Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.07.2, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-96355 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurabl | unknown | 0.0 | 0% |
| CVE-2025-53093 | starcitizentools/tabber-neue | TabberNeue vulnerable to Stored XSS through wikitext | high | 8.6 | 0% |
| CVE-2024-54149 | winter/wn-cms-module | Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion | high | 8.4 | 0% |
| CVE-2024-13344 | advance-seat-reservation-management-for-woocommerce (WordPress plugin) | The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in | high | 7.5 | 0% |
| CVE-2025-4204 | ultimate-wordpress-auction-plugin (WordPress plugin) | The Ultimate Auction Pro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and inclu | high | 7.5 | 0% |
| CVE-2023-4308 | user-submitted-posts (WordPress plugin) | The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in ver | high | 7.2 | 0% |
| CVE-2024-10116 | twitter-follow (WordPress plugin) | The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-4370 | wpzoom-elementor-addons (WordPress plugin) | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widg | medium | 6.4 | 0% |
| CVE-2023-6050 | estatik (WordPress plugin) | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outpu | medium | 6.1 | 0% |
| CVE-2023-6161 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2023-6166 | quiz-maker (WordPress plugin) | The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cro | medium | 6.1 | 0% |
| CVE-2023-6268 | json-content-importer (WordPress plugin) | The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page | medium | 6.1 | 0% |
| CVE-2023-7170 | rsvp-events (WordPress plugin) | The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading t | medium | 6.1 | 0% |
| CVE-2024-2278 | woocommerce-product-filter (WordPress plugin) | Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users suc | medium | 6.1 | 0% |
| CVE-2024-2729 | otter-blocks (WordPress plugin) | The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final | medium | 6.1 | 0% |
| CVE-2024-2870 | swift-framework (WordPress plugin) | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape a parameter before outputting it back in the page | medium | 6.1 | 0% |
| CVE-2020-36702 | spectra (WordPress plugin) | The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14 | medium | 5.5 | 0% |
| CVE-2023-6067 | user-profile-avatar (WordPress plugin) | The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2024-12276 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | 0% |
| CVE-2024-45932 | krayin/laravel-crm | Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name | medium | 4.8 | 0% |
| CVE-2026-42841 | getgrav/grav | Grav CMS vulnerable to stored XSS via Markdown media attribute() action | medium | 4.8 | 0% |
| CVE-2024-1977 | restaurant-solutions---checklist (WordPress plugin) | The Restaurant Solutions – Checklist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Checklist points in version 1 | medium | 4.4 | 0% |
| CVE-2023-1704 | pimcore/pimcore | pimcore is vulnerable to cross-site scripting in translate module | medium | 0.0 | 0% |
| CVE-2021-4445 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. Thi | medium | 6.5 | 0% |
| CVE-2024-1572 | wp-ulike (WordPress plugin) | The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_ulike' shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-3923 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_target parameter | medium | 6.4 | 0% |
| CVE-2024-4107 | website-builder (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2023-22729 | silverstripe/framework | Open redirect vulnerability on CMSSecurity relogin screen | medium | 6.1 | 0% |
| CVE-2023-2407 | event-registration-calendar-by-vcita (WordPress plugin), online-payments---get-paid-with-paypal\,-square-\&-stripe (WordPress plugin) | The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & S | medium | 6.1 | 0% |
| CVE-2023-0313 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2023-2342 | pimcore/pimcore | Cross-site Scripting (XSS) in Website Settings name field | medium | 5.4 | 0% |
| CVE-2024-1055 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 5.4 | 0% |
| CVE-2023-44401 | silverstripe/graphql | View permissions are bypassed for paginated lists of ORM data | medium | 5.3 | 0% |
| CVE-2024-13904 | platformly-for-woocommerce (WordPress plugin) | The Platform.ly for WooCommerce plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including | medium | 5.3 | 0% |
| CVE-2024-6010 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This i | medium | 5.3 | 0% |
| CVE-2022-3609 | getyourguide-ticketing (WordPress plugin) | The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2022-3906 | easy-form-builder (WordPress plugin) | The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2022-40968 | 2kb-amazon-affiliates-store (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress. | medium | 4.8 | 0% |
| CVE-2024-39416 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization leads to Security feature bypass | medium | 4.3 | 0% |
| CVE-2024-10098 | applyonline---application-form-builder-and-manager (WordPress plugin) | The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated user | low | 2.7 | 0% |
| CVE-2024-13296 | drupal/mailjet | This module for Drupal provides complete control of Email settings with Drupal and Mailjet. In certain cases the module | unknown | 0.0 | 0% |
| CVE-2025-7954 | shopware/platform | Shopware race condition bypasses voucher restrictions | medium | 0.0 | 0% |
| CVE-2026-40607 | mantisbt/mantisbt | MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column | high | 0.0 | 0% |
| CVE-2026-77146 | in2code/femanager | TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager) | unknown | 0.0 | 0% |
| CVE-2024-2376 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |
| CVE-2025-1970 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inclu | high | 7.6 | 0% |
| CVE-2025-24018 | yeswiki/yeswiki | Authenticated Stored XSS in YesWiki | high | 7.6 | 0% |
| CVE-2025-3431 | zoomsounds (WordPress plugin) | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, | high | 7.5 | 0% |
| CVE-2024-4279 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Cou | medium | 6.5 | 0% |
| CVE-2024-43257 | leopard (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects L | medium | 6.5 | 0% |