Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8276 | wpzoom-portfolio (WordPress plugin) | The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ at | medium | 6.4 | 0% |
| CVE-2024-8742 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2024-0238 | eventon (WordPress plugin) | The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and do | medium | 6.1 | 0% |
| CVE-2024-12047 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cus | medium | 6.1 | 0% |
| CVE-2024-12731 | infeed (WordPress plugin) | The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 0% |
| CVE-2024-5079 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenti | medium | 6.1 | 0% |
| CVE-2023-1575 | mega-main-menu (WordPress plugin) | The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, | medium | 5.5 | 0% |
| CVE-2022-40132 | seriously-simple-podcasting (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings cha | medium | 5.4 | 0% |
| CVE-2023-0780 | cockpit-hq/cockpit | Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit | medium | 5.4 | 0% |
| CVE-2023-6109 | yop-poll (WordPress plugin) | The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper re | medium | 5.3 | 0% |
| CVE-2024-6553 | wp-meteor (WordPress plugin) | The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includi | medium | 5.3 | 0% |
| CVE-2024-6571 | imageseo (WordPress plugin) | The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions u | medium | 5.3 | 0% |
| CVE-2024-6725 | formidable (WordPress plugin) | The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable | medium | 4.9 | 0% |
| CVE-2023-6783 | wolfnet-idx-for-wordpress (WordPress plugin) | The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2024-2696 | swift-framework (WordPress plugin) | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-4664 | wp-chat-app (WordPress plugin) | The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-6165 | wanotifier (WordPress plugin) | The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-6927 | viral-signup (WordPress plugin) | The Viral Signup WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-3369 | about-me-3000 (WordPress plugin) | The About Me 3000 widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and includi | medium | 4.4 | 0% |
| CVE-2023-5606 | chatbot (WordPress plugin) | The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficie | medium | 4.4 | 0% |
| CVE-2023-1159 | bookly-responsive-appointment-booking-tool (WordPress plugin) | The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due t | medium | 4.0 | 0% |
| CVE-2026-27599 | ci4-cms-erp/ci4ms | ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via | critical | 9.1 | 0% |
| CVE-2026-50635 | limesurvey/limesurvey | LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. | high | 8.8 | 0% |
| CVE-2023-0554 | quick-restaurant-menu (WordPress plugin) | The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is | high | 8.1 | 0% |
| CVE-2024-56526 | oxid-esales/oxideshop-ce, oxid-esales/oxideshop-metapackage-ce, oxid-esales/smarty-component | OXID eShop May Display User Information | high | 7.5 | 0% |
| CVE-2024-13699 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-1586 | schema-\&-structured-data-for-wp-\&-amp (WordPress plugin) | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all ver | medium | 6.4 | 0% |
| CVE-2024-4392 | jetpack (WordPress plugin) | The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvide | medium | 6.4 | 0% |
| CVE-2026-71293 | statamic/cms | Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering | medium | 6.2 | 0% |
| CVE-2024-12239 | powerpack-addon-for-beaver-builder (WordPress plugin) | The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the navigate parameter in all | medium | 6.1 | 0% |
| CVE-2026-67354 | guzzlehttp/guzzle | Guzzle: URI fragments disclosed in redirect Referer headers | medium | 5.9 | 0% |
| CVE-2022-38086 | shortcodes-ultimate (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings chang | medium | 5.4 | 0% |
| CVE-2025-1766 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data | medium | 5.3 | 0% |
| CVE-2025-2789 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for Word | medium | 5.3 | 0% |
| CVE-2026-67339 | guzzlehttp/guzzle | Guzzle: Proxy-Authorization headers can be sent to origin servers | medium | 5.3 | 0% |
| CVE-2024-10027 | wp-booking-calendar (WordPress plugin) | The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2024-3644 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-3921 | gianism (WordPress plugin) | The Gianism WordPress plugin through 5.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-5286 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 4.8 | 0% |
| CVE-2025-23198 | librenms/librenms | LibreNMS Display Name Stored Cross-site Scripting vulnerability | medium | 4.6 | 0% |
| CVE-2023-5120 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter | medium | 4.4 | 0% |
| CVE-2024-0983 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-0984 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-3920 | flattr (WordPress plugin) | The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as | low | 3.5 | 0% |
| CVE-2024-13251 | drupal/registration_role | The Registration role module lets an administrator select a role (or multiple roles) to automatically assign to new user | unknown | 0.0 | 0% |
| CVE-2026-34970 | mantisbt/mantisbt | MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked | medium | 0.0 | 0% |
| CVE-2025-2816 | page-views-count (WordPress plugin) | The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a mi | high | 8.1 | 0% |
| CVE-2026-53673 | buddypress/buddypress | BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter | high | 8.1 | 0% |
| CVE-2024-1761 | wp-whatsapp (WordPress plugin) | The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and i | medium | 6.4 | 0% |
| CVE-2024-1957 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gi | medium | 6.4 | 0% |