Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9345 | product-delivery-date-for-woocommerce-lite (WordPress plugin) | The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_ | medium | 6.1 | 0% |
| CVE-2024-9353 | popularis-extra (WordPress plugin) | The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg | medium | 6.1 | 0% |
| CVE-2024-9384 | wholesale-pricing-woocommerce (WordPress plugin) | The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to th | medium | 6.1 | 0% |
| CVE-2024-9435 | shiftcontroller (WordPress plugin) | The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL keys in all versi | medium | 6.1 | 0% |
| CVE-2024-9613 | formfacade (WordPress plugin) | The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and | medium | 6.1 | 0% |
| CVE-2023-49841 | optin-forms (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Optin Forms – Simple List | medium | 5.9 | 0% |
| CVE-2021-24618 | donate-with-qrcode (WordPress plugin) | The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross- | medium | 5.4 | 0% |
| CVE-2024-5941 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to | medium | 5.4 | 0% |
| CVE-2024-1779 | admin-side-data-storage-for-contact-form-7 (WordPress plugin) | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2023-1928 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_prel | medium | 4.3 | 0% |
| CVE-2023-1929 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_purg | medium | 4.3 | 0% |
| CVE-2023-1930 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the wpfc_clear_ca | medium | 4.3 | 0% |
| CVE-2023-1931 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the deleteCssAndJsCac | medium | 4.3 | 0% |
| CVE-2023-2174 | badgeos (WordPress plugin) | The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_ | medium | 4.3 | 0% |
| CVE-2023-2284 | wp-security-audit-log (WordPress plugin) | The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2023-4600 | affiliatewp (WordPress plugin) | The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_ad | medium | 4.3 | 0% |
| CVE-2023-4948 | woocommerce-cvr-payment-gateway (WordPress plugin) | The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2023-6066 | wp-custom-widget-area (WordPress plugin) | The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callb | medium | 4.3 | 0% |
| CVE-2024-12132 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 4.3 | 0% |
| CVE-2024-6621 | wp-rss-aggregator (WordPress plugin) | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2026-14793 | craftcms/cms | Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets | medium | 4.3 | 0% |
| CVE-2024-13253 | drupal/advanced_pwa | Progressive web applications are web applications that load like regular web pages or websites but can offer the user fu | unknown | 0.0 | 0% |
| CVE-2026-72782 | craftcms/cms | Craft CMS: Authenticated leak of secret environment variables | medium | 0.0 | 0% |
| CVE-2025-4855 | support-board (WordPress plugin) | The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default se | critical | 9.8 | 0% |
| CVE-2024-13440 | super-store-finder (WordPress plugin) | The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssf_wp_user_name’ parameter in all versions up to, and i | high | 8.2 | 0% |
| CVE-2025-55742 | unopim/unopim | UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality | medium | 6.8 | 0% |
| CVE-2022-2355 | easy-username-updater (WordPress plugin) | The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admi | medium | 6.5 | 0% |
| CVE-2023-49168 | better-messages (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages – Live Chat f | medium | 6.5 | 0% |
| CVE-2024-5149 | buddyforms (WordPress plugin) | The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an | medium | 6.5 | 0% |
| CVE-2026-49205 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) | medium | 6.5 | 0% |
| CVE-2023-4893 | crayon-syntax-highlighter (WordPress plugin) | The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortcode in versions up to | medium | 6.4 | 0% |
| CVE-2024-2484 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Services and Post Type Grid widgets in | medium | 6.4 | 0% |
| CVE-2024-4567 | themify-shortcodes (WordPress plugin) | The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themify_button shortcode in all ve | medium | 6.4 | 0% |
| CVE-2024-5582 | schema-and-structured-data-for-wp (WordPress plugin) | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute | medium | 6.4 | 0% |
| CVE-2024-5763 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-6208 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-6804 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2024-7302 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads | medium | 6.4 | 0% |
| CVE-2024-7304 | ninja-tables (WordPress plugin) | The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all | medium | 6.4 | 0% |
| CVE-2024-7317 | folders (WordPress plugin) | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Stored Cr | medium | 6.4 | 0% |
| CVE-2024-8440 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-8486 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter | medium | 6.4 | 0% |
| CVE-2024-8505 | ajax-load-more (WordPress plugin) | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ para | medium | 6.4 | 0% |
| CVE-2024-2833 | job-postings (WordPress plugin) | The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘job-search’ parameter in all versions u | medium | 6.1 | 0% |
| CVE-2024-3615 | media-library-plus (WordPress plugin) | The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, | medium | 6.1 | 0% |
| CVE-2024-11942 | drupal/core | Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the enti | medium | 5.9 | 0% |
| CVE-2023-6876 | clever-fox (WordPress plugin) | The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a | medium | 5.4 | 0% |
| CVE-2024-39318 | ibexa/admin-ui | Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget | medium | 5.4 | 0% |
| CVE-2024-3994 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tut | medium | 5.4 | 0% |
| CVE-2025-2331 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u | medium | 5.3 | 0% |