Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1157 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, a | medium | 5.4 | 0% |
| CVE-2024-1340 | login-lockdown (WordPress plugin) | The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-56412 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters | medium | 5.4 | 0% |
| CVE-2025-4964 | wp-online-users-stats (WordPress plugin) | The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘table_name’ parameter in all versions up t | medium | 4.9 | 0% |
| CVE-2024-5578 | table-of-contents-plus (WordPress plugin) | The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-7876 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape | medium | 4.8 | 0% |
| CVE-2024-7877 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape | medium | 4.8 | 0% |
| CVE-2024-9883 | pods (WordPress plugin) | The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2023-47548 | integrate-google-drive (WordPress plugin) | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, | medium | 4.7 | 0% |
| CVE-2023-48325 | landing-page-builder (WordPress plugin) | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page | medium | 4.7 | 0% |
| CVE-2021-4396 | rucy (WordPress plugin) | The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or | medium | 4.3 | 0% |
| CVE-2021-4397 | staff-directory-pro (WordPress plugin) | The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6. This is d | medium | 4.3 | 0% |
| CVE-2021-4398 | amministrazione-trasparente (WordPress plugin) | The Amministrazione Trasparente plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. Thi | medium | 4.3 | 0% |
| CVE-2021-4400 | better-search (WordPress plugin) | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This is due to m | medium | 4.3 | 0% |
| CVE-2021-4403 | remove-schema (WordPress plugin) | The Remove Schema plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to mis | medium | 4.3 | 0% |
| CVE-2021-4404 | event-espresso-decaf (WordPress plugin) | The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This | medium | 4.3 | 0% |
| CVE-2021-4405 | elasticpress (WordPress plugin) | The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to mi | medium | 4.3 | 0% |
| CVE-2022-2172 | linkworth-wp-plugin (WordPress plugin) | The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change se | medium | 4.3 | 0% |
| CVE-2023-7038 | automad/automad | Cross-Site Request Forgery (CSRF) in automad/automad | medium | 4.3 | 0% |
| CVE-2024-2744 | nextgen-gallery (WordPress plugin) | The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.3 | 0% |
| CVE-2025-3640 | moodle/moodle | Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users | medium | 4.3 | 0% |
| CVE-2008-5153 | moodle/moodle | Moodle vulnerable to symlink attack | medium | 0.0 | 0% |
| CVE-2026-45070 | symfony/mime, symfony/symfony | Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names | medium | 0.0 | 0% |
| CVE-2026-8727 | tomasnorre/crawler | TYPO3 Remote Code Execution in extension "Site Crawler" (crawler) | high | 0.0 | 0% |
| CVE-2023-0766 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in us | high | 8.8 | 0% |
| CVE-2023-2329 | woocommerce-google-sheet-connector (WordPress plugin) | The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could all | high | 8.8 | 0% |
| CVE-2023-2330 | caldera-forms-google-sheets-connector (WordPress plugin) | The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could al | high | 8.8 | 0% |
| CVE-2023-2628 | kivicare (WordPress plugin) | The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which co | high | 8.8 | 0% |
| CVE-2023-3179 | post-smtp (WordPress plugin) | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to mak | high | 8.8 | 0% |
| CVE-2026-75828 | getgrav/grav | Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS | high | 8.7 | 0% |
| CVE-2026-54329 | snipe/snipe-it | Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection | high | 8.5 | 0% |
| CVE-2024-9156 | ti-woocommerce-wishlist (WordPress plugin) | The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied | high | 7.5 | 0% |
| CVE-2025-13206 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ param | high | 7.2 | 0% |
| CVE-2023-6830 | formidable (WordPress plugin) | The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows u | medium | 6.5 | 0% |
| CVE-2024-13235 | booking-system (WordPress plugin) | The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter i | medium | 6.5 | 0% |
| CVE-2024-13595 | simple-signup-form (WordPress plugin) | The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up | medium | 6.5 | 0% |
| CVE-2025-0723 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the ri | medium | 6.5 | 0% |
| CVE-2026-48014 | shopware/core, shopware/platform | Shopware: Admin API ACL Bypass in Order State Transition Endpoints | medium | 6.5 | 0% |
| CVE-2026-56830 | shopper/framework | Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph) | medium | 6.5 | 0% |
| CVE-2023-6500 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2024-1291 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown URL parameter in all versions u | medium | 6.4 | 0% |
| CVE-2024-13732 | responsive-block-editor-addons (WordPress plugin) | The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘section_tag’ p | medium | 6.4 | 0% |
| CVE-2024-1762 | social-networks-auto-poster-facebook-twitter-g (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP_USER_AGENT heade | medium | 6.1 | 0% |
| CVE-2024-3580 | popup4phone (WordPress plugin) | The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 6.1 | 0% |
| CVE-2024-47765 | dev-lancer/minecraft-motd-parser | Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS | medium | 6.1 | 0% |
| CVE-2024-0201 | product-expiry-for-woocommerce (WordPress plugin) | The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-21628 | prestashop/prestashop | PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO) | medium | 5.4 | 0% |
| CVE-2024-9065 | wp-helper-lite (WordPress plugin) | The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'whp_ | medium | 5.3 | 0% |
| CVE-2024-9700 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Referen | medium | 5.3 | 0% |
| CVE-2023-0710 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_tha | medium | 4.9 | 0% |