Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.07.2, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10284 | ce21-suite (WordPress plugin) | The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded | critical | 9.8 | 0% |
| CVE-2023-0820 | user-role (WordPress plugin) | The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to | high | 8.8 | 0% |
| CVE-2025-6783 | gozen-forms (WordPress plugin) | The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions u | high | 7.5 | 0% |
| CVE-2022-3208 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin c | medium | 6.5 | 0% |
| CVE-2024-9829 | download-plugin (WordPress plugin) | The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwap_handl | medium | 6.5 | 0% |
| CVE-2025-46556 | mantisbt/mantisbt | MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length | medium | 6.5 | 0% |
| CVE-2024-4615 | elespare (WordPress plugin) | The Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: | medium | 6.4 | 0% |
| CVE-2024-8681 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Grid widget in all | medium | 6.4 | 0% |
| CVE-2024-8991 | osm (WordPress plugin) | The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's osm_map and osm_map_v3 shortcodes | medium | 6.4 | 0% |
| CVE-2024-10078 | easy-post-types (WordPress plugin) | The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability | medium | 6.3 | 0% |
| CVE-2023-6981 | wp-sms (WordPress plugin) | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection | medium | 6.1 | 0% |
| CVE-2024-12177 | ai-image-alt-text-generator-for-wp (WordPress plugin) | The Ai Image Alt Text Generator for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all | medium | 6.1 | 0% |
| CVE-2024-12299 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, | medium | 6.1 | 0% |
| CVE-2021-3683 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 5.4 | 0% |
| CVE-2025-24428 | magento/community-edition, magento/project-community-edition | Magento stored Cross-Site Scripting (XSS) vulnerability | medium | 5.4 | 0% |
| CVE-2024-0237 | eventon (WordPress plugin) | The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing u | medium | 5.3 | 0% |
| CVE-2024-1798 | tutor-lms-migration-tool (WordPress plugin) | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tu | medium | 5.3 | 0% |
| CVE-2025-3427 | 3dprint-lite (WordPress plugin) | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'infill_text' parameter in all versions up to, and including, 2 | medium | 4.9 | 0% |
| CVE-2024-47528 | librenms/librenms | LibreNMS vulnerable to Stored Cross-site Scripting via File Upload | medium | 4.8 | 0% |
| CVE-2021-24172 | vm-backups (WordPress plugin) | The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as | medium | 4.3 | 0% |
| CVE-2024-9583 | wp-rss-aggregator (WordPress plugin) | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functi | medium | 4.3 | 0% |
| CVE-2026-54492 | phanan/koel | Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation | medium | 4.3 | 0% |
| CVE-2026-108099 | drupal/entity_list | The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution | unknown | 0.0 | 0% |
| CVE-2026-96365 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2025-60880 | bagisto/bagisto | Bagisto is vulnerable to XSS through Admin Panel's product creation path | high | 8.3 | 0% |
| CVE-2025-25227 | joomla/joomla-cms | Joomla CMS Multi-Factor Authentication Bypass | high | 7.5 | 0% |
| CVE-2022-1830 | amazon-einzeltitellinks (WordPress plugin) | The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow a | medium | 6.5 | 0% |
| CVE-2022-1831 | wplite (WordPress plugin) | The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make | medium | 6.5 | 0% |
| CVE-2024-1123 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a miss | medium | 6.5 | 0% |
| CVE-2023-5125 | formget-contact-form (WordPress plugin) | The Contact Form by FormGet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formget' shortcode in versions up to, and | medium | 6.4 | 0% |
| CVE-2023-5232 | font-awesome-more-icons (WordPress plugin) | The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and in | medium | 6.4 | 0% |
| CVE-2023-5233 | font-awesome-integration (WordPress plugin) | The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, a | medium | 6.4 | 0% |
| CVE-2024-4666 | borderless (WordPress plugin) | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site | medium | 6.4 | 0% |
| CVE-2024-8657 | garden-gnome-package (WordPress plugin) | The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ggpkg shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-9851 | tour-operator (WordPress plugin) | The LSX Tour Operator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2024-47847 | mediawiki/cargo | Mediawiki Cargo extension vulnerable to Cross-site Scripting | medium | 6.1 | 0% |
| CVE-2024-9777 | ashe (WordPress theme) | The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on | medium | 6.1 | 0% |
| CVE-2022-29450 | admin-management-xtended (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress. | medium | 5.4 | 0% |
| CVE-2023-44383 | october/system | October CMS stored XSS by authenticated backend user with improper configuration | medium | 5.4 | 0% |
| CVE-2023-4025 | radio-player (WordPress plugin) | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_pla | medium | 5.3 | 0% |
| CVE-2023-4027 | radio-player (WordPress plugin) | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_set | medium | 5.3 | 0% |
| CVE-2024-11282 | content-protector (WordPress plugin) | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to | medium | 5.3 | 0% |
| CVE-2024-12427 | multi-step-form (WordPress plugin) | The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_uploa | medium | 5.3 | 0% |
| CVE-2024-3679 | premium-seo-pack (WordPress plugin) | The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi | medium | 5.3 | 0% |
| CVE-2024-5639 | metronet-profile-picture (WordPress plugin) | The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 | medium | 4.3 | 0% |
| CVE-2024-6824 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capabilit | medium | 4.3 | 0% |
| CVE-2025-7717 | drupal/file_download | The File Download enables you to allow users to download file and image entities directly using a custom field formatter | unknown | 0.0 | 0% |
| CVE-2026-25496 | craftcms/cms | Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields | medium | 0.0 | 0% |
| CVE-2023-28335 | moodle/moodle | Moodle vulnerable to Cross-site Request Forgery | high | 8.8 | 0% |
| CVE-2024-9195 | whmcs-client-area (WordPress plugin) | The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalati | high | 8.8 | 0% |