Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3636 | pinpoint-booking-system (WordPress plugin) | The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high pri | medium | 5.4 | 0% |
| CVE-2024-56411 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header | medium | 5.4 | 0% |
| CVE-2023-2494 | go-pricing (WordPress plugin) | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missin | medium | 4.6 | 0% |
| CVE-2024-13447 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_bookin | medium | 4.3 | 0% |
| CVE-2023-23677 | gtmetrix (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions. | low | 3.8 | 0% |
| CVE-2026-8495 | drupal/date_ical | This module enables you to export entity date fields as iCal feeds. The module doesn't sufficiently check entity or fie | unknown | 0.0 | 0% |
| CVE-2024-9658 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions u | high | 8.8 | 0% |
| CVE-2025-1667 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on | high | 8.8 | 0% |
| CVE-2025-48201 | nitsan/ns-backup | The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location | high | 8.6 | 0% |
| CVE-2025-48205 | sjbr/sr-feuser-register | The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference | high | 8.6 | 0% |
| CVE-2025-6238 | ai-engine (WordPress plugin) | The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the | high | 8.0 | 0% |
| CVE-2024-55921 | typo3/cms-extensionmanager | TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery | high | 7.5 | 0% |
| CVE-2026-105830 | league/commonmark | league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan | high | 7.5 | 0% |
| CVE-2024-13509 | ws-form (WordPress plugin) | The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, an | high | 7.2 | 0% |
| CVE-2023-50371 | advanced-page-visit-counter (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page Visit | medium | 6.5 | 0% |
| CVE-2025-13359 | taxopress (WordPress plugin) | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the " | medium | 6.5 | 0% |
| CVE-2025-4523 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a | medium | 6.5 | 0% |
| CVE-2024-4354 | tablepress (WordPress plugin) | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-10103 | mailpoet (WordPress plugin) | In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on | medium | 6.1 | 0% |
| CVE-2024-13823 | 360-product-rotation (WordPress plugin) | The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-13865 | s3player (WordPress plugin) | The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 0% |
| CVE-2024-5281 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-5283 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-9417 | hash-form (WordPress plugin) | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validat | medium | 6.1 | 0% |
| CVE-2024-2762 | foogallery (WordPress plugin) | The FooGallery WordPress plugin before 2.4.15, foogallery-premium WordPress plugin before 2.4.15 does not validate and escape some of its G | medium | 5.4 | 0% |
| CVE-2025-12468 | wp-marketing-automations (WordPress plugin) | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive I | medium | 5.3 | 0% |
| CVE-2025-48207 | renolit/reint-downloadmanager | reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference | medium | 5.3 | 0% |
| CVE-2024-10903 | broken-link-checker (WordPress plugin) | The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow a | medium | 4.7 | 0% |
| CVE-2024-8552 | download-monitor (WordPress plugin) | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable | medium | 4.3 | 0% |
| CVE-2025-49550 | magento/community-edition, magento/project-community-edition | Magento Security feature bypass | medium | 4.3 | 0% |
| CVE-2026-40194 | phpseclib/phpseclib | phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() | low | 3.7 | 0% |
| CVE-2026-55519 | snipe/snipe-it | Snipe-IT has Improper Authorization in File Deletion (IDOR) | low | 0.0 | 0% |
| CVE-2022-40489 | thinkcmf/thinkcmf | ThinkCMF Cross Site Request Forgery (CSRF) vulnerability | high | 8.8 | 0% |
| CVE-2024-12821 | media-manager (WordPress plugin) | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation | high | 8.8 | 0% |
| CVE-2024-43369 | ibexa/fieldtype-richtext | Persistent Cross-site Scripting in Ibexa RichText Field Type | high | 7.2 | 0% |
| CVE-2024-1168 | wp-seopress (WordPress plugin) | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social image URL in all versio | medium | 6.4 | 0% |
| CVE-2024-5994 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions | medium | 6.4 | 0% |
| CVE-2024-11685 | kudos-donations (WordPress plugin) | The `Kudos Donations – Easy donations and payments with Mollie` plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to | medium | 6.1 | 0% |
| CVE-2024-12302 | icegram-engage (WordPress plugin) | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and | medium | 6.1 | 0% |
| CVE-2024-12587 | contact-form-master (WordPress plugin) | The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-13218 | fast-tube (WordPress plugin) | The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 0% |
| CVE-2024-4057 | gutenberg-blocks-with-ai (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before | medium | 6.1 | 0% |
| CVE-2024-4289 | sailthru-triggermail (WordPress plugin) | The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages a | medium | 6.1 | 0% |
| CVE-2024-9651 | contact-form (WordPress plugin) | The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 6.1 | 0% |
| CVE-2025-3421 | everest-forms (WordPress plugin) | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflec | medium | 6.1 | 0% |
| CVE-2024-1687 | woo-thank-you-page-customizer (WordPress plugin) | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcod | medium | 5.4 | 0% |
| CVE-2024-5475 | responsive-video-embed (WordPress plugin) | The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting the | medium | 5.4 | 0% |
| CVE-2024-9641 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | 0% |
| CVE-2024-12560 | button-block (WordPress plugin) | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in | medium | 4.3 | 0% |
| CVE-2024-12584 | xpro-elementor-addons (WordPress plugin) | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 4.3 | 0% |