Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.06.2, updated 2026-11-06. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1171 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 5.4 | 0% |
| CVE-2024-12316 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_a | medium | 5.3 | 0% |
| CVE-2024-8513 | qa-heatmap-analytics (WordPress plugin) | The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized mod | medium | 5.3 | 0% |
| CVE-2024-13119 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 | medium | 4.8 | 0% |
| CVE-2024-2309 | wp-staging (WordPress plugin) | The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and es | medium | 4.8 | 0% |
| CVE-2024-5002 | user-submitted-posts (WordPress plugin) | The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2022-27846 | yoo-slider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider. | medium | 4.3 | 0% |
| CVE-2024-1330 | kadence-blocks-pro (WordPress plugin) | The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's | medium | 4.3 | 0% |
| CVE-2026-23959 | coreshop/core-shop | CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier | medium | 0.0 | 0% |
| CVE-2026-59943 | dompdf/dompdf | Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem | medium | 0.0 | 0% |
| CVE-2025-1446 | pods (WordPress plugin) | The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to pe | critical | 9.8 | 0% |
| CVE-2026-41147 | nukeviet/nukeviet | NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class | high | 8.7 | 0% |
| CVE-2026-46491 | simplesamlphp/simplesamlphp-module-casserver | SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion | high | 8.6 | 0% |
| CVE-2022-3605 | wp-csv-exporter (WordPress plugin) | The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection | high | 7.8 | 0% |
| CVE-2026-49359 | pontedilana/php-weasyprint | PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option | medium | 6.5 | 0% |
| CVE-2023-4773 | wordpress-social-login (WordPress plugin) | The WordPress Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wordpress_social_login_meta' shortcode | medium | 6.4 | 0% |
| CVE-2022-48614 | mediawiki/semantic-media-wiki | Cross-site Scripting in Semantic MediaWiki | medium | 6.1 | 0% |
| CVE-2021-24752 | catch-scroll-progress-bar (WordPress plugin), catch-sticky-menu (WordPress plugin), catch-themes-demo-import (WordPress plugin) +7 more | Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any | medium | 5.7 | 0% |
| CVE-2024-1368 | wp-page-duplicator (WordPress plugin) | The Page Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplica | medium | 5.3 | 0% |
| CVE-2024-1516 | wp-e-commerce (WordPress plugin) | The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_f | medium | 5.3 | 0% |
| CVE-2025-59397 | open-web-analytics/open-web-analytics | Open Web Analytics Server is vulnerable to SQL Injection | medium | 5.0 | 0% |
| CVE-2024-4061 | survey-maker (WordPress plugin) | The Survey Maker WordPress plugin before 4.2.9 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-3265 | advance-search (WordPress plugin) | The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for user | medium | 4.7 | 0% |
| CVE-2024-1463 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz tit | medium | 4.4 | 0% |
| CVE-2024-1571 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, a | medium | 4.4 | 0% |
| CVE-2024-13343 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_a | high | 8.8 | 0% |
| CVE-2024-29763 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Tax | high | 7.1 | 0% |
| CVE-2023-23708 | visualizer (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin | medium | 6.5 | 0% |
| CVE-2024-1537 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2022-29439 | baslider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress allows deleting slides. | medium | 5.4 | 0% |
| CVE-2022-4219 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to | medium | 5.4 | 0% |
| CVE-2022-4220 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to | medium | 5.4 | 0% |
| CVE-2025-1508 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data | medium | 5.3 | 0% |
| CVE-2025-4798 | wp-downloadmanager (WordPress plugin) | The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due | medium | 4.9 | 0% |
| CVE-2023-43649 | baserproject/basercms | baserCMS CSRF vulnerability in Content preview Feature | medium | 4.7 | 0% |
| CVE-2022-23983 | wp-content-copy-protector (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click | medium | 4.3 | 0% |
| CVE-2022-29427 | disable-right-click-for-wp (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress. | medium | 4.3 | 0% |
| CVE-2022-29441 | private-messages-for-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Private Messages For WordPress plugin <= 2.1.10 at WordPress allows attackers to send mes | medium | 4.3 | 0% |
| CVE-2024-12164 | wpsyncsheets-wpforms (WordPress plugin) | The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data | medium | 4.3 | 0% |
| CVE-2024-7762 | simple-job-board (WordPress plugin) | The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to acc | low | 3.7 | 0% |
| CVE-2024-13280 | drupal/persistent_login | This module enables users to remain logged in separately from session timeouts. The module doesn't sufficiently check a | unknown | 0.0 | 0% |
| CVE-2026-96355 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurabl | unknown | 0.0 | 0% |
| CVE-2025-53093 | starcitizentools/tabber-neue | TabberNeue vulnerable to Stored XSS through wikitext | high | 8.6 | 0% |
| CVE-2024-54149 | winter/wn-cms-module | Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion | high | 8.4 | 0% |
| CVE-2024-13344 | advance-seat-reservation-management-for-woocommerce (WordPress plugin) | The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in | high | 7.5 | 0% |
| CVE-2025-4204 | ultimate-wordpress-auction-plugin (WordPress plugin) | The Ultimate Auction Pro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and inclu | high | 7.5 | 0% |
| CVE-2023-4308 | user-submitted-posts (WordPress plugin) | The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in ver | high | 7.2 | 0% |
| CVE-2024-10116 | twitter-follow (WordPress plugin) | The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-4370 | wpzoom-elementor-addons (WordPress plugin) | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widg | medium | 6.4 | 0% |
| CVE-2023-6050 | estatik (WordPress plugin) | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outpu | medium | 6.1 | 0% |