Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.07.2, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6732 | ultimate-maps (WordPress plugin) | The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-1401 | profile-box-shortcode-and-widget (WordPress plugin) | The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2023-43663 | prestashop/prestashop | PrestaShop allows users to uninstall modules from backoffice, even with low rights | medium | 4.3 | 0% |
| CVE-2023-3303 | admidio/admidio | Admidio Improper Access Control vulnerability | low | 3.5 | 0% |
| CVE-2025-4416 | drupal/events_log_track | The Events Log Track module enables you to log specific events on a Drupal site. The module doesn't sufficiently mitiga | unknown | 0.0 | 0% |
| CVE-2026-18259 | drupal/tca | The Token Content Access module enables site administrators to provide access to content using access tokens. The modul | unknown | 0.0 | 0% |
| CVE-2023-6373 | artplacer-widget (WordPress plugin) | The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to | high | 8.8 | 0% |
| CVE-2025-27773 | simplesamlphp/saml2, simplesamlphp/saml2-legacy | The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding | high | 8.6 | 0% |
| CVE-2026-54493 | phanan/koel | Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations | high | 7.7 | 0% |
| CVE-2026-76089 | verbb/formie | Formie: Missing authorization on sent notification resend modal exposes submission PII | high | 7.7 | 0% |
| CVE-2020-36840 | mp-timetable (WordPress plugin) | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check o | high | 7.3 | 0% |
| CVE-2024-11730 | kivicare-clinic-management-system (WordPress plugin) | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of th | medium | 6.5 | 0% |
| CVE-2024-1559 | link-library (WordPress plugin) | The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in all versions up to, | medium | 6.5 | 0% |
| CVE-2026-64662 | statamic/cms | Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries | medium | 6.5 | 0% |
| CVE-2018-5478 | contao/core | Contao Cross-site Scripting vulnerabililty | medium | 6.1 | 0% |
| CVE-2024-3886 | tagdiv-composer (WordPress plugin) | The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions u | medium | 6.1 | 0% |
| CVE-2023-3304 | admidio/admidio | Admidio Improper Access Control vulnerability | medium | 5.4 | 0% |
| CVE-2025-23210 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters | medium | 5.4 | 0% |
| CVE-2024-6687 | ctt-expresso-para-woocommerce (WordPress plugin) | The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3 | medium | 5.3 | 0% |
| CVE-2026-44583 | paymenter/paymenter | Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module | medium | 5.3 | 0% |
| CVE-2025-66303 | getgrav/grav | Grav is vulnerable to a DOS on the admin panel | medium | 4.9 | 0% |
| CVE-2023-1312 | pimcore/pimcore | pimcore is vulnerable to cross-site scripting | medium | 4.8 | 0% |
| CVE-2024-3986 | sportspress (WordPress plugin) | The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-13900 | head\,-footer\,-and-post-injections (WordPress plugin) | The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. T | medium | 4.1 | 0% |
| CVE-2024-13256 | drupal/email_contact | The Email Contact module provides email field display formatters that can display the field as a link to the contact for | unknown | 0.0 | 0% |
| CVE-2024-2125 | envialosimple-email-marketing-y-newsletters-gratis (WordPress plugin) | The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | high | 8.8 | 0% |
| CVE-2025-67848 | moodle/moodle | Moodle authentication bypass vulnerability | high | 8.1 | 0% |
| CVE-2024-49764 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php | high | 7.5 | 0% |
| CVE-2024-50350 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php | high | 7.5 | 0% |
| CVE-2026-41231 | froxlor/froxlor | Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron | high | 7.5 | 0% |
| CVE-2024-56408 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file | high | 7.1 | 0% |
| CVE-2023-25040 | shortcodes-ultimate (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugi | medium | 6.5 | 0% |
| CVE-2025-3874 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi | medium | 6.5 | 0% |
| CVE-2024-11829 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-1396 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ para | medium | 6.4 | 0% |
| CVE-2024-9023 | wp-webauthn (WordPress plugin) | The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwa_login_form shortcode in all versions | medium | 6.4 | 0% |
| CVE-2023-4642 | kk-star-ratings (WordPress plugin) | The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple times on a poll due | medium | 5.9 | 0% |
| CVE-2024-39680 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up t | medium | 5.4 | 0% |
| CVE-2024-39681 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up t | medium | 5.4 | 0% |
| CVE-2024-45691 | moodle/moodle | Moodle Lesson activity password bypass through PHP loose comparison | medium | 5.4 | 0% |
| CVE-2024-10517 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 | medium | 4.8 | 0% |
| CVE-2024-10518 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 | medium | 4.8 | 0% |
| CVE-2024-3112 | quotes-and-tips (WordPress plugin) | The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege use | medium | 4.8 | 0% |
| CVE-2019-16107 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2024-10329 | ultimate-bootstrap-elements-for-elementor (WordPress plugin) | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an | medium | 4.3 | 0% |
| CVE-2024-13783 | formcraft (WordPress plugin) | The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in a | medium | 4.3 | 0% |
| CVE-2024-7417 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2024-8801 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3. | medium | 4.3 | 0% |
| CVE-2026-48016 | shopware/core, shopware/platform | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment | medium | 4.3 | 0% |
| CVE-2024-55634 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. | medium | 0.0 | 0% |