Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6953 | fluentforms-pdf (WordPress plugin) | The PDF Generator For Fluent Forms – The Contact Form Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the heade | medium | 4.9 | 0% |
| CVE-2023-5529 | advanced-page-visit-counter (WordPress plugin) | The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2023-5932 | travelpayouts (WordPress plugin) | The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting | medium | 4.8 | 0% |
| CVE-2024-7084 | ajax-search (WordPress plugin) | The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low | medium | 4.8 | 0% |
| CVE-2022-36389 | bp-better-messages (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. | medium | 4.3 | 0% |
| CVE-2020-28838 | opencart/opencart | OpenCart Cross-Site Request Forgery (CSRF) | low | 3.5 | 0% |
| CVE-2024-51991 | october/october, october/system | October CMS Allows Unprotected SVG Rename in Media Manager | low | 0.0 | 0% |
| CVE-2025-47710 | drupal/miniorange_2fa | The module enables you to add second-factor authentication in addition to the default Drupal login. The module does not | unknown | 0.0 | 0% |
| CVE-2026-86431 | league/commonmark | league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed | high | 7.2 | 0% |
| CVE-2024-4290 | sailthru-triggermail (WordPress plugin) | The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege us | high | 7.1 | 0% |
| CVE-2022-47407 | fixpunkt/fp-masterquiz | TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz) | medium | 6.5 | 0% |
| CVE-2024-12609 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'view-attendance' page in all version | medium | 6.5 | 0% |
| CVE-2024-1289 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl | medium | 6.5 | 0% |
| CVE-2023-5317 | thorsten/phpmyfaq | phpMyFaq Cross-site Scripting vulnerability | medium | 6.3 | 0% |
| CVE-2022-27860 | footer-text (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress. | medium | 6.1 | 0% |
| CVE-2022-4954 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to | medium | 5.5 | 0% |
| CVE-2024-3627 | wheel-of-life (WordPress plugin) | The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of d | medium | 5.4 | 0% |
| CVE-2022-29413 | hermit (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &ti | medium | 4.7 | 0% |
| CVE-2022-29436 | code-snippets-extended (WordPress plugin) | Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Si | medium | 4.7 | 0% |
| CVE-2026-62998 | redaxo/source | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration | medium | 4.3 | 0% |
| CVE-2024-35498 | getgrav/grav | Grav Cross-site Scripting vulnerability | low | 0.0 | 0% |
| CVE-2026-28781 | craftcms/cms | Craft CMS: Entries Authorship Spoofing via Mass Assignment | medium | 0.0 | 0% |
| CVE-2026-34560 | ci4-cms-erp/ci4ms | CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2024-5151 | sully (WordPress plugin) | The SULly WordPress plugin before 4.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | high | 7.1 | 0% |
| CVE-2024-5715 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | high | 7.1 | 0% |
| CVE-2024-3208 | sydney-toolbox (WordPress plugin) | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versi | medium | 6.4 | 0% |
| CVE-2024-4709 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 6.4 | 0% |
| CVE-2023-47639 | api-platform/core | API Platform Core can leak exceptions message that may contain sensitive information | medium | 5.3 | 0% |
| CVE-2026-25509 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to User Email Enumeration via Password Reset Flow | medium | 5.3 | 0% |
| CVE-2024-8189 | wp-multitasking (WordPress plugin) | The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in a | medium | 4.4 | 0% |
| CVE-2024-10780 | restaurant-cafe-addon-for-elementor (WordPress plugin) | The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1 | medium | 4.3 | 0% |
| CVE-2024-10798 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2024-11583 | borderless (WordPress plugin) | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss | medium | 4.3 | 0% |
| CVE-2026-112237 | kitodo/presentation | TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf) | unknown | 0.0 | 0% |
| CVE-2026-112240 | codingms/fluid-form | TYPO3-EXT-SA-2026-033: Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) | unknown | 0.0 | 0% |
| CVE-2026-120333 | evoweb/sf-register | TYPO3-EXT-SA-2026-038: Broken Access Control in extension "Frontend User Registration" (sf_register) | unknown | 0.0 | 0% |
| CVE-2026-50284 | craftcms/cms | Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets | high | 0.0 | 0% |
| CVE-2023-0294 | mediamatic (WordPress plugin) | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2. | high | 8.8 | 0% |
| CVE-2025-53370 | starcitizentools/citizen-skin | Citizen vulnerable to Stored XSS through short descriptions | high | 8.6 | 0% |
| CVE-2022-44743 | jobs-for-wordpress (WordPress plugin) | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.11.2 versions. | medium | 6.5 | 0% |
| CVE-2024-13403 | wpforms-lite (WordPress plugin) | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored C | medium | 6.4 | 0% |
| CVE-2024-3641 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors t | medium | 6.1 | 0% |
| CVE-2024-5613 | formula (WordPress theme) | The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'quality_customizer_notify_dis | medium | 6.1 | 0% |
| CVE-2024-5638 | formula (WordPress theme) | The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ti_customizer_notify_dismiss_ | medium | 6.1 | 0% |
| CVE-2024-8712 | gtm-server-side (WordPress plugin) | The GTM Server Side plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate | medium | 6.1 | 0% |
| CVE-2024-8741 | beam-me-up-scotty (WordPress plugin) | The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_ | medium | 6.1 | 0% |
| CVE-2024-8800 | rabbit-loader (WordPress plugin) | The RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more plugin for WordP | medium | 6.1 | 0% |
| CVE-2024-9210 | mailchimp-top-bar (WordPress plugin) | The MC4WP: Mailchimp Top Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without ap | medium | 6.1 | 0% |
| CVE-2024-9218 | magazine-blocks (WordPress plugin) | The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is | medium | 6.1 | 0% |
| CVE-2024-9222 | paid-member-subscriptions (WordPress plugin) | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to R | medium | 6.1 | 0% |