Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6134 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the pag | medium | 5.4 | 0% |
| CVE-2026-35540 | roundcube/roundcubemail | Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages | medium | 5.4 | 0% |
| CVE-2024-10535 | video-wc-gallery (WordPress plugin) | The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.3 | 0% |
| CVE-2024-9528 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 4.9 | 0% |
| CVE-2022-25576 | anchorcms/anchor-cms | Cross-Site Request Forgery in Anchor CMS | medium | 4.5 | 0% |
| CVE-2021-36852 | wp-hotel-booking (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress. | medium | 4.3 | 0% |
| CVE-2024-8199 | reviews-feed (WordPress plugin) | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2024-9530 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 | medium | 4.3 | 0% |
| CVE-2024-13922 | order-export-\&-order-import-for-woocommerce (WordPress plugin) | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path | low | 2.7 | 0% |
| CVE-2026-25878 | frosh/adminer-platform | FroshAdminer Adminer UI is accessible without admin session | medium | 0.0 | 0% |
| CVE-2026-34571 | ci4-cms-erp/ci4ms | CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromi | critical | 9.9 | 0% |
| CVE-2025-1305 | newsblogger (WordPress theme) | The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due t | high | 8.8 | 0% |
| CVE-2025-31694 | drupal/tfa | This module enables you to allow and/or require users to use a second authentication method in addition to password auth | high | 8.1 | 0% |
| CVE-2024-5071 | bookster (WordPress plugin) | The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulat | medium | 6.5 | 0% |
| CVE-2023-7070 | email-encoder-bundle (WordPress plugin) | The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-3718 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all | medium | 6.4 | 0% |
| CVE-2024-4482 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-7122 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-7895 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in al | medium | 6.4 | 0% |
| CVE-2021-4458 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_p | medium | 5.9 | 0% |
| CVE-2023-5506 | imagemapper (WordPress plugin) | The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area | medium | 5.4 | 0% |
| CVE-2024-13209 | redaxo/source | Stored XSS in REDAXO | medium | 5.4 | 0% |
| CVE-2024-8500 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters | medium | 5.4 | 0% |
| CVE-2024-0596 | awesome-support (WordPress plugin) | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing | medium | 5.3 | 0% |
| CVE-2024-22407 | shopware/core, shopware/platform | Broken Access Control order API in Shopware | medium | 4.9 | 0% |
| CVE-2024-0625 | wpfront-notification-bar (WordPress plugin) | The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-options[cus | medium | 4.4 | 0% |
| CVE-2024-6757 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versio | medium | 4.3 | 0% |
| CVE-2024-9540 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2024-1245 | concrete5/concrete5 | Concrete CMS vulnerable to stored XSS in file tags and description attributes | low | 2.4 | 0% |
| CVE-2026-6366 | drupal/core | Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists | medium | 6.6 | 0% |
| CVE-2024-0334 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attribute of a link in several Elemen | medium | 6.4 | 0% |
| CVE-2024-0586 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-1278 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th | medium | 6.4 | 0% |
| CVE-2024-1293 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the embedded media custom block in all versio | medium | 6.4 | 0% |
| CVE-2024-13323 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-1363 | easy-accordion-free (WordPress plugin) | The Easy Accordion – Best Accordion FAQ Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acco | medium | 6.4 | 0% |
| CVE-2024-1684 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-1948 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-1996 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's IHover widget link in all versions | medium | 6.4 | 0% |
| CVE-2022-1418 | social-stickers (WordPress plugin) | The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does no | medium | 6.1 | 0% |
| CVE-2024-0585 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 5.4 | 0% |
| CVE-2024-0871 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Widget 'fl_builder_data[node_preview][link | medium | 5.4 | 0% |
| CVE-2024-3939 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 5.4 | 0% |
| CVE-2024-4094 | simple-share-buttons-adder (WordPress plugin) | The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privi | medium | 5.4 | 0% |
| CVE-2024-4372 | carousel-slider (WordPress plugin) | The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low | medium | 5.4 | 0% |
| CVE-2024-13844 | post-smtp (WordPress plugin) | The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, | medium | 4.9 | 0% |
| CVE-2026-57961 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has Potential Authenticated Path Traversal in PDF Export | medium | 4.9 | 0% |
| CVE-2024-3261 | strong-testimonials (WordPress plugin) | The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them ba | medium | 4.8 | 0% |
| CVE-2024-5169 | video-widget (WordPress plugin) | The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-6724 | magic-post-thumbnail (WordPress plugin) | The Generate Images WordPress plugin before 5.2.8 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |