Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2926 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions | medium | 6.4 | 0% |
| CVE-2024-4212 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TF Group Image, TF Na | medium | 6.4 | 0% |
| CVE-2024-8117 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘selected_opti | medium | 6.1 | 0% |
| CVE-2024-8119 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter | medium | 6.1 | 0% |
| CVE-2024-8802 | clio-grow-form (WordPress plugin) | The Clio Grow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escap | medium | 6.1 | 0% |
| CVE-2024-9349 | amazon-auto-links (WordPress plugin) | The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the u | medium | 6.1 | 0% |
| CVE-2024-9667 | seriously-simple-podcasting (WordPress plugin) | The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without | medium | 6.1 | 0% |
| CVE-2022-1577 | database-backup (WordPress plugin) | The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which co | medium | 5.4 | 0% |
| CVE-2024-1274 | my-calendar (WordPress plugin) | The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as S | medium | 5.4 | 0% |
| CVE-2024-3752 | crelly-slider (WordPress plugin) | The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 5.4 | 0% |
| CVE-2024-3755 | mf-gig-calendar (WordPress plugin) | The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 5.4 | 0% |
| CVE-2024-4602 | embed-peertube-playlist (WordPress plugin) | The Embed Peertube Playlist WordPress plugin before 1.10 does not sanitise and escape some of its settings, which could allow high privilege | medium | 5.4 | 0% |
| CVE-2025-23201 | librenms/librenms | Librenms has a reflected XSS on error alert | medium | 5.4 | 0% |
| CVE-2022-3489 | wp-hide (WordPress plugin) | The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settin | medium | 5.3 | 0% |
| CVE-2024-3927 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 5.3 | 0% |
| CVE-2026-22242 | coreshop/core-shop | CoreShop Vulnerable to SQL Injection via Admin Reports | medium | 4.9 | 0% |
| CVE-2023-5940 | wp-not-login-hide (WordPress plugin) | The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-0836 | review-schema (WordPress plugin) | The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data | medium | 4.3 | 0% |
| CVE-2024-51755 | twig/twig | Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled | low | 2.2 | 0% |
| CVE-2024-46209 | redaxo/source | REDAXO CMS Cross-site Scripting vulnerability | low | 0.0 | 0% |
| CVE-2026-55452 | snipe/snipe-it | Snipe-IT has CSV formula injection in Activity Report export | medium | 0.0 | 0% |
| CVE-2026-100857 | azuracast/azuracast | AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs | high | 8.7 | 0% |
| CVE-2024-13793 | wolmart (WordPress theme) | The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions | high | 7.3 | 0% |
| CVE-2022-3097 | lbstopattack (WordPress plugin) | The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to cond | medium | 6.5 | 0% |
| CVE-2024-6256 | feeds-for-youtube (WordPress plugin) | The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2023-26091 | frappant/frp-form-answers | frp_form_answers allows Cross-site Scripting | medium | 6.1 | 0% |
| CVE-2024-23173 | mediawiki/cargo | MediaWiki Cargo Extension Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2024-25875 | enhavo/enhavo-app | Enhavo Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2022-2223 | image-slider-widget (WordPress plugin) | The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to pro | medium | 5.4 | 0% |
| CVE-2022-2224 | feed-instagram-lite (WordPress plugin) | The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to f | medium | 5.4 | 0% |
| CVE-2022-45363 | betheme (WordPress plugin) | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) in Muffingroup Betheme theme <= 26.6.1 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-1502 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabi | medium | 5.4 | 0% |
| CVE-2023-5137 | simply-excerpts (WordPress plugin) | The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-pri | medium | 4.8 | 0% |
| CVE-2024-2444 | inline-related-posts (WordPress plugin) | The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-10568 | ajax-search (WordPress plugin) | The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.7 | 0% |
| CVE-2024-3338 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up t | medium | 4.4 | 0% |
| CVE-2023-6959 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-0248 | eazydocs (WordPress plugin) | The EazyDocs WordPress plugin before 2.4.0 re-introduced CVE-2023-6029 (https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597 | medium | 4.3 | 0% |
| CVE-2024-0369 | bulk-edit-post-titles (WordPress plugin) | The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the b | medium | 4.3 | 0% |
| CVE-2024-0370 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2024-0371 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2024-0797 | profit-products-tables-for-woocommerce (WordPress plugin) | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unautho | medium | 4.3 | 0% |
| CVE-2023-2599 | ldap-login-for-intranet-sites (WordPress plugin) | The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via th | low | 3.1 | 0% |
| CVE-2025-47707 | drupal/miniorange_2fa | The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't | unknown | 0.0 | 0% |
| CVE-2026-40596 | mantisbt/mantisbt | MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference | high | 0.0 | 0% |
| CVE-2026-35470 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals | high | 8.8 | 0% |
| CVE-2024-34009 | moodle/moodle | Moodle ReCAPTCHA can be bypassed on the login page | high | 7.5 | 0% |
| CVE-2023-6806 | starbox (WordPress plugin) | The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up to | medium | 6.4 | 0% |
| CVE-2023-6986 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for Wor | medium | 6.4 | 0% |
| CVE-2023-7044 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |