868 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-5260 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 0% |
| CVE-2024-12262 | ebook-store (WordPress plugin) | The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'step' parameter in all versions up to, and inc | medium | 6.1 | 0% |
| CVE-2024-9021 | relevanssi (WordPress plugin) | In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to implement Stored XSS | medium | 5.4 | 0% |
| CVE-2022-51011 | pocketmine/pocketmine-mp | Denial-of-service vulnerability processing large chat messages containing many newlines | medium | 5.3 | 0% |
| CVE-2023-54395 | pocketmine/pocketmine-mp | PocketMine-MP vulnerable to denial-of-service by sending large modal form responses | medium | 5.3 | 0% |
| CVE-2024-13230 | super-socializer (WordPress plugin) | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via | medium | 5.3 | 0% |
| CVE-2024-1492 | wpify-woo (WordPress plugin) | The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to | medium | 5.3 | 0% |
| CVE-2023-5119 | forminator (WordPress plugin) | The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could | medium | 4.8 | 0% |
| CVE-2023-5209 | bookly (WordPress plugin) | The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which cou | medium | 4.8 | 0% |
| CVE-2023-5343 | popup-box (WordPress plugin) | The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2023-5757 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2023-6257 | inline-related-posts (WordPress plugin) | The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see th | medium | 4.3 | 0% |
| CVE-2025-13827 | mautic/grapes-js-builder-bundle | GrapesJsBuilder File Upload allows all file uploads | high | 0.0 | 0% |
| CVE-2026-55554 | dompdf/dompdf | Dompdf: Chroot Validation Bypass | low | 0.0 | 0% |
| CVE-2026-33502 | wwbn/avideo | AVideo has Unauthenticated SSRF via plugin/Live/test.php | critical | 9.3 | 0% |
| CVE-2024-25737 | vufind/vufind | VuFind Server-Side Request Forgery (SSRF) vulnerability | critical | 9.1 | 0% |
| CVE-2024-27915 | sulu/sulu | Sulu grants access to pages regardless of role permissions | medium | 6.8 | 0% |
| CVE-2023-23684 | wp-graphql/wp-graphql | WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF) | medium | 6.5 | 0% |
| CVE-2024-6133 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.5 | 0% |
| CVE-2024-7870 | pixelyoursite (WordPress plugin) | The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Informa | medium | 6.5 | 0% |
| CVE-2026-28685 | kimai/kimai | Kimai's API invoice endpoint missing customer-level access control (IDOR) | medium | 6.5 | 0% |
| CVE-2024-10374 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_loginout shortcode | medium | 6.4 | 0% |
| CVE-2021-34661 | wp-fusion-lite (WordPress plugin) | The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes | medium | 6.1 | 0% |
| CVE-2024-43407 | ckeditor/ckeditor | Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability | medium | 6.1 | 0% |
| CVE-2024-7651 | app-builder (WordPress plugin) | The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-bu | medium | 5.6 | 0% |
| CVE-2023-5809 | popup-box (WordPress plugin) | The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |