Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9109 | flexible-shipping-ups (WordPress plugin) | The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a | medium | 4.3 | 0% |
| CVE-2025-8401 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 4.3 | 0% |
| CVE-2023-28820 | concrete5/concrete5 | Stored cross site scripting in RSS displayer | low | 2.0 | 0% |
| CVE-2025-69216 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection in Scadenzario Print Template | high | 0.0 | 0% |
| CVE-2025-62417 | bagisto/bagisto | bagisto has CSV Formula Injection in Create New Product | critical | 9.0 | 0% |
| CVE-2026-44739 | pimcore/pimcore | Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration | high | 8.7 | 0% |
| CVE-2024-10483 | simplepress (WordPress plugin) | The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leadi | high | 7.1 | 0% |
| CVE-2024-10117 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-8668 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-8917 | football-leagues-by-anwppro (WordPress plugin) | The AnWP Football Leagues plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-8793 | woocommerce-exporter (WordPress plugin) | The Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin for WordPress is vulnerable to Re | medium | 6.1 | 0% |
| CVE-2024-8803 | bulk-noindex-nofollow-toolkit-by-mad-fish (WordPress plugin) | The Bulk NoIndex & NoFollow Toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg | medium | 6.1 | 0% |
| CVE-2024-9209 | search-analytics (WordPress plugin) | The WP Search Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropr | medium | 6.1 | 0% |
| CVE-2024-9220 | lh-copy-media-file (WordPress plugin) | The LH Copy Media File plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropri | medium | 6.1 | 0% |
| CVE-2024-9228 | loggedin (WordPress plugin) | The Loggedin – Limit Active Logins plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with | medium | 6.1 | 0% |
| CVE-2024-9385 | themify-builder (WordPress plugin) | The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate | medium | 6.1 | 0% |
| CVE-2024-9865 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking | medium | 6.1 | 0% |
| CVE-2023-23734 | userlike (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Voswinkel Userlike – WordPress Live Chat plugin <= 2.2 versions. | medium | 5.9 | 0% |
| CVE-2023-25972 | wordpress-ctapt (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in IKSWEB WordPress Старт plugin <= 3.7 versions. | medium | 5.9 | 0% |
| CVE-2022-36388 | yds-support-ticket-system (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress. | medium | 5.4 | 0% |
| CVE-2024-7727 | html5-video-player (WordPress plugin) | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missin | medium | 5.3 | 0% |
| CVE-2024-8619 | ajax-search (WordPress plugin) | The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2024-1053 | event-tickets (WordPress plugin) | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th | medium | 4.3 | 0% |
| CVE-2026-80202 | kimai/kimai | Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation | medium | 0.0 | 0% |
| CVE-2025-1319 | site-mailer (WordPress plugin) | The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting i | high | 7.2 | 0% |
| CVE-2024-4333 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 0% |
| CVE-2024-2189 | social-icons-widget (WordPress plugin) | The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which cou | medium | 6.1 | 0% |
| CVE-2024-6020 | sign-up-sheets (WordPress plugin) | The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the $_SERVER['REQUEST_URI'] parameter befo | medium | 6.1 | 0% |
| CVE-2022-29431 | remove-cpt-base (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT base plugin <= 5.8 at WordPress allows an attacker to delete the CPT base. | medium | 5.4 | 0% |
| CVE-2024-4627 | seo (WordPress plugin) | The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to | medium | 5.4 | 0% |
| CVE-2024-6408 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users su | medium | 5.4 | 0% |
| CVE-2024-6884 | gutenberg-blocks-with-ai (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before out | medium | 5.4 | 0% |
| CVE-2024-12184 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check o | medium | 5.3 | 0% |
| CVE-2024-39912 | web-auth/webauthn-framework, web-auth/webauthn-lib | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames | medium | 5.3 | 0% |
| CVE-2026-34369 | wwbn/avideo | AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification | medium | 5.3 | 0% |
| CVE-2021-41273 | pterodactyl/panel | Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys | medium | 4.3 | 0% |
| CVE-2024-21517 | opencart/opencart | Cross site scripting in opencart | medium | 4.2 | 0% |
| CVE-2024-13314 | carousel\,-slider\,-gallery-by-wp-carousel (WordPress plugin) | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could a | low | 3.5 | 0% |
| CVE-2025-49549 | magento/community-edition, magento/project-community-edition | Magento Authenticated Security feature bypass | low | 2.7 | 0% |
| CVE-2025-3474 | drupal/panels | Panels enables administrators to add page variants within page manager, panelizer, etc to create custom pages. The modu | unknown | 0.0 | 0% |
| CVE-2024-13646 | single-user-chat (WordPress plugin) | The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to ins | high | 8.1 | 0% |
| CVE-2023-4995 | embed-calendly-scheduling (WordPress plugin) | The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and includi | medium | 6.4 | 0% |
| CVE-2023-5001 | horizontal-scrolling-announcement (WordPress plugin) | The Horizontal scrolling announcement plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'horizontal-scrolling' shortcode | medium | 6.4 | 0% |
| CVE-2023-5668 | whatsapp (WordPress plugin) | The WhatsApp Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'whatsapp' shortcode in all ver | medium | 6.4 | 0% |
| CVE-2024-4711 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajax_load_more shor | medium | 6.4 | 0% |
| CVE-2023-6541 | allow-svg (WordPress plugin) | The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to up | medium | 6.1 | 0% |
| CVE-2023-7230 | illi-link-party\! (WordPress plugin) | The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low a | medium | 6.1 | 0% |
| CVE-2024-45967 | pagekit/pagekit | Pagekit Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2023-6081 | chartjs (WordPress plugin) | The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 5.4 | 0% |
| CVE-2023-6082 | chartjs (WordPress plugin) | The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 5.4 | 0% |