Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6888 | secure-copy-content-protection-and-content-locking (WordPress plugin) | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, whic | medium | 4.8 | 0% |
| CVE-2024-9600 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2021-3976 | kevinpapst/kimai2 | Cross-site Scripting in kimai2 | medium | 4.3 | 0% |
| CVE-2024-8009 | sensei-lms (WordPress plugin) | The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page | medium | 4.3 | 0% |
| CVE-2025-24430 | magento/community-edition, magento/project-community-edition | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | low | 3.7 | 0% |
| CVE-2025-24432 | magento/community-edition, magento/project-community-edition | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | low | 3.7 | 0% |
| CVE-2026-24418 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module | high | 0.0 | 0% |
| CVE-2024-34008 | moodle/moodle | Moodle CSRF risk in analytics management of models | high | 8.8 | 0% |
| CVE-2022-23556 | codeigniter4/framework | CodeIgniter4 allows spoofing of IP address when using proxy | high | 7.0 | 0% |
| CVE-2026-33486 | roadiz/documents | Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents | medium | 6.8 | 0% |
| CVE-2023-5357 | instagram-for-wordpress (WordPress plugin) | The Instagram for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and includin | medium | 6.4 | 0% |
| CVE-2024-9502 | master-addons (WordPress plugin) | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnera | medium | 6.4 | 0% |
| CVE-2024-4752 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 5.9 | 0% |
| CVE-2021-24703 | download-plugin (WordPress plugin) | The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowin | medium | 5.7 | 0% |
| CVE-2024-0659 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Si | medium | 5.5 | 0% |
| CVE-2023-2517 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including | medium | 5.4 | 0% |
| CVE-2023-33736 | dcat/laravel-admin | Dcat-Admin vulnerable to Stored Cross-site Scripting | medium | 5.4 | 0% |
| CVE-2024-1487 | contest-gallery (WordPress plugin) | The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users wi | medium | 5.4 | 0% |
| CVE-2024-5861 | wp-easy-pay (WordPress plugin) | The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability che | medium | 5.3 | 0% |
| CVE-2026-24749 | silverstripe/assets | Silverstripe Assets Module has a DBFile::getURL() permission bypass | medium | 5.3 | 0% |
| CVE-2023-1197 | uvdesk/community-skeleton | uvdesk/community-skeleton vulnerable to Stored Cross-site Scripting | medium | 4.8 | 0% |
| CVE-2024-5172 | expert-invoice (WordPress plugin) | The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-7955 | starbox (WordPress plugin) | The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-0898 | chat-bubble (WordPress plugin) | The Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back plugin for WordPress is vulnerable to | medium | 4.4 | 0% |
| CVE-2023-3947 | video-conferencing-with-zoom-api (WordPress plugin) | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the | low | 3.7 | 0% |
| CVE-2024-7512 | concrete5/concrete5 | Concrete CMS vulnerable to Stored Cross-site Scripting | low | 2.0 | 0% |
| CVE-2021-46875 | ezsystems/ezplatform-kernel, ezsystems/ezpublish-kernel | Cross-site scripting in eZ Platform Kernel | high | 0.0 | 0% |
| CVE-2026-25493 | craftcms/cms | Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect | medium | 0.0 | 0% |
| CVE-2026-25494 | craftcms/cms | Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation | medium | 0.0 | 0% |
| CVE-2026-31858 | craftcms/cms | CraftCMS's `ElementSearchController` Affected by Blind SQL Injection | high | 0.0 | 0% |
| CVE-2026-32935 | phpseclib/phpseclib | phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack | high | 0.0 | 0% |
| CVE-2024-30201 | wp-smart-import (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows | high | 7.1 | 0% |
| CVE-2024-32149 | jobs-for-wordpress (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Jobs for WordPress allows Re | high | 7.1 | 0% |
| CVE-2023-45607 | wordpress-popular-posts (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions. | medium | 6.5 | 0% |
| CVE-2023-7268 | artplacer-widget (WordPress plugin) | The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authentic | medium | 6.5 | 0% |
| CVE-2024-10548 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via | medium | 6.5 | 0% |
| CVE-2024-45689 | moodle/moodle | Moodle allows users to retrieve information they did not have permission to access | medium | 6.5 | 0% |
| CVE-2024-1046 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2024-0821 | cost-of-goods-for-woocommerce (WordPress plugin) | The Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting | medium | 6.1 | 0% |
| CVE-2024-10879 | forumwp (WordPress plugin) | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg | medium | 6.1 | 0% |
| CVE-2024-3547 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting | medium | 6.1 | 0% |
| CVE-2024-47617 | sulu/sulu | Injection of arbitrary HTML/JavaScript code through the media download URL | medium | 6.1 | 0% |
| CVE-2021-36891 | gallery-by-supsystic (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin setti | medium | 5.4 | 0% |
| CVE-2024-9697 | social-rocket (WordPress plugin) | The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 5.3 | 0% |
| CVE-2026-30878 | baserproject/basercms | baserCMS has Mail Form Acceptance Bypass via Public API | medium | 5.3 | 0% |
| CVE-2026-33761 | wwbn/avideo | AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings | medium | 5.3 | 0% |
| CVE-2024-13846 | ultimate-learning-pro (WordPress plugin) | The Indeed Ultimate Learning Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions | medium | 4.9 | 0% |
| CVE-2024-3999 | eazydocs (WordPress plugin) | The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-6094 | wp-ulike (WordPress plugin) | The WP ULike WordPress plugin before 4.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-8283 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |