Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.07.2, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5292 | acf-extended (WordPress plugin) | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in vers | medium | 6.4 | 0% |
| CVE-2024-4618 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Member widget in all versi | medium | 6.4 | 0% |
| CVE-2024-8363 | share-this-image (WordPress plugin) | The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STI Buttons shortcode in all version | medium | 6.4 | 0% |
| CVE-2025-5096 | tablepress (WordPress plugin) | The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding', | medium | 6.4 | 0% |
| CVE-2023-41661 | smarty (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 version | medium | 5.9 | 0% |
| CVE-2024-45046 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information | medium | 5.4 | 0% |
| CVE-2023-47110 | prestashop/blockreassurance | Any value can be changed in the configuration table by an employee having access to block reassurance module | medium | 5.3 | 0% |
| CVE-2024-13540 | byconsole-woo-order-delivery-time (WordPress plugin) | The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all ver | medium | 5.3 | 0% |
| CVE-2026-35542 | roundcube/roundcubemail | Roundcube: Bypass of remote image blocking via crafted BODY background attribute | medium | 5.3 | 0% |
| CVE-2026-35543 | roundcube/roundcubemail | Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message | medium | 5.3 | 0% |
| CVE-2026-67353 | guzzlehttp/guzzle | Guzzle: Unbounded response cookies risk denial of service | medium | 5.3 | 0% |
| CVE-2025-3428 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'coating_text' parameter in all versions up to, and including, | medium | 4.9 | 0% |
| CVE-2025-3429 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'material_text' parameter in all versions up to, and including, | medium | 4.9 | 0% |
| CVE-2025-3430 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'printer_text' parameter in all versions up to, and including, | medium | 4.9 | 0% |
| CVE-2023-2707 | gappointments (WordPress plugin) | The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2023-5564 | froxlor/froxlor | Cross-site Scripting (XSS) in froxlor/froxlor | medium | 4.8 | 0% |
| CVE-2024-2439 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-10009 | melapress-file-monitor (WordPress plugin) | The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowi | medium | 4.1 | 0% |
| CVE-2024-10710 | yadisk-files (WordPress plugin) | The YaDisk Files WordPress plugin through 1.2.5 does not sanitise and escape some of its settings, which could allow high privilege users su | low | 3.5 | 0% |
| CVE-2026-48806 | twig/twig | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys | medium | 0.0 | 0% |
| CVE-2026-92692 | sulu/sulu | Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) | medium | 0.0 | 0% |
| CVE-2026-85990 | leantime/leantime | Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods | high | 8.8 | 0% |
| CVE-2026-35675 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration | high | 8.2 | 0% |
| CVE-2024-9898 | parallax-image (WordPress plugin) | The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-1106 | shariff-wrapper (WordPress plugin) | The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 6.1 | 0% |
| CVE-2024-34467 | topthink/framework | ThinkPHP Cross-Site Scripting Vulnerability | medium | 6.1 | 0% |
| CVE-2024-4269 | svg-block (WordPress plugin) | The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG w | medium | 6.1 | 0% |
| CVE-2024-47186 | filament/infolists, filament/tables | Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting | medium | 6.1 | 0% |
| CVE-2022-29412 | hermit (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow attackers to delete cache, del | medium | 5.4 | 0% |
| CVE-2024-13539 | aforms-eats (WordPress plugin) | The AForms Eats plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.3.1. This is due the /ven | medium | 5.3 | 0% |
| CVE-2024-6099 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, a | medium | 5.3 | 0% |
| CVE-2024-10638 | product-labels-for-woocommerce-\(sale-badges\) (WordPress plugin) | The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in | medium | 4.1 | 0% |
| CVE-2024-29376 | sylius/sylius | Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book | medium | 0.0 | 0% |
| CVE-2025-59022 | typo3/cms-recycler | TYPO3 CMS Allows Broken Access Control in Recycler Module | high | 0.0 | 0% |
| CVE-2026-54347 | froxlor/froxlor | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover | high | 8.7 | 0% |
| CVE-2024-13654 | zoxpress (WordPress theme) | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a | high | 8.1 | 0% |
| CVE-2025-59943 | thorsten/phpmyfaq | phpMyFAQ duplicate email registration allows multiple accounts with the same email | high | 8.1 | 0% |
| CVE-2024-12024 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_c | high | 7.2 | 0% |
| CVE-2026-104890 | kunstmaan/bundles-cms, kunstmaan/media-bundle | Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote c | high | 7.2 | 0% |
| CVE-2023-22488 | flarum/core | Flarum notifications can leak restricted content | medium | 6.8 | 0% |
| CVE-2024-13594 | simple-downloads-list (WordPress plugin) | The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofix_sdl' shortcode in | medium | 6.5 | 0% |
| CVE-2024-5266 | download-manager (WordPress plugin) | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packa | medium | 6.4 | 0% |
| CVE-2024-9024 | material-design-icons (WordPress plugin) | The Material Design Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mdi-icon shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-45803 | wireui/wireui | Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content | medium | 6.1 | 0% |
| CVE-2024-6076 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.1 | 0% |
| CVE-2024-8740 | getresponse (WordPress plugin) | The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with | medium | 6.1 | 0% |
| CVE-2024-9206 | mas-wp-job-manager-company (WordPress plugin) | The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg wi | medium | 6.1 | 0% |
| CVE-2024-9383 | woo-parcel-pro (WordPress plugin) | The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and in | medium | 6.1 | 0% |
| CVE-2023-4514 | mmm-simple-file-list (WordPress plugin) | The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 0% |
| CVE-2024-3239 | postx (WordPress plugin) | The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block optio | medium | 5.4 | 0% |