Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1860 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unautho | medium | 6.5 | 0% |
| CVE-2024-1239 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all | medium | 6.4 | 0% |
| CVE-2024-1366 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘archive_title_tag’ attribute of th | medium | 6.4 | 0% |
| CVE-2024-8364 | wp-custom-fields-search (WordPress plugin) | The WP Custom Fields Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfs-preset shortcode in all | medium | 6.4 | 0% |
| CVE-2024-13629 | pushbiz (WordPress plugin) | The pushBIZ WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle | medium | 6.1 | 0% |
| CVE-2024-13669 | calendapp (WordPress plugin) | The CalendApp WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 6.1 | 0% |
| CVE-2024-51434 | froala/wysiwyg-editor | Froala WYSIWYG editor allows cross-site scripting (XSS) | medium | 6.1 | 0% |
| CVE-2024-7691 | flaming-forms (WordPress plugin) | The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to pe | medium | 6.1 | 0% |
| CVE-2024-7761 | simple-job-board (WordPress plugin) | In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored | medium | 6.1 | 0% |
| CVE-2024-8724 | waitlist-woocommerce (WordPress plugin) | The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of a | medium | 6.1 | 0% |
| CVE-2024-9344 | searchpro (WordPress plugin) | The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for Word | medium | 6.1 | 0% |
| CVE-2024-5442 | nextgen-gallery (WordPress plugin) | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could all | medium | 5.9 | 0% |
| CVE-2024-6026 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated | medium | 5.4 | 0% |
| CVE-2025-4955 | tarteaucitron.io (WordPress plugin) | The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correc | medium | 4.7 | 0% |
| CVE-2020-5501 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2023-6731 | wp-show-posts (WordPress plugin) | The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX funct | medium | 4.3 | 0% |
| CVE-2023-6897 | ean-for-woocommerce (WordPress plugin) | The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 v | medium | 4.3 | 0% |
| CVE-2024-10360 | move-addons (WordPress plugin) | The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3 | medium | 4.3 | 0% |
| CVE-2024-1133 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due | medium | 4.3 | 0% |
| CVE-2026-112067 | blueways/bw-captcha | TYPO3-EXT-SA-2026-030: Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha) | unknown | 0.0 | 0% |
| CVE-2024-13558 | woo-rfq-for-woocommerce (WordPress plugin) | The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu | high | 7.5 | 0% |
| CVE-2025-4179 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() | high | 7.3 | 0% |
| CVE-2023-6828 | arforms-form-builder (WordPress plugin) | The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site S | high | 7.2 | 0% |
| CVE-2024-10260 | tripetto (WordPress plugin) | The Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 8.0.11 | high | 7.2 | 0% |
| CVE-2024-2082 | all-contact-form-integration-for-elementor (WordPress plugin) | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | high | 7.2 | 0% |
| CVE-2023-30485 | avartan-slider-lite (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Solwin Infotech Responsive WordPress Slider – Avartan Slider Lite plugin <= 1. | high | 7.1 | 0% |
| CVE-2023-34180 | free-google-fonts (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in KAPlugins Google Fonts For WordPress plugin <= 3.0.0 versions. | high | 7.1 | 0% |
| CVE-2023-39992 | online-booking-\&-scheduling-calendar (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita plugin < | high | 7.1 | 0% |
| CVE-2022-3677 | advanced-import (WordPress plugin) | The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attacke | medium | 6.5 | 0% |
| CVE-2024-1320 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'offline_st | medium | 6.5 | 0% |
| CVE-2023-4482 | amazon-auto-links (WordPress plugin) | The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and inclu | medium | 6.4 | 0% |
| CVE-2024-33996 | moodle/moodle | Moodle broken access control when setting calendar event type | medium | 6.2 | 0% |
| CVE-2023-6527 | email-subscribe (WordPress plugin) | The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all version | medium | 6.1 | 0% |
| CVE-2024-0957 | print-invoices-packing-slip-labels-for-woocommerce (WordPress plugin) | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scri | medium | 6.1 | 0% |
| CVE-2024-1782 | blue-triad-ezanalytics (WordPress plugin) | The Blue Triad EZAnalytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'bt_webid' parameter in all versions | medium | 6.1 | 0% |
| CVE-2024-1810 | archivist-custom-archive-templates (WordPress plugin) | The Archivist – Custom Archive Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode_attributes' | medium | 6.1 | 0% |
| CVE-2024-3731 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versi | medium | 6.1 | 0% |
| CVE-2024-5212 | tagdiv-composer (WordPress plugin) | The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions u | medium | 6.1 | 0% |
| CVE-2024-3992 | amen (WordPress plugin) | The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | medium | 4.8 | 0% |
| CVE-2024-6070 | if-so (WordPress plugin) | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not sanitise and escape some of its settings, which could all | medium | 4.8 | 0% |
| CVE-2024-6887 | rafflepress (WordPress plugin) | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, whic | medium | 4.8 | 0% |
| CVE-2024-6889 | secure-copy-content-protection-and-content-locking (WordPress plugin) | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, whic | medium | 4.8 | 0% |
| CVE-2024-51478 | yeswiki/yeswiki | YesWiki Uses a Broken or Risky Cryptographic Algorithm | critical | 9.9 | 0% |
| CVE-2026-33507 | wwbn/avideo | AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload | high | 8.8 | 0% |
| CVE-2025-4381 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable | high | 7.5 | 0% |
| CVE-2025-5339 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa | high | 7.5 | 0% |
| CVE-2025-6437 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter | high | 7.5 | 0% |
| CVE-2022-3632 | oauth-client (WordPress plugin) | The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to m | medium | 6.5 | 0% |
| CVE-2024-4643 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-8241 | nova-blocks (WordPress plugin) | The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separat | medium | 6.4 | 0% |