Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2280 | better-elementor-addons (WordPress plugin) | The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget link URL values in all versions | medium | 6.4 | 0% |
| CVE-2024-2328 | real-media-library-lite (WordPress plugin) | The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image | medium | 6.4 | 0% |
| CVE-2024-2925 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget | medium | 6.4 | 0% |
| CVE-2024-3267 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_price_list shortcode in all v | medium | 6.4 | 0% |
| CVE-2024-10858 | jetpack (WordPress plugin) | The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed a | medium | 6.1 | 0% |
| CVE-2026-49870 | snipe/snipe-it | Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` | medium | 5.9 | 0% |
| CVE-2024-0691 | filebird (WordPress plugin) | The FileBird plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported folder titles in all versions up to, and includi | medium | 5.5 | 0% |
| CVE-2021-24837 | passter (WordPress plugin) | The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low | medium | 5.4 | 0% |
| CVE-2022-4653 | greenshift (WordPress plugin) | The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a ro | medium | 5.4 | 0% |
| CVE-2025-62416 | bagisto/bagisto | bagisto has Server Side Template Injection (SSTI) in Product Description | medium | 5.1 | 0% |
| CVE-2022-38137 | wp-analytify (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress. | medium | 4.3 | 0% |
| CVE-2024-29885 | silverstripe/reports | Silverstripe Reports are still accessible even when `canView()` returns false | medium | 4.3 | 0% |
| CVE-2025-13785 | yungifez/skuul | Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images | medium | 4.3 | 0% |
| CVE-2026-15089 | drupal/commerce_guest_registration | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-16645 | drupal/photoswipe | The Photoswipe Drupal module provides integration for the widely used [PhotoSwipe lightbox library](https://photoswipe.c | unknown | 0.0 | 0% |
| CVE-2026-46724 | tpwd/ke_search | TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer | medium | 0.0 | 0% |
| CVE-2026-50280 | craftcms/cms | Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check | medium | 0.0 | 0% |
| CVE-2026-73475 | drupal/commerce_paypal | This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the tra | unknown | 0.0 | 0% |
| CVE-2024-6635 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is | high | 7.3 | 0% |
| CVE-2024-13835 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. | high | 7.2 | 0% |
| CVE-2024-3047 | woocommerce-pdf-invoices\&-packing-slips (WordPress plugin) | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and in | high | 7.2 | 0% |
| CVE-2023-41804 | starter-templates (WordPress plugin) | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.Thi | high | 7.1 | 0% |
| CVE-2023-49170 | captainform (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captainform Forms by CaptainForm – For | high | 7.1 | 0% |
| CVE-2023-49187 | adifier (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spoonthemes Adifier - Classified Ads W | high | 7.1 | 0% |
| CVE-2023-6781 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions | medium | 6.4 | 0% |
| CVE-2024-10684 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all vers | medium | 6.1 | 0% |
| CVE-2024-6339 | phlox (WordPress theme) | The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including | medium | 6.1 | 0% |
| CVE-2024-8713 | kodex-posts-likes (WordPress plugin) | The Kodex Posts likes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria | medium | 6.1 | 0% |
| CVE-2024-8730 | exit-notifier (WordPress plugin) | The Exit Notifier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate e | medium | 6.1 | 0% |
| CVE-2024-8731 | leira-cron-jobs (WordPress plugin) | The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escap | medium | 6.1 | 0% |
| CVE-2024-8737 | pdf-thumbnail-generator (WordPress plugin) | The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without app | medium | 6.1 | 0% |
| CVE-2023-1067 | pimcore/pimcore | Pimcore vulnerable to Cross-site Scripting | medium | 5.4 | 0% |
| CVE-2023-1429 | pimcore/pimcore | Cross-site Scripting (XSS) in Document Types | medium | 5.4 | 0% |
| CVE-2023-6141 | essential-real-estate (WordPress plugin) | The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other thing | medium | 5.4 | 0% |
| CVE-2023-7084 | voting-record (WordPress plugin) | The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such | medium | 5.4 | 0% |
| CVE-2024-10473 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the | medium | 5.4 | 0% |
| CVE-2024-10896 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high pri | medium | 5.4 | 0% |
| CVE-2024-2402 | better-comments (WordPress plugin) | The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 5.4 | 0% |
| CVE-2024-2583 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes befo | medium | 5.4 | 0% |
| CVE-2024-5074 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 5.4 | 0% |
| CVE-2023-2328 | pimcore/pimcore | Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition | medium | 5.2 | 0% |
| CVE-2024-5802 | url-shortener (WordPress plugin) | The URL Shortener by Myhop WordPress plugin through 1.0.17 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-9538 | woolentor-addons (WordPress plugin) | The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'ren | medium | 4.3 | 0% |
| CVE-2023-2327 | pimcore/pimcore | Cross-site Scripting (XSS) in pimcore via DataObject Class date fields | medium | 4.0 | 0% |
| CVE-2024-7300 | bolt/bolt | Bolt CMS Cross-site Scripting vulnerability | low | 3.5 | 0% |
| CVE-2026-120328 | mediaessenz/mail | TYPO3-EXT-SA-2026-037: Information Disclosure in extension "Mail" (mail) | unknown | 0.0 | 0% |
| CVE-2026-49279 | wwbn/avideo | WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) | high | 0.0 | 0% |
| CVE-2026-33717 | wwbn/avideo | AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL | high | 8.8 | 0% |
| CVE-2026-47198 | paymenter/paymenter | Paymenter has URL parameter injection that bypasses paid plan limits at checkout | high | 8.5 | 0% |
| CVE-2024-7624 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. | high | 8.1 | 0% |