Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-25874 | enhavo/enhavo-app | Enhavo Cross-site Scripting vulnerability | medium | 0.0 | 0% |
| CVE-2026-96366 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2023-5820 | wp-responsive-slider-with-lightbox (WordPress plugin) | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing o | critical | 9.6 | 0% |
| CVE-2022-25776 | mautic/core | Mautic Sensitive Data Exposure due to inadequate user permission settings | high | 8.3 | 0% |
| CVE-2023-2736 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to mi | high | 7.5 | 0% |
| CVE-2023-7332 | pocketmine/pocketmine-mp | PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash | high | 7.5 | 0% |
| CVE-2025-6782 | gozen-forms (WordPress plugin) | The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all ve | high | 7.5 | 0% |
| CVE-2023-3492 | wp-shopping-pages (WordPress plugin) | The WP Shopping Pages WordPress plugin through 1.14 does not have CSRF check in some places, and is missing sanitisation as well as escaping | medium | 6.8 | 0% |
| CVE-2026-64663 | statamic/cms | Statamic: Unsafe method invocation via Antlers template resolution allows data destruction | medium | 6.5 | 0% |
| CVE-2024-11203 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & | medium | 6.4 | 0% |
| CVE-2023-7167 | persian-fonts (WordPress plugin) | The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 6.1 | 0% |
| CVE-2024-0973 | widget-for-social-page-feeds (WordPress plugin) | The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privi | medium | 6.1 | 0% |
| CVE-2024-4272 | support-svg (WordPress plugin) | The Support SVG WordPress plugin before 1.1.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG | medium | 6.1 | 0% |
| CVE-2025-22131 | phpoffice/phpexcel, phpoffice/phpspreadsheet | Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet | medium | 6.1 | 0% |
| CVE-2023-27618 | store-locator (WordPress plugin) | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in AGILELOGIX Store Locator WordPress plugin <= 1.4.9 versions. | medium | 5.9 | 0% |
| CVE-2024-6455 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due | medium | 5.3 | 0% |
| CVE-2024-6544 | custom-post-limits (WordPress plugin) | The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due t | medium | 5.3 | 0% |
| CVE-2024-9940 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to | medium | 5.3 | 0% |
| CVE-2025-5103 | woo-gift-cards-lite (WordPress plugin) | The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'default_price' and 'produ | medium | 4.9 | 0% |
| CVE-2024-7878 | wp-ulike (WordPress plugin) | The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-8758 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high pr | medium | 4.8 | 0% |
| CVE-2025-2162 | mappress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-56144 | librenms/librenms | LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability | medium | 4.6 | 0% |
| CVE-2025-3903 | drupal/ueditor | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-77129 | derhansen/sf_event_mgt | TYPO3-EXT-SA-2026-023: Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt) | unknown | 0.0 | 0% |
| CVE-2026-77137 | frappant/frp-form-answers | TYPO3-EXT-SA-2026-027: SQL Injection in extension "Forms Export" (frp_form_answers) | unknown | 0.0 | 0% |
| CVE-2026-2469 | directorytree/imapengine | ImapEngine affected by command injection via the ID command parameters | high | 7.6 | 0% |
| CVE-2024-12614 | passwords-manager (WordPress plugin) | The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_ | high | 7.5 | 0% |
| CVE-2026-40863 | phpoffice/phpspreadsheet | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader | high | 7.5 | 0% |
| CVE-2026-40902 | phpoffice/phpspreadsheet | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions | high | 7.5 | 0% |
| CVE-2024-5902 | userfeedback-lite (WordPress plugin) | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross- | high | 7.2 | 0% |
| CVE-2024-13691 | uncode (WordPress theme) | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_recordMedia' functio | medium | 6.5 | 0% |
| CVE-2023-7029 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in al | medium | 6.4 | 0% |
| CVE-2024-10113 | wpadcenter (WordPress plugin) | The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpadcenter_ad | medium | 6.4 | 0% |
| CVE-2024-8236 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url | medium | 6.4 | 0% |
| CVE-2024-9177 | themedy-toolbox (WordPress plugin) | The Themedy Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themedy_col, themedy_social_link, the | medium | 6.4 | 0% |
| CVE-2023-30177 | craftcms/cms | Cross Site Scripting in CraftCMS | medium | 6.1 | 0% |
| CVE-2024-10265 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Script | medium | 6.1 | 0% |
| CVE-2024-12714 | backlink-monitoring-manager (WordPress plugin) | The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.1 | 0% |
| CVE-2024-12715 | asgard-security-scanner (WordPress plugin) | The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, lea | medium | 6.1 | 0% |
| CVE-2024-47817 | lara-zeus/artemis, lara-zeus/dynamic-dashboard | Lara-zeus Dynamic Dashboard and Artemis do not validate paragraph widget values which can be used for XSS | medium | 6.1 | 0% |
| CVE-2024-5730 | pagerank-tools (WordPress plugin) | The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-8787 | clover-online-orders (WordPress plugin) | The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & rem | medium | 6.1 | 0% |
| CVE-2024-9237 | fish-and-ships (WordPress plugin) | The Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate plugin for WordPress is vulnerable to Reflected Cross-Si | medium | 6.1 | 0% |
| CVE-2021-24615 | wechat-reward (WordPress plugin) | The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attack | medium | 5.4 | 0% |
| CVE-2024-10482 | media-library-tools (WordPress plugin) | The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded | medium | 5.4 | 0% |
| CVE-2024-13688 | admin-and-site-enhancements (WordPress plugin) | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing | medium | 5.3 | 0% |
| CVE-2026-22692 | october/rain | October Rain has a Twig Sandbox Bypass via Collection Methods | medium | 4.9 | 0% |
| CVE-2022-25774 | mautic/core | Mautic vulnerable to cross-site scripting in notifications via saving Dashboards | medium | 4.8 | 0% |
| CVE-2021-3963 | kevinpapst/kimai2 | Cross-site Scripting in kimai2 | medium | 4.3 | 0% |