Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.07.2, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2539 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget '_id' attributes in all versio | medium | 6.4 | 0% |
| CVE-2024-5215 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all ve | medium | 6.4 | 0% |
| CVE-2021-3932 | area17/twill | twill is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.3 | 0% |
| CVE-2023-31144 | craftcms/cms | craftcms/cms vulnerable to cross site scripting in RSS feed widget | medium | 6.1 | 0% |
| CVE-2023-6027 | elijaa/phpmemcacheadmin | PHPMemcachedAdmin vulnerable to cross-site scripting (XSS) via improper encoding | medium | 6.1 | 0% |
| CVE-2024-50637 | unopim/unopim | UnoPim Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2023-6530 | tj-shortcodes (WordPress plugin) | The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2023-6742 | envira-gallery-lite (WordPress plugin) | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an im | medium | 4.3 | 0% |
| CVE-2024-1686 | woo-thank-you-page-customizer (WordPress plugin) | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all ver | medium | 4.3 | 0% |
| CVE-2024-1771 | total (WordPress theme) | The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sectio | medium | 4.3 | 0% |
| CVE-2024-1870 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ca | medium | 4.3 | 0% |
| CVE-2025-12918 | yungifez/skuul | Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice | low | 3.1 | 0% |
| CVE-2026-24416 | devcode-it/openstamanager | OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module | high | 0.0 | 0% |
| CVE-2026-24417 | devcode-it/openstamanager | OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service | high | 0.0 | 0% |
| CVE-2026-32261 | craftcms/webhooks | RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin | high | 0.0 | 0% |
| CVE-2026-77134 | in2code/femanager | TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager) | unknown | 0.0 | 0% |
| CVE-2026-77135 | in2code/femanager | TYPO3-EXT-SA-2026-024: Information Disclosure in extension "femanager" (femanager) | unknown | 0.0 | 0% |
| CVE-2026-77140 | jweiland/telephonedirectory | TYPO3-EXT-SA-2026-018: Broken Access Control in extension "Telephone Directory" (telephonedirectory) | unknown | 0.0 | 0% |
| CVE-2026-77141 | jweiland/clubdirectory | TYPO3-EXT-SA-2026-019: Broken Access Control in extension "Club Directory" (clubdirectory) | unknown | 0.0 | 0% |
| CVE-2026-77142 | jweiland/yellowpages2 | TYPO3-EXT-SA-2026-020: Broken Access Control in extension "Industry Directory" (yellowpages2) | unknown | 0.0 | 0% |
| CVE-2026-77143 | jweiland/pforum | TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum) | unknown | 0.0 | 0% |
| CVE-2024-6522 | modern-events-calendar (WordPress plugin), modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 vi | high | 8.5 | 0% |
| CVE-2021-3734 | yourls/yourls | Improper Restriction of Rendered UI Layers or Frames in yourls | medium | 6.5 | 0% |
| CVE-2023-5295 | facebook-comment-by-vivacity (WordPress plugin) | The Comments by Startbit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vivafbcomment' shortcode in versions up to, | medium | 6.4 | 0% |
| CVE-2023-7071 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 0% |
| CVE-2024-2128 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-2256 | oik (WordPress plugin) | The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes such as bw_contact_button and bw_butto | medium | 6.4 | 0% |
| CVE-2024-2399 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions | medium | 6.4 | 0% |
| CVE-2024-1589 | sendpress (WordPress plugin) | The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privi | medium | 6.1 | 0% |
| CVE-2024-6223 | send-email-only-on-reply-to-my-comment (WordPress plugin) | The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back | medium | 6.1 | 0% |
| CVE-2024-2118 | social-media-share-buttons-\&-social-sharing-icons (WordPress plugin) | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which | medium | 5.9 | 0% |
| CVE-2022-25599 | spiffy-calendar (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4. | medium | 5.4 | 0% |
| CVE-2023-6165 | restrict-usernames-emails-characters (WordPress plugin) | The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow | medium | 4.8 | 0% |
| CVE-2023-1602 | shorten-url (WordPress plugin) | The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input saniti | medium | 4.4 | 0% |
| CVE-2021-3729 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2023-6384 | user-profile-avatar (WordPress plugin) | The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update ar | medium | 4.3 | 0% |
| CVE-2023-6843 | easy.jobs (WordPress plugin) | The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 d | medium | 4.3 | 0% |
| CVE-2024-45120 | magento/community-edition | Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | medium | 4.3 | 0% |
| CVE-2024-26481 | getkirby/cms | Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field | medium | 4.2 | 0% |
| CVE-2023-37867 | yet-another-stars-rating (WordPress plugin) | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordP | low | 3.7 | 0% |
| CVE-2025-66298 | getgrav/grav | Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms | high | 0.0 | 0% |
| CVE-2022-3899 | 3dprint (WordPress plugin) | The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with | high | 8.1 | 0% |
| CVE-2026-54087 | easycorp/easyadmin-bundle | EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField | high | 7.6 | 0% |
| CVE-2025-62399 | moodle/moodle | Moodle vulnerable to brute-force password guesses | high | 7.5 | 0% |
| CVE-2023-5615 | skype-online-status (WordPress plugin) | The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all | medium | 6.4 | 0% |
| CVE-2023-6747 | foogallery (WordPress plugin) | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes i | medium | 6.4 | 0% |
| CVE-2024-0698 | easyappointments (WordPress plugin) | The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-1348 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parame | medium | 6.4 | 0% |
| CVE-2024-1357 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_tim | medium | 6.4 | 0% |
| CVE-2024-1533 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML Element in | medium | 6.4 | 0% |