Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6626 | all-contact-form-integration-for-elementor (WordPress plugin) | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due | medium | 5.3 | 0% |
| CVE-2022-40694 | news-announcement-scroll (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress. | medium | 4.8 | 0% |
| CVE-2022-41315 | ezoic (WordPress plugin) | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic plugin <= 2.8.8 on WordPress. | medium | 4.8 | 0% |
| CVE-2022-43463 | custom-product-tabs-for-woocommerce (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress. | medium | 4.8 | 0% |
| CVE-2022-44591 | anthologize (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anthologize plugin <= 0.8.0 on WordPress. | medium | 4.8 | 0% |
| CVE-2022-44736 | chameleon (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress. | medium | 4.8 | 0% |
| CVE-2012-10015 | twitter (WordPress plugin) | A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the func | medium | 4.3 | 0% |
| CVE-2013-10025 | exit-strategy (WordPress plugin) | A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this issue is the function ex | medium | 4.3 | 0% |
| CVE-2013-10027 | blogger-importer (WordPress plugin) | A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function | medium | 4.3 | 0% |
| CVE-2013-10029 | wordpress-exit-box-lite (WordPress plugin) | A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this vulnerability is the f | medium | 4.3 | 0% |
| CVE-2021-24688 | orange-form (WordPress plugin) | The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_ | medium | 4.3 | 0% |
| CVE-2025-60790 | processwire/processwire | ProcessWire CMS vulnerable to resource-exhaustion Denial of Service | medium | 0.0 | 0% |
| CVE-2026-13244 | drupal/tealiumiq | The Tealium iQ Tag Management module provides Drupal integration with Tealium iQ. `tealiumiq` stores some data as PHP-s | unknown | 0.0 | 0% |
| CVE-2026-55809 | drupal/flag_attendance_field | The Flag attendance field module gives you the ability to add attendance by depending on [Flag module](https://www.drupa | unknown | 0.0 | 0% |
| CVE-2026-55810 | drupal/plotly_js | The Plotly.js Graphing module provides a fully customizable implementation of the open source Plotly.js graphing library | unknown | 0.0 | 0% |
| CVE-2026-45010 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id | critical | 9.1 | 0% |
| CVE-2024-52806 | simplesamlphp/saml2, simplesamlphp/saml2-legacy | SimpleSAMLphp SAML2 has an XXE in parsing SAML messages | high | 8.3 | 0% |
| CVE-2024-13568 | fluent-support (WordPress plugin) | The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all v | high | 7.5 | 0% |
| CVE-2024-5472 | wp-quicklatex (WordPress plugin) | The WP QuickLaTeX WordPress plugin before 3.8.7 does not sanitise and escape some of its settings, which could allow high privilege users su | high | 7.1 | 0% |
| CVE-2024-9529 | advanced-custom-fields (WordPress plugin) | The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro Wor | medium | 6.6 | 0% |
| CVE-2021-25116 | enqueue-anything (WordPress plugin) | The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does no | medium | 6.5 | 0% |
| CVE-2026-74907 | getgrav/grav | Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`) | medium | 5.9 | 0% |
| CVE-2023-5610 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an ar | medium | 5.4 | 0% |
| CVE-2024-8983 | custom-twitter-feeds (WordPress plugin) | Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2023-5712 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_va | medium | 4.3 | 0% |
| CVE-2024-2844 | easy-appointments (WordPress plugin) | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the aja | medium | 4.3 | 0% |
| CVE-2026-49276 | getkirby/cms | Kirby: Self cross-site scripting (self-XSS) in the writer field | high | 0.0 | 0% |
| CVE-2026-80198 | kimai/kimai | Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates | medium | 0.0 | 0% |
| CVE-2025-58048 | paymenter/paymenter | Paymenter vulnerable to Remote Code Execution via public file uploads | critical | 9.9 | 0% |
| CVE-2024-3668 | powerpack-addons-for-elementor (WordPress plugin) | The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. Th | high | 8.8 | 0% |
| CVE-2024-6698 | wp-fundraising-donation (WordPress plugin) | The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the pl | high | 8.8 | 0% |
| CVE-2024-8246 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | high | 8.8 | 0% |
| CVE-2024-13606 | js-support-ticket (WordPress plugin) | The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi | high | 7.5 | 0% |
| CVE-2024-51494 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php | high | 7.5 | 0% |
| CVE-2024-51495 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php | high | 7.5 | 0% |
| CVE-2023-1367 | alextselegidis/easyappointments | Code Injection in alextselegidis/easyappointments | high | 7.3 | 0% |
| CVE-2023-4889 | shareaholic (WordPress plugin) | The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and includi | medium | 6.4 | 0% |
| CVE-2024-9239 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_qu | medium | 6.1 | 0% |
| CVE-2024-3048 | bannerlid (WordPress plugin) | The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross | medium | 5.5 | 0% |
| CVE-2021-24433 | simple-sort\&search (WordPress plugin) | The simple sort&search WordPress plugin through 0.0.3 does not make sure that the indexurl parameter of the shortcodes "category_sims", "ord | medium | 5.4 | 0% |
| CVE-2023-3192 | froxlor/froxlor | Froxlor Session Fixation vulnerability | medium | 5.4 | 0% |
| CVE-2024-0719 | tabs-shortcode-and-widget (WordPress plugin) | The Tabs Shortcode and Widget WordPress plugin through 1.17 does not validate and escape some of its shortcode attributes before outputting | medium | 5.4 | 0% |
| CVE-2023-46925 | reportico-web/reportico | Reportico Cross-site Scripting vulnerability | medium | 4.8 | 0% |
| CVE-2021-4395 | woo-abandoned-cart-recovery (WordPress plugin) | The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin | medium | 4.3 | 0% |
| CVE-2022-2123 | wp-opt-in (WordPress plugin) | The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF which allows changed plugin settings and can be used for sending spam ema | medium | 4.3 | 0% |
| CVE-2024-1288 | schema-\&-structured-data-for-wp-\&-amp (WordPress plugin) | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 4.3 | 0% |
| CVE-2024-3243 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-51754 | twig/twig | Twig has unguarded calls to `__toString()` when nesting an object into an array | low | 2.2 | 0% |
| CVE-2024-4305 | postx (WordPress plugin) | The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block optio | medium | 6.8 | 0% |
| CVE-2024-5744 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribut | medium | 6.8 | 0% |