Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9028 | wp-gpx-maps (WordPress plugin) | The WP GPX Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sgpx' shortcode in all versions up to, a | medium | 6.4 | 0% |
| CVE-2023-7085 | scalable-vector-graphics-\(svg\) (WordPress plugin) | The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as | medium | 5.4 | 0% |
| CVE-2024-13905 | onestore-sites (WordPress plugin) | The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the cla | medium | 5.3 | 0% |
| CVE-2024-3961 | convertkit (WordPress plugin) | The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modific | medium | 5.3 | 0% |
| CVE-2024-13120 | profilepress (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 | medium | 4.8 | 0% |
| CVE-2024-6138 | secure-copy-content-protection-and-content-locking (WordPress plugin) | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, whic | medium | 4.8 | 0% |
| CVE-2024-1590 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin | medium | 4.6 | 0% |
| CVE-2024-1778 | admin-side-data-storage-for-contact-form-7 (WordPress plugin) | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 4.3 | 0% |
| CVE-2026-109162 | typo3/cms-form | TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework | unknown | 0.0 | 0% |
| CVE-2025-65103 | devcode-it/openstamanager | OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter | high | 8.8 | 0% |
| CVE-2026-69246 | guzzlehttp/guzzle | Guzzle: Noncanonical host can bypass host-based checks | high | 7.2 | 0% |
| CVE-2023-26536 | spotify-play-button-for-wordpress (WordPress plugin) | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.05 v | medium | 6.5 | 0% |
| CVE-2023-6988 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortco | medium | 6.4 | 0% |
| CVE-2024-11195 | email-subscribe (WordPress plugin) | The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's print_email_subscribe_form s | medium | 6.4 | 0% |
| CVE-2023-6278 | biteship (WordPress plugin) | The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_err | medium | 6.1 | 0% |
| CVE-2024-12283 | wp-pipes (WordPress plugin) | The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and includin | medium | 6.1 | 0% |
| CVE-2023-0431 | file-away (WordPress plugin) | The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with | medium | 5.4 | 0% |
| CVE-2023-0439 | nex-forms (WordPress plugin) | The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By defaul | medium | 5.4 | 0% |
| CVE-2024-1775 | nextend-facebook-connect (WordPress plugin) | The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_descr | medium | 5.4 | 0% |
| CVE-2024-33998 | moodle/moodle | Moodle Cross-site Scripting (XSS) | medium | 5.4 | 0% |
| CVE-2025-4177 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() func | medium | 5.3 | 0% |
| CVE-2024-5968 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could a | medium | 4.8 | 0% |
| CVE-2022-4867 | froxlor/froxlor | Froxlor vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-3609 | reviewx (WordPress plugin) | The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a m | medium | 4.3 | 0% |
| CVE-2026-33171 | statamic/cms | Statamic has a path traversal in file dictionary fieldtype | medium | 4.3 | 0% |
| CVE-2025-53021 | moodle/moodle | Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter | medium | 4.2 | 0% |
| CVE-2023-2332 | pimcore/pimcore | Cross-site Scripting (XSS) in Conditions tab of Pricing Rules | medium | 4.0 | 0% |
| CVE-2025-9551 | drupal/protected_pages | This module enables you to protect individual pages with a password. The module doesn't limit the number of password at | unknown | 0.0 | 0% |
| CVE-2026-32268 | craftcms/azure-blob | Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability | high | 0.0 | 0% |
| CVE-2023-3204 | materialis (WordPress theme) | The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due | medium | 6.5 | 0% |
| CVE-2023-5205 | add-custom-body-class (WordPress plugin) | The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_custom_body_class' value in version | medium | 6.4 | 0% |
| CVE-2024-5666 | extensions-for-elementor (WordPress plugin) | The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button | medium | 6.4 | 0% |
| CVE-2024-0979 | dashboard-widgets-suite (WordPress plugin) | The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up | medium | 6.1 | 0% |
| CVE-2024-10825 | hide-my-wp (WordPress plugin) | The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions | medium | 6.1 | 0% |
| CVE-2024-13431 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Sc | medium | 6.1 | 0% |
| CVE-2024-3368 | all-in-one-seo (WordPress plugin) | The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which | medium | 6.1 | 0% |
| CVE-2022-46861 | custom-login-page-styler (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Zia Imtiaz Custom Login Page Styler for WordPress plugin <= 6.2 versions. | medium | 5.9 | 0% |
| CVE-2023-23710 | wordpress-social-login-and-register-\(discord\,-google\,-twitter\,-linkedin\) (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, | medium | 5.9 | 0% |
| CVE-2023-23884 | kanban-boards-for-wordpress (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions | medium | 5.9 | 0% |
| CVE-2023-25021 | fareharbor (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FareHarbor FareHarbor for WordPress plugin <= 3.6.6 versions. | medium | 5.9 | 0% |
| CVE-2023-25797 | vslider (WordPress plugin) | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions. | medium | 5.9 | 0% |
| CVE-2023-26008 | top-10---popular-posts (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ajay D'Souza Top 10 – Popular posts plugin for WordPress plugin <= 3.2.4 v | medium | 5.9 | 0% |
| CVE-2023-26017 | jobs-for-wordpress (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.10.2 versions. | medium | 5.9 | 0% |
| CVE-2023-29434 | optin-forms (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress plugin | medium | 5.9 | 0% |
| CVE-2023-30876 | dave\'s-wordpress-live-search (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dave Ross Dave's WordPress Live Search plugin <= 4.8.1 versions. | medium | 5.9 | 0% |
| CVE-2023-34368 | kanban-boards (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions | medium | 5.9 | 0% |
| CVE-2024-5604 | bug-library (WordPress plugin) | The Bug Library WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.9 | 0% |
| CVE-2024-6231 | request-a-quote (WordPress plugin) | The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 5.9 | 0% |
| CVE-2025-2228 | responsive-addons-for-elementor (WordPress plugin) | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive I | medium | 5.7 | 0% |
| CVE-2022-37411 | captcha-code-authentication (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress. | medium | 5.4 | 0% |