Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-55375 | jleehr/canto-saas-api | canto-saas-api: OAuth credentials exposed in URL query string and exception messages | medium | 5.3 | 0% |
| CVE-2024-0451 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_c | medium | 5.0 | 0% |
| CVE-2021-3957 | kevinpapst/kimai2 | Cross-site Scripting in kimai2 | medium | 4.6 | 0% |
| CVE-2023-7068 | print-invoices-packing-slip-labels-for-woocommerce (WordPress plugin) | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of | medium | 4.3 | 0% |
| CVE-2025-8571 | concrete5/concrete5 | Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page | medium | 0.0 | 0% |
| CVE-2026-54458 | wwbn/avideo | WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin | critical | 9.6 | 0% |
| CVE-2026-32257 | winter/wn-backend-module | Winter: Stored XSS through Brand Settings custom styles | high | 8.1 | 0% |
| CVE-2026-32258 | winter/wn-backend-module | Winter: Stored XSS through Editor Settings custom styles | high | 8.1 | 0% |
| CVE-2026-84189 | librenms/librenms | LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page | high | 8.1 | 0% |
| CVE-2025-1912 | product-import-export-for-woo (WordPress plugin) | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forger | high | 7.6 | 0% |
| CVE-2024-8269 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all v | high | 7.3 | 0% |
| CVE-2025-0916 | yaysmtp (WordPress plugin) | The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to | high | 7.2 | 0% |
| CVE-2022-47146 | real-estate-7 (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions. | high | 7.1 | 0% |
| CVE-2023-24413 | wordpress-vertical-image-slider (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress vertical image slider plugin <= 1.2.16 versi | high | 7.1 | 0% |
| CVE-2023-28781 | wordpress-contact-forms (WordPress plugin) | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions. | high | 7.1 | 0% |
| CVE-2023-28789 | wordpress-contact-forms (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions | high | 7.1 | 0% |
| CVE-2023-30498 | vimeotheque (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeFlavors Vimeotheque: Vimeo WordPress Plugin <= 2.2.1 versions. | high | 7.1 | 0% |
| CVE-2023-32499 | radio-station (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tony Zeoli, Tony Hayes Radio Station by netmix® – Manage and play your Show Sc | high | 7.1 | 0% |
| CVE-2023-32503 | gtmetrix (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.6 versions. | high | 7.1 | 0% |
| CVE-2023-37977 | wpfunnels (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plug | high | 7.1 | 0% |
| CVE-2025-59713 | snipe/snipe-it | Snipe-IT allows unsafe deserialization | medium | 6.8 | 0% |
| CVE-2021-25097 | labtools (WordPress plugin) | The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing an | medium | 6.5 | 0% |
| CVE-2024-8108 | share-this-image (WordPress plugin) | The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' parameter in all versions up to, | medium | 6.4 | 0% |
| CVE-2022-35277 | getresponse-integration (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress. | medium | 5.4 | 0% |
| CVE-2024-4860 | rss-aggregator (WordPress plugin) | The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lac | medium | 5.4 | 0% |
| CVE-2023-6957 | fluentform (WordPress plugin) | The Fluent Forms plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up t | medium | 4.9 | 0% |
| CVE-2024-5883 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, | medium | 4.7 | 0% |
| CVE-2023-4726 | ultimate-dashboard (WordPress plugin) | The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including | medium | 4.4 | 0% |
| CVE-2021-24790 | contact-form-advanced-database (WordPress plugin) | The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_d | medium | 4.3 | 0% |
| CVE-2022-1625 | new-user-approve (WordPress plugin) | The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, w | medium | 4.3 | 0% |
| CVE-2022-34347 | download-manager (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | medium | 4.2 | 0% |
| CVE-2026-24419 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection in the Prima Nota module | high | 0.0 | 0% |
| CVE-2026-86198 | pocketmine/pocketmine-mp | PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets | low | 0.0 | 0% |
| CVE-2024-3940 | recaptcha-jetpack (WordPress plugin) | The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attacke | high | 8.8 | 0% |
| CVE-2025-31678 | drupal/ai | The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes. The module | high | 8.2 | 0% |
| CVE-2015-5723 | aws/aws-sdk-php, doctrine/annotations, doctrine/cache +9 more | Doctrine Security Misconfiguration Vulnerability | high | 7.8 | 0% |
| CVE-2024-3600 | poll-maker (WordPress plugin) | The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability ch | high | 7.2 | 0% |
| CVE-2024-13632 | wp-extra-fields (WordPress plugin) | The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t | high | 7.1 | 0% |
| CVE-2024-13633 | simple-catalogue (WordPress plugin) | The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading | high | 7.1 | 0% |
| CVE-2023-3095 | nilsteampassnet/teampass | TeamPass vulnerable to Improper Access Control | medium | 6.5 | 0% |
| CVE-2024-1159 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, | medium | 6.4 | 0% |
| CVE-2023-0403 | social-warfare (WordPress plugin) | The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to | medium | 5.4 | 0% |
| CVE-2023-42817 | pimcore/admin-ui-classic-bundle | pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in Translations | medium | 5.4 | 0% |
| CVE-2024-1160 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Link in all versions up to, an | medium | 5.4 | 0% |
| CVE-2024-41816 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[co | medium | 5.4 | 0% |
| CVE-2024-6641 | wp-security-hardening (WordPress plugin) | The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and incl | medium | 5.3 | 0% |
| CVE-2026-35452 | wwbn/avideo | AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php | medium | 5.3 | 0% |
| CVE-2024-0630 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the RSS feed source in all versions up to, and i | medium | 4.4 | 0% |
| CVE-2024-13217 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via | medium | 4.3 | 0% |
| CVE-2024-1745 | testimonial-slider-and-showcase (WordPress plugin) | The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sen | medium | 4.3 | 0% |