Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6733 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 6.5 | 0% |
| CVE-2024-12635 | wp-docs (WordPress plugin) | The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up to, and including, | medium | 6.5 | 0% |
| CVE-2024-1763 | wp-social (WordPress plugin) | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap | medium | 6.5 | 0% |
| CVE-2026-57570 | backpack/crud | Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation | medium | 6.5 | 0% |
| CVE-2024-3647 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's post ticker widget in al | medium | 6.4 | 0% |
| CVE-2025-66304 | getgrav/grav | Grav Exposes Password Hashes Leading to privilege escalation | medium | 6.2 | 0% |
| CVE-2024-8663 | wp-simple-booking-calendar (WordPress plugin) | The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove | medium | 6.1 | 0% |
| CVE-2023-2527 | integration-for-contact-form-7-and-zoho-crm\,-bigin (WordPress plugin) | The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter befor | medium | 4.8 | 0% |
| CVE-2023-3170 | tagdiv-composer (WordPress plugin) | The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and | medium | 4.8 | 0% |
| CVE-2023-4829 | froxlor/froxlor | Cross-site Scripting (XSS) in froxlor/froxlor | medium | 4.8 | 0% |
| CVE-2023-7154 | hubbub-lite (WordPress plugin) | The Hubbub Lite (formerly Grow Social) WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow h | medium | 4.8 | 0% |
| CVE-2024-6158 | category-posts-widget (WordPress plugin), term-and-category-based-posts-widget (WordPress plugin) | The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not valid | medium | 4.8 | 0% |
| CVE-2020-36745 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0. This is due | medium | 4.3 | 0% |
| CVE-2023-45824 | oro/platform | Pinned entity creation form shows wrong data | medium | 4.3 | 0% |
| CVE-2023-48296 | oro/customer-portal | Storefront user can access history and most viewed data from matching back-office user with the same ID | medium | 4.3 | 0% |
| CVE-2024-10216 | wp-user-manager (WordPress plugin) | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2024-8516 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 v | medium | 4.3 | 0% |
| CVE-2026-16644 | drupal/webform_rest | This module enables you to retrieve and submit webform submissions via REST endpoints. The module doesn't sufficiently | unknown | 0.0 | 0% |
| CVE-2025-47658 | wsdesk (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpd | critical | 9.9 | 0% |
| CVE-2024-13771 | civi (WordPress plugin) | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up | critical | 9.8 | 0% |
| CVE-2026-33351 | wwbn/avideo | AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass | critical | 9.1 | 0% |
| CVE-2024-11271 | wp-webinarsystem (WordPress plugin) | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on | high | 8.8 | 0% |
| CVE-2026-55466 | snipe/snipe-it | Snipe-IT vulnerable to stored XSS via inline-served attachment | high | 8.7 | 0% |
| CVE-2026-55460 | snipe/snipe-it | Snipe-IT has an authorization bypass on bulk editing users | high | 7.1 | 0% |
| CVE-2017-8879 | dolibarr/dolibarr | Dolibarr allows password changes without supplying the current password | medium | 6.8 | 0% |
| CVE-2019-7851 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition CSRF vulnerability | medium | 6.5 | 0% |
| CVE-2019-7874 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 6.5 | 0% |
| CVE-2019-7947 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition CSRF vulnerability | medium | 6.5 | 0% |
| CVE-2024-10341 | league-of-legends-shortcodes (WordPress plugin) | The League of Legends Shortcodes plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and inclu | medium | 6.5 | 0% |
| CVE-2024-12332 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up | medium | 6.5 | 0% |
| CVE-2025-54267 | magento/community-edition, magento/project-community-edition | Magento vulnerable to privilege escalation due to incorrect authorization | medium | 6.5 | 0% |
| CVE-2023-4960 | wc-multivendor-marketplace (WordPress plugin) | The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and in | medium | 6.4 | 0% |
| CVE-2023-5116 | ipushpull (WordPress plugin) | The Live updates from Excel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ipushpull_page' shortcode in | medium | 6.4 | 0% |
| CVE-2024-0792 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode( | medium | 6.4 | 0% |
| CVE-2024-1058 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the onclick parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-10785 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-1445 | page-scroll-to-id (WordPress plugin) | The Page scroll to id plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-2475 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up | medium | 6.4 | 0% |
| CVE-2024-3974 | buddypress (WordPress plugin) | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and includ | medium | 6.4 | 0% |
| CVE-2022-41788 | soledad (WordPress plugin) | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-11083 | wp-user-avatar (WordPress plugin) | The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the | medium | 5.3 | 0% |
| CVE-2024-6499 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7. | medium | 5.3 | 0% |
| CVE-2024-7415 | remember-me-controls (WordPress plugin) | The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due | medium | 5.3 | 0% |
| CVE-2023-0566 | froxlor/froxlor | Froxlor contains Static Code Injection | medium | 4.8 | 0% |
| CVE-2022-0245 | livehelperchat/livehelperchat | Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat | medium | 4.3 | 0% |
| CVE-2023-1701 | pimcore/pimcore | Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings | medium | 0.0 | 0% |
| CVE-2023-1702 | pimcore/pimcore | Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings | medium | 0.0 | 0% |
| CVE-2026-112071 | codingms/shop | TYPO3-EXT-SA-2026-036: Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop) | unknown | 0.0 | 0% |
| CVE-2026-113468 | codingms/shop | TYPO3-EXT-SA-2026-036: Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop) | unknown | 0.0 | 0% |
| CVE-2026-35445 | winter/wn-backend-module | Winter: Authenticated backend users can bypass Users controller permission checks | high | 0.0 | 0% |