Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6491 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-8902 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13 | medium | 4.3 | 0% |
| CVE-2024-8913 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2026-109449 | symfony/expression-language, symfony/symfony | CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process | unknown | 0.0 | 0% |
| CVE-2024-4869 | gdpr-cookie-consent (WordPress plugin) | The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ he | high | 7.2 | 0% |
| CVE-2023-35090 | masterstudy-lms (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses | medium | 6.5 | 0% |
| CVE-2023-47835 | ari-stream-quiz (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Q | medium | 6.5 | 0% |
| CVE-2024-3587 | auxin-portfolio (WordPress plugin) | The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Portf | medium | 6.4 | 0% |
| CVE-2021-24173 | vm-backups (WordPress plugin) | The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as | medium | 6.1 | 0% |
| CVE-2023-6882 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versi | medium | 6.1 | 0% |
| CVE-2024-33997 | moodle/moodle | Moodle stored Cross-site Scripting (XSS) | medium | 6.1 | 0% |
| CVE-2024-38274 | moodle/moodle | Moodle stored XSS via calendar's event title when deleting the event | medium | 6.1 | 0% |
| CVE-2024-10104 | jobs-for-wordpress (WordPress plugin) | The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users suc | medium | 5.9 | 0% |
| CVE-2024-6025 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow co | medium | 5.4 | 0% |
| CVE-2024-8239 | starbox (WordPress plugin) | The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user' | medium | 5.4 | 0% |
| CVE-2024-8536 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2024-13274 | goalgorilla/open_social | Drupal Open Social allows Functionality Misuse | medium | 5.3 | 0% |
| CVE-2026-41055 | wwbn/avideo | WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF | medium | 5.3 | 0% |
| CVE-2024-2619 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insu | medium | 5.0 | 0% |
| CVE-2023-5124 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious J | medium | 4.8 | 0% |
| CVE-2024-9638 | category-posts-widget (WordPress plugin) | The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2023-1470 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versi | medium | 4.4 | 0% |
| CVE-2023-1913 | google-maps-widget (WordPress plugin) | The Maps Widget for Google Maps for WordPress is vulnerable to Stored Cross-Site Scripting via widget settings in versions up to, and includ | medium | 4.4 | 0% |
| CVE-2024-10854 | buy-one-click-woocommerce (WordPress plugin) | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-6792 | wp-ulike (WordPress plugin) | The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page. | low | 3.5 | 0% |
| CVE-2024-6692 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to | low | 3.3 | 0% |
| CVE-2024-13275 | drupal/seckit | This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP r | unknown | 0.0 | 0% |
| CVE-2026-55516 | snipe/snipe-it | Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update | high | 7.7 | 0% |
| CVE-2023-52892 | phpseclib/phpseclib | Name confusion in x509 Subject Alternative Name fields | high | 7.5 | 0% |
| CVE-2024-45233 | in2code/powermail | Powermail TYPO3 extension Broken Access Control in the OutputController | high | 7.3 | 0% |
| CVE-2026-72697 | getgrav/grav | Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content | medium | 6.5 | 0% |
| CVE-2024-10181 | newsletters-lite (WordPress plugin) | The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-1384 | auxin-portfolio (WordPress plugin) | The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_recen | medium | 6.4 | 0% |
| CVE-2024-5530 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-5879 | leadin (WordPress plugin) | The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' | medium | 6.4 | 0% |
| CVE-2022-36796 | callrail-phone-call-tracking (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking | medium | 6.1 | 0% |
| CVE-2023-51651 | aws/aws-sdk-php | Potential URI resolution path traversal in the AWS SDK for PHP | medium | 6.0 | 0% |
| CVE-2024-0970 | user-activity-tracking-and-log (WordPress plugin) | This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing | medium | 5.3 | 0% |
| CVE-2025-11996 | find-unused-images (WordPress plugin) | The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_i | medium | 5.3 | 0% |
| CVE-2023-2767 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settin | medium | 4.4 | 0% |
| CVE-2024-10537 | wp-user-manager (WordPress plugin) | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing c | medium | 4.3 | 0% |
| CVE-2024-12335 | avada-builder (WordPress plugin) | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the | medium | 4.3 | 0% |
| CVE-2024-48896 | moodle/moodle | Moodle leaks user names | medium | 4.3 | 0% |
| CVE-2024-13269 | drupal/adv_varnish | This module enables you to cache pages for logged in users at the Varnish level. The Varnish bin names may be guessable | unknown | 0.0 | 0% |
| CVE-2026-33159 | craftcms/cms | Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations | medium | 0.0 | 0% |
| CVE-2026-72779 | craftcms/cms | Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts | medium | 0.0 | 0% |
| CVE-2026-38991 | cockpit-hq/cockpit | Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type | high | 8.8 | 0% |
| CVE-2024-24881 | wp-sms (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS No | high | 7.1 | 0% |
| CVE-2026-47693 | poweradmin/poweradmin | Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications | medium | 6.9 | 0% |
| CVE-2021-4333 | wp-statistics (WordPress plugin) | The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to | medium | 6.5 | 0% |