Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12061 | events-addon-for-elementor (WordPress plugin) | The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via th | medium | 4.3 | 0% |
| CVE-2024-4468 | salon-booking-system (WordPress plugin) | The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2024-6012 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2026-14794 | craftcms/cms | Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics | medium | 4.3 | 0% |
| CVE-2026-48492 | snipe/snipe-it | Snipe-IT's selectlist visibility is too permissive | medium | 0.0 | 0% |
| CVE-2026-72780 | craftcms/cms | Craft CMS: Passkey login accepts replayed WebAuthn assertions | critical | 0.0 | 0% |
| CVE-2017-20062 | elefant/cms | Cross-Site Request Forgery in Elefant CMS | high | 8.8 | 0% |
| CVE-2024-0856 | appointment-booking-calendar (WordPress plugin) | The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to mak | high | 8.8 | 0% |
| CVE-2024-11936 | zox-news (WordPress theme) | The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing c | high | 8.8 | 0% |
| CVE-2024-12129 | royal-core (WordPress plugin) | The Royal Core plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missin | high | 8.8 | 0% |
| CVE-2026-35671 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: IDOR Account Takeover | high | 8.8 | 0% |
| CVE-2026-47743 | shopper/framework | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | high | 8.7 | 0% |
| CVE-2026-24765 | phpunit/phpunit | PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling | high | 7.8 | 0% |
| CVE-2026-54491 | phanan/koel | Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths | high | 7.1 | 0% |
| CVE-2025-0764 | wpforo (WordPress plugin) | The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of th | medium | 6.5 | 0% |
| CVE-2025-1669 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions | medium | 6.5 | 0% |
| CVE-2025-1670 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up | medium | 6.5 | 0% |
| CVE-2023-4779 | user-submitted-posts (WordPress plugin) | The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versi | medium | 6.4 | 0% |
| CVE-2025-46734 | league/commonmark | league/commonmark contains a XSS vulnerability in Attributes extension | medium | 6.4 | 0% |
| CVE-2024-3942 | masterstudy-lms (WordPress plugin) | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modificat | medium | 6.3 | 0% |
| CVE-2023-30124 | lavalite/cms | LavaLite vulnerable to Cross Site Scripting | medium | 5.4 | 0% |
| CVE-2025-2876 | melapress-login-security (WordPress plugin) | The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a | medium | 5.3 | 0% |
| CVE-2026-35450 | wwbn/avideo | AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php | medium | 5.3 | 0% |
| CVE-2020-36741 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. This is due to mi | medium | 4.3 | 0% |
| CVE-2020-36742 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is | medium | 4.3 | 0% |
| CVE-2020-36743 | post-type-x (WordPress plugin) | The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This i | medium | 4.3 | 0% |
| CVE-2020-36744 | notificationx (WordPress plugin) | The NotificationX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to m | medium | 4.3 | 0% |
| CVE-2020-36750 | ewww-image-optimizer (WordPress plugin) | The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is d | medium | 4.3 | 0% |
| CVE-2021-4385 | wp-private-content-plus (WordPress plugin) | The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is | medium | 4.3 | 0% |
| CVE-2021-4386 | wp-security-questions (WordPress plugin) | The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is d | medium | 4.3 | 0% |
| CVE-2021-4407 | custom-banners (WordPress plugin) | The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to m | medium | 4.3 | 0% |
| CVE-2021-4408 | dw-question-answer (WordPress plugin) | The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is d | medium | 4.3 | 0% |
| CVE-2021-4409 | woocommerce-etsy-integration (WordPress plugin) | The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. T | medium | 4.3 | 0% |
| CVE-2021-4410 | qtranslate-slug (WordPress plugin) | The Qtranslate Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due t | medium | 4.3 | 0% |
| CVE-2021-4412 | wp-prayer (WordPress plugin) | The WP Prayer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5. This is due to missi | medium | 4.3 | 0% |
| CVE-2021-4413 | process-steps-template-designer (WordPress plugin) | The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1 | medium | 4.3 | 0% |
| CVE-2021-4414 | woocommerce-abandoned-cart (WordPress plugin) | The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5 | medium | 4.3 | 0% |
| CVE-2021-4415 | sunshine-photo-cart (WordPress plugin) | The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is du | medium | 4.3 | 0% |
| CVE-2021-4416 | wp-mpdf (WordPress plugin) | The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing | medium | 4.3 | 0% |
| CVE-2022-46862 | quiz-and-survey-master (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plug | medium | 4.3 | 0% |
| CVE-2024-13310 | drupal/git_utils | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2023-47350 | swiftyedit/swiftyedit | Cross Site Request Forgery in SwiftyEdit | high | 8.8 | 0% |
| CVE-2023-54355 | pocketmine/pocketmine-mp | PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey | high | 7.5 | 0% |
| CVE-2022-3538 | webmaster-tools-verification (WordPress plugin) | The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing u | medium | 6.5 | 0% |
| CVE-2023-23977 | social-comments (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments | medium | 6.5 | 0% |
| CVE-2023-36503 | maxbuttons (WordPress plugin) | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <= 9.5.3 versions. | medium | 6.5 | 0% |
| CVE-2024-8547 | simple-popup-plugin (WordPress plugin) | The Simple Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [popup] shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-13678 | r3w-instafeed (WordPress plugin) | The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 0% |
| CVE-2023-5873 | pimcore/pimcore | Pimcore Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2026-34732 | wwbn/avideo | AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints | medium | 5.3 | 0% |