Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2509 | gutenberg-blocks-with-ai (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputti | medium | 6.5 | 0% |
| CVE-2025-0866 | legoeso-pdf-manager (WordPress plugin) | The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter in all versions up to | medium | 6.5 | 0% |
| CVE-2022-23502 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset | medium | 5.4 | 0% |
| CVE-2024-1093 | change-memory-limit (WordPress plugin) | The Change Memory Limit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the adm | medium | 5.3 | 0% |
| CVE-2024-1178 | sportspress (WordPress plugin) | The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-13372 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 5.3 | 0% |
| CVE-2024-11184 | mwdelaney/wp-enable-svg, wp-enable-svg (WordPress plugin) | The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded | medium | 4.8 | 0% |
| CVE-2024-45604 | contao/core-bundle | Contao affected by directory traversal in the file selector widget | medium | 4.3 | 0% |
| CVE-2024-7605 | helloasso (WordPress plugin) | The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' fun | medium | 4.3 | 0% |
| CVE-2024-8350 | uncanny-groups-for-learndash (WordPress plugin) | The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm | low | 2.7 | 0% |
| CVE-2026-34390 | mantisbt/mantisbt | MantisBT Vulnerable to Privilege Escalation from Manager to Administrator | medium | 0.0 | 0% |
| CVE-2026-45704 | pimcore/pimcore | Pimcore has a CustomReports Share Bypass | high | 0.0 | 0% |
| CVE-2026-52821 | kimai/kimai | Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects | medium | 0.0 | 0% |
| CVE-2026-52826 | kimai/kimai | Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation | medium | 0.0 | 0% |
| CVE-2026-54005 | getkirby/cms | Kirby: `pages.access` permission is not checked in the `site/find` REST API route | high | 0.0 | 0% |
| CVE-2026-54494 | phanan/koel | Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv | medium | 0.0 | 0% |
| CVE-2026-56096 | apache-solr-for-typo3/solr | TYPO3-EXT-SA-2026-025: Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) | unknown | 0.0 | 0% |
| CVE-2026-71415 | getkirby/cms | Kirby: File upload permissions are not checked during processing of chunk data | high | 0.0 | 0% |
| CVE-2026-77132 | typo3/cms-backend | TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard | unknown | 0.0 | 0% |
| CVE-2026-82395 | sulu/sulu | Sulu: Media move/update authorization bypass (IDOR) | medium | 0.0 | 0% |
| CVE-2026-38992 | cockpit-hq/cockpit | Cockpit is vulnerable to arbitrary code execution | critical | 9.8 | 0% |
| CVE-2026-27939 | statamic/cms | Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass | high | 8.8 | 0% |
| CVE-2024-50351 | librenms/librenms | LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php | high | 7.5 | 0% |
| CVE-2024-29777 | forminator (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress P | high | 7.1 | 0% |
| CVE-2026-28423 | statamic/cms | Statamic Vulnerable to Server-Side Request Forgery via Glide | medium | 6.8 | 0% |
| CVE-2025-49578 | starcitizentools/citizen-skin | starcitizentools/citizen-skin allows stored XSS in user registration date message | medium | 6.5 | 0% |
| CVE-2023-5432 | jquery-news-ticker (WordPress plugin) | The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up t | medium | 6.4 | 0% |
| CVE-2024-3266 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of widgets in all versions up | medium | 6.4 | 0% |
| CVE-2023-7200 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle | medium | 6.1 | 0% |
| CVE-2024-11188 | formidable (WordPress plugin) | The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable | medium | 6.1 | 0% |
| CVE-2021-24968 | ultimate-faq (WordPress plugin) | The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome | medium | 5.7 | 0% |
| CVE-2021-25011 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, | medium | 5.7 | 0% |
| CVE-2021-4417 | forminator (WordPress plugin) | The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versio | medium | 5.4 | 0% |
| CVE-2023-5620 | web-push-notifications (WordPress plugin) | The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, so | medium | 5.4 | 0% |
| CVE-2023-5738 | backup-and-migration (WordPress plugin) | The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a | medium | 5.4 | 0% |
| CVE-2024-37308 | cooked (WordPress plugin) | The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` par | medium | 5.4 | 0% |
| CVE-2024-24753 | bref/bref | Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2 | medium | 4.8 | 0% |
| CVE-2024-4149 | floating-chat-widget (WordPress plugin) | The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin bef | medium | 4.8 | 0% |
| CVE-2024-39678 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-39679 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up t | medium | 4.3 | 0% |
| CVE-2026-35538 | roundcube/roundcubemail | Roundcube Webmail: Unsanitized IMAP SEARCH command arguments | low | 3.1 | 0% |
| CVE-2025-1911 | product-import-export-for-woo (WordPress plugin) | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion du | low | 2.7 | 0% |
| CVE-2026-44212 | prestashop/prestashop | PrestaShop has a stored XSS executable in customer service view | critical | 9.3 | 0% |
| CVE-2026-63135 | yourls/yourls | YOURLS has stored XSS in referrer statistics chart via crafted Referer header | high | 8.2 | 0% |
| CVE-2025-30151 | shopware/core, shopware/platform | Shopware allows Denial Of Service via password length | high | 7.5 | 0% |
| CVE-2025-68129 | auth0/auth0-php | Auth0-PHP SDK has Improper Audience Validation | medium | 6.8 | 0% |
| CVE-2025-49575 | starcitizentools/citizen-skin | Citizen skin vulnerable to stored XSS through multiple system messages | medium | 6.5 | 0% |
| CVE-2025-49576 | starcitizentools/citizen-skin | starcitizentools/citizen-skin allows stored XSS in search no result messages | medium | 6.5 | 0% |
| CVE-2025-49577 | starcitizentools/citizen-skin | starcitizentools/citizen-skin allows stored XSS in preference menu heading messages | medium | 6.5 | 0% |
| CVE-2025-65657 | feehi/cms | FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management | medium | 6.5 | 0% |