Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-51511 | cadmium-org/cadmium-cms | Cadmium CMS has a background arbitrary file upload vulnerability | high | 0.0 | 0% |
| CVE-2026-62230 | getgrav/grav | Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems | high | 0.0 | 0% |
| CVE-2024-40633 | sylius/sylius | Sylius has a security vulnerability via adjustments API endpoint | high | 7.5 | 0% |
| CVE-2019-12203 | silverstripe/framework | Session fixation in change password form | medium | 6.3 | 0% |
| CVE-2024-11974 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit- | medium | 6.1 | 0% |
| CVE-2024-13603 | wise-forms (WordPress plugin) | The Wise Forms WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow unauthenticated users to | medium | 6.1 | 0% |
| CVE-2024-2119 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions u | medium | 6.1 | 0% |
| CVE-2024-5626 | inline-related-posts (WordPress plugin) | The Inline Related Posts WordPress plugin before 3.7.0 does not sanitise and escape a parameter before outputting it back in the page, leadi | medium | 6.1 | 0% |
| CVE-2024-8664 | wp-test-email (WordPress plugin) | The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate e | medium | 6.1 | 0% |
| CVE-2024-9205 | maximum-products-per-user-for-woocommerce (WordPress plugin) | The Maximum Products per User for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_que | medium | 6.1 | 0% |
| CVE-2023-23878 | wp-maps (WordPress plugin) | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS plugin <= 4.3.9 ve | medium | 5.9 | 0% |
| CVE-2023-36259 | superbig/craft-audit | Craft CMS Audit Plugin Cross Site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2023-7089 | easy-svg-support (WordPress plugin) | The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author t | medium | 5.4 | 0% |
| CVE-2024-10493 | element-pack (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 d | medium | 5.4 | 0% |
| CVE-2024-10980 | element-pack (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 | medium | 5.4 | 0% |
| CVE-2026-88974 | wp-graphql/wp-graphql | WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost | medium | 5.4 | 0% |
| CVE-2024-13451 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | medium | 5.3 | 0% |
| CVE-2026-35544 | roundcube/roundcubemail | Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages | medium | 5.3 | 0% |
| CVE-2024-9881 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2023-5121 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup pa | medium | 4.4 | 0% |
| CVE-2022-25952 | content-egg (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress. | medium | 4.3 | 0% |
| CVE-2022-37405 | better-font-awesome (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress. | medium | 4.3 | 0% |
| CVE-2026-16647 | drupal/disable_login | This module enables you to disable access to the `/user/login` form unless a secret key is provided. The module does no | unknown | 0.0 | 0% |
| CVE-2026-52763 | yeswiki/yeswiki | YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read | medium | 6.5 | 0% |
| CVE-2024-1041 | wp-radio (WordPress plugin) | The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-1658 | grid-shortcodes (WordPress plugin) | The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2025-67855 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | medium | 5.4 | 0% |
| CVE-2023-5980 | bsk-forms-blacklist (WordPress plugin) | The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2024-0951 | advanced-social-feeds-widget-\&-shortcode (WordPress plugin) | The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could all | medium | 4.8 | 0% |
| CVE-2024-12201 | hash-form (WordPress plugin) | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when cr | medium | 4.3 | 0% |
| CVE-2024-13121 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 | low | 3.5 | 0% |
| CVE-2025-5420 | juzaweb/cms | juzaweb CMS allows cross-site scripting by uploading an SVG file | low | 3.5 | 0% |
| CVE-2024-13242 | drupal/swiftmailer | The Drupal Swift Mailer module extends the basic e-mail sending functionality provided by Drupal by delegating all e-mai | unknown | 0.0 | 0% |
| CVE-2024-2087 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in all versions up to, a | high | 7.2 | 0% |
| CVE-2024-8725 | file-manager-advanced (WordPress plugin) | Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper chec | medium | 6.8 | 0% |
| CVE-2023-5230 | tm-woocommerce-compare-wishlist (WordPress plugin) | The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcod | medium | 6.4 | 0% |
| CVE-2024-11746 | gs-woo-brands (WordPress plugin) | The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stor | medium | 6.4 | 0% |
| CVE-2024-13575 | web-stories-enhancer (WordPress plugin) | The Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'web | medium | 6.4 | 0% |
| CVE-2024-13591 | team-builder-for-wpbakery-page-builder (WordPress plugin) | The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t | medium | 6.4 | 0% |
| CVE-2022-33201 | official-mailerlite-sign-up-forms (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to c | medium | 6.3 | 0% |
| CVE-2024-12290 | infility-global (WordPress plugin) | The Infility Global plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_type’ parameter in all versions up to, | medium | 6.1 | 0% |
| CVE-2022-36292 | photoblocks-grid-gallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. | medium | 5.4 | 0% |
| CVE-2023-2343 | pimcore/pimcore | Cross-site Scripting (XSS) in DataObject Classification Store | medium | 5.4 | 0% |
| CVE-2024-4483 | email-encoder (WordPress plugin) | The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outpu | medium | 5.4 | 0% |
| CVE-2024-12717 | infeed (WordPress plugin) | The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2023-4021 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in vers | medium | 4.4 | 0% |
| CVE-2019-7857 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2019-7873 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 4.3 | 0% |
| CVE-2022-38470 | customer-reviews-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. | medium | 4.3 | 0% |
| CVE-2024-5703 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | medium | 4.3 | 0% |