Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9650 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip’ parameter in all versions up to, and | medium | 6.5 | 0% |
| CVE-2024-9820 | two-factor-login-telegram (WordPress plugin) | The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This | medium | 6.5 | 0% |
| CVE-2023-4963 | ws-facebook-likebox (WordPress plugin) | The WS Facebook Like Box Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in ver | medium | 6.4 | 0% |
| CVE-2023-5085 | advanced-menu-widget (WordPress plugin) | The Advanced Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'advMenu' shortcode in versions up to, and in | medium | 6.4 | 0% |
| CVE-2024-3333 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attributes of widgets in al | medium | 6.4 | 0% |
| CVE-2023-50828 | ultimate-dashboard (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Vongries Ultimate Dashboard – Cu | medium | 5.9 | 0% |
| CVE-2024-0619 | payflex-payment-gateway (WordPress plugin) | The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 5.3 | 0% |
| CVE-2024-13428 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 5.3 | 0% |
| CVE-2024-4858 | testimonials-carousel-elementor (WordPress plugin) | The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.3 | 0% |
| CVE-2024-7447 | funnelforms-free (WordPress plugin) | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to un | medium | 5.3 | 0% |
| CVE-2023-1517 | pimcore/pimcore | Pimcore has Cross site Scripting vulnerability in Schedule tab of Documents | medium | 4.8 | 0% |
| CVE-2023-4925 | easy-forms-for-mailchimp (WordPress plugin) | The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privi | medium | 4.8 | 0% |
| CVE-2023-5943 | wp-adv-quiz (WordPress plugin) | The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2023-5956 | wp-adv-quiz (WordPress plugin) | The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-6037 | wp-tripadvisor-review-slider (WordPress plugin) | The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2023-6163 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2023-6290 | seopress (WordPress plugin) | The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as a | medium | 4.8 | 0% |
| CVE-2023-6626 | product-enquiry-for-woocommerce (WordPress plugin) | The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high pr | medium | 4.8 | 0% |
| CVE-2023-6941 | official-opt-in-forms (WordPress plugin) | The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2023-7115 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2024-10471 | everest-forms (WordPress plugin) | The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-10510 | adbuddy\+-\(adblocker-detection\) (WordPress plugin) | The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which | medium | 4.8 | 0% |
| CVE-2024-10704 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-2263 | woocommerce-product-filter (WordPress plugin) | Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflecte | medium | 4.8 | 0% |
| CVE-2024-7132 | coblocks (WordPress plugin) | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which coul | medium | 4.8 | 0% |
| CVE-2023-7198 | wp-dashboard-notes (WordPress plugin) | The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authe | medium | 4.3 | 0% |
| CVE-2024-5053 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized | medium | 4.2 | 0% |
| CVE-2025-1972 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valida | low | 2.7 | 0% |
| CVE-2026-47732 | twig/twig | Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points | high | 0.0 | 0% |
| CVE-2025-61682 | mediawiki/semantic-media-wiki | Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes | high | 8.6 | 0% |
| CVE-2024-34001 | moodle/moodle | Moodle CSRF risk in admin preset tool management of presets | high | 8.4 | 0% |
| CVE-2022-3763 | booster-for-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for Woo | high | 8.1 | 0% |
| CVE-2024-2867 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2024-4479 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordio | medium | 6.4 | 0% |
| CVE-2024-4619 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting vi | medium | 6.4 | 0% |
| CVE-2024-5757 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url attribute within the pl | medium | 6.4 | 0% |
| CVE-2024-5787 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 6.4 | 0% |
| CVE-2021-4335 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a mi | medium | 6.3 | 0% |
| CVE-2023-3999 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX ca | medium | 6.3 | 0% |
| CVE-2022-41136 | shortcodes-ultimate (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugi | medium | 6.1 | 0% |
| CVE-2022-44741 | testimonial-slider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 o | medium | 6.1 | 0% |
| CVE-2023-6621 | post-smtp (WordPress plugin) | The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-10683 | contact-form-7-paypal-add-on (WordPress plugin) | The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query | medium | 6.1 | 0% |
| CVE-2024-9219 | share-button (WordPress plugin) | The WordPress Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with | medium | 6.1 | 0% |
| CVE-2024-9609 | learnpress-import-export (WordPress plugin) | The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via t | medium | 6.1 | 0% |
| CVE-2024-9896 | bbp-core (WordPress plugin) | The BBP Core – Expand bbPress powered forums with useful features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due t | medium | 6.1 | 0% |
| CVE-2025-2109 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions | medium | 5.8 | 0% |
| CVE-2023-1117 | pimcore/pimcore | Pimcore vulnerable to Cross Site Scripting in image/video thumbnail config | medium | 5.4 | 0% |
| CVE-2024-1333 | responsive-pricing-table (WordPress plugin) | The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting | medium | 5.4 | 0% |
| CVE-2024-2404 | better-comments (WordPress plugin) | The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users s | medium | 5.4 | 0% |