Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13228 | qubely (WordPress plugin) | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | medium | 4.3 | 0% |
| CVE-2025-3637 | moodle/moodle | Moodle's mod_data edit/delete pages pass CSRF token in GET parameter | low | 3.1 | 0% |
| CVE-2026-29173 | craftcms/commerce | Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table | low | 0.0 | 0% |
| CVE-2026-48807 | twig/twig | Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters | medium | 0.0 | 0% |
| CVE-2024-0858 | innovs-hr (WordPress plugin) | The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in user | high | 8.8 | 0% |
| CVE-2024-6075 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make | high | 8.8 | 0% |
| CVE-2026-41236 | froxlor/froxlor | Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path | high | 8.8 | 0% |
| CVE-2024-0233 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outp | medium | 6.1 | 0% |
| CVE-2026-67355 | guzzlehttp/guzzle | Guzzle: Host-only cookie scope is not preserved | medium | 5.9 | 0% |
| CVE-2024-45964 | tribalsystems/zenario | Zenario Cross Site Scripting in the Image library | medium | 5.4 | 0% |
| CVE-2024-13685 | admin-and-site-enhancements (WordPress plugin) | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allow | medium | 5.3 | 0% |
| CVE-2025-26527 | moodle/moodle | Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block | medium | 5.3 | 0% |
| CVE-2025-3889 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi | medium | 5.3 | 0% |
| CVE-2024-9892 | add-widget-after-content (WordPress plugin) | The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and | medium | 4.4 | 0% |
| CVE-2025-3645 | moodle/moodle | Moodle has an IDOR in messaging web service which allows access to some user details | medium | 4.3 | 0% |
| CVE-2024-21515 | opencart/opencart | Cross site scripting in opencart | medium | 4.2 | 0% |
| CVE-2024-21516 | opencart/opencart | Cross site scripting in opencart | medium | 4.2 | 0% |
| CVE-2026-48013 | shopware/core, shopware/platform | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | medium | 4.1 | 0% |
| CVE-2026-112064 | sgalinski/sg-cookie-optin | TYPO3-EXT-SA-2026-029: SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin) | unknown | 0.0 | 0% |
| CVE-2026-42155 | openmage/magento-lts | Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs | critical | 0.0 | 0% |
| CVE-2026-84921 | drupal/webform_submissions_delete | This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficie | unknown | 0.0 | 0% |
| CVE-2024-1755 | nps-computy (WordPress plugin) | The NPS computy WordPress plugin through 2.7.5 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |
| CVE-2026-31069 | billabear/billabear | BillaBear is Vulnerable to SQL Injection in the EventRepository | high | 8.8 | 0% |
| CVE-2024-1937 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'u | high | 7.1 | 0% |
| CVE-2025-5257 | mautic/core | Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure | medium | 6.5 | 0% |
| CVE-2023-1661 | display-metadata (WordPress plugin) | The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post met | medium | 6.4 | 0% |
| CVE-2023-2498 | go-pricing (WordPress plugin) | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in ver | medium | 6.4 | 0% |
| CVE-2023-2558 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcs_ | medium | 6.4 | 0% |
| CVE-2023-4838 | simple-download-counter (WordPress plugin) | The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, | medium | 6.4 | 0% |
| CVE-2024-4983 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-11356 | tour-master (WordPress plugin) | The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allo | medium | 6.1 | 0% |
| CVE-2022-2375 | wp-sticky-button (WordPress plugin) | The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenti | medium | 5.4 | 0% |
| CVE-2025-0958 | ultimate-auction (WordPress plugin) | The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and | medium | 5.4 | 0% |
| CVE-2025-0318 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | 0% |
| CVE-2023-5945 | wp-responsive-video-gallery-with-lightbox (WordPress plugin) | The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to miss | medium | 4.3 | 0% |
| CVE-2024-10670 | primary-addon-for-elementor (WordPress plugin) | The Primary Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.2 via t | medium | 4.3 | 0% |
| CVE-2024-5459 | food-and-drink-menu (WordPress plugin) | The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check | medium | 4.3 | 0% |
| CVE-2025-50383 | alextselegidis/easyappointments | Easy!Appointments SQL injection vulnerability | medium | 0.0 | 0% |
| CVE-2026-32265 | craftcms/aws-s3 | Amazon S3 for Craft CMS has an Information Disclosure vulnerability | medium | 0.0 | 0% |
| CVE-2026-32266 | craftcms/google-cloud | Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability | low | 0.0 | 0% |
| CVE-2025-4519 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missin | high | 8.8 | 0% |
| CVE-2024-9627 | green-wp-telegram-bot-by-teplitsa (WordPress plugin) | The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization check | high | 8.6 | 0% |
| CVE-2025-26530 | moodle/moodle | Moodle allows reflected XSS via question bank filter | high | 8.3 | 0% |
| CVE-2026-4338 | activitypub (WordPress plugin) | The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts | high | 7.5 | 0% |
| CVE-2024-2297 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insuffici | high | 7.1 | 0% |
| CVE-2024-4362 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortco | medium | 6.4 | 0% |
| CVE-2024-11287 | ebook-store (WordPress plugin) | The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc | medium | 6.1 | 0% |
| CVE-2022-38085 | read-more (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress. | medium | 5.4 | 0% |
| CVE-2024-5644 | tournamatch (WordPress plugin) | The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 0% |
| CVE-2024-45960 | tribalsystems/zenario | Zenario allows authenticated admin users to upload PDF files containing malicious code | medium | 4.8 | 0% |