Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-8726 | georgringer/news | georgringer/news has SQL Injection in extension "News system" (news) | high | 0.0 | 0% |
| CVE-2024-49759 | librenms/librenms | Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php | high | 7.5 | 0% |
| CVE-2024-7092 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-3188 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes b | medium | 6.3 | 0% |
| CVE-2024-8792 | subscribe-to-comments (WordPress plugin) | The Subscribe to Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appro | medium | 6.1 | 0% |
| CVE-2021-36850 | media-file-renamer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Media File Renamer – Auto & Manual Rename plugin (versions <= 5.1.9). Affected | medium | 5.4 | 0% |
| CVE-2022-4792 | news-\&-blog-designer-pack (WordPress plugin) | The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow us | medium | 5.4 | 0% |
| CVE-2024-0895 | 3d-flipbook-dflip-lite (WordPress plugin) | The PDF Flipbook, 3D Flipbook – DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versi | medium | 5.4 | 0% |
| CVE-2024-5649 | fusion-slider (WordPress plugin) | The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserializat | medium | 5.4 | 0% |
| CVE-2023-6962 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the me | medium | 5.3 | 0% |
| CVE-2024-7133 | my-sticky-bar (WordPress plugin) | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does no | medium | 4.8 | 0% |
| CVE-2021-36878 | ulisting (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to update s | medium | 4.3 | 0% |
| CVE-2024-10312 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including | medium | 4.3 | 0% |
| CVE-2023-1788 | grumpydictator/firefly-iii | Firefly III insufficiently expires sessions | medium | 4.2 | 0% |
| CVE-2025-3952 | projectopia-core (WordPress plugin) | The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a de | high | 8.1 | 0% |
| CVE-2022-2555 | yotpo-reviews-for-woocommerce (WordPress plugin) | The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to | medium | 6.5 | 0% |
| CVE-2023-6812 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20 | medium | 4.3 | 0% |
| CVE-2024-7394 | concrete5/concrete5 | Concrete CMS Stored XSS in getAttributeSetName | low | 2.0 | 0% |
| CVE-2026-112066 | sgalinski/sg-cookie-optin | TYPO3-EXT-SA-2026-029: Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin) | unknown | 0.0 | 0% |
| CVE-2026-77139 | mask/mask | TYPO3-EXT-SA-2026-017: Path Traversal in extension "Mask" (mask) | unknown | 0.0 | 0% |
| CVE-2025-54677 | online-booking-\&-scheduling-calendar (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-s | critical | 9.1 | 0% |
| CVE-2025-1657 | ulisting (WordPress plugin) | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object In | high | 8.8 | 0% |
| CVE-2026-32812 | admidio/admidio | Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint | medium | 6.8 | 0% |
| CVE-2022-3017 | froxlor/froxlor | Froxlor vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 0% |
| CVE-2022-51018 | pocketmine/pocketmine-mp | Book page text, count, and author/title length is not limited in PocketMine-MP | medium | 6.5 | 0% |
| CVE-2023-6551 | verot/class.upload.php | class.upload.php allows cross-site scripting attacks via uploaded files | medium | 6.5 | 0% |
| CVE-2023-4962 | video-popup (WordPress plugin) | The Video PopUp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'video_popup' shortcode in versions up to, and includi | medium | 6.4 | 0% |
| CVE-2023-6684 | ibtana-visual-editor (WordPress plugin) | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ive' shortcode in versions | medium | 6.4 | 0% |
| CVE-2023-6994 | list-category-posts (WordPress plugin) | The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-7100 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_button shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-8519 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 6.4 | 0% |
| CVE-2024-10003 | rover-idx (WordPress plugin) | The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on | medium | 6.3 | 0% |
| CVE-2024-5087 | minimal-coming-soon-maintenance-mode (WordPress plugin) | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili | medium | 6.3 | 0% |
| CVE-2024-9377 | export-woocommerce (WordPress plugin) | The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use o | medium | 6.1 | 0% |
| CVE-2024-1855 | wp-cafe (WordPress plugin) | The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to | medium | 5.3 | 0% |
| CVE-2023-4810 | responsive-pricing-table (WordPress plugin) | The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-34349 | sylius/sylius | Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel | medium | 4.8 | 0% |
| CVE-2024-8541 | woo-discount-rules (WordPress plugin) | The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulne | medium | 4.7 | 0% |
| CVE-2024-6011 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in al | medium | 4.4 | 0% |
| CVE-2025-71417 | pocketmine/pocketmine-mp | PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking | high | 0.0 | 0% |
| CVE-2026-86204 | pocketmine/pocketmine-mp | PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling | high | 0.0 | 0% |
| CVE-2024-11285 | jobcareer (WordPress plugin) | The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. Th | critical | 9.8 | 0% |
| CVE-2024-13446 | workreap (WordPress plugin) | The Workreap plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.2.5. Th | critical | 9.8 | 0% |
| CVE-2024-51497 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php | high | 7.5 | 0% |
| CVE-2020-5502 | phpbb/phpbb | phpBB allows CSRF | medium | 6.5 | 0% |
| CVE-2026-56831 | shopper/framework | Shopper: Negative discount values accepted and propagated through order calculation pipeline | medium | 6.5 | 0% |
| CVE-2024-13501 | formassembly-web-forms (WordPress plugin) | The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-2348 | gum-elementor-addon (WordPress plugin) | The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Meta widget in all versions up to, an | medium | 6.4 | 0% |
| CVE-2024-2460 | gamipress-button (WordPress plugin) | The GamiPress – Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gamipress_button' shortcode in al | medium | 6.4 | 0% |
| CVE-2024-37294 | aimeos/aimeos-core | Aimeos denial of service vulnerability in SaaS and marketplace setups | medium | 5.5 | 0% |