Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-29430 | png-to-jpg (WordPress plugin) | Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable | medium | 4.7 | 0% |
| CVE-2024-5553 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via several parameters in all v | medium | 4.4 | 0% |
| CVE-2022-2377 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated user | medium | 4.3 | 0% |
| CVE-2022-2382 | product-slider-for-woocommerce (WordPress plugin) | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, | medium | 4.3 | 0% |
| CVE-2022-2389 | funnelkit-automations (WordPress plugin) | The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before | medium | 4.3 | 0% |
| CVE-2023-4920 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |
| CVE-2023-2608 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the ord | low | 3.1 | 0% |
| CVE-2026-44176 | getkirby/cms | Kirby CMS's `pages.access` permission is not checked during rendering of page drafts | medium | 0.0 | 0% |
| CVE-2026-45334 | getkirby/cms | Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions | medium | 0.0 | 0% |
| CVE-2026-50279 | craftcms/cms | Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap | high | 0.0 | 0% |
| CVE-2026-50283 | craftcms/cms | Craft CMS: Unauthorized Deletion of Source Assets During File Replacement | medium | 0.0 | 0% |
| CVE-2026-33719 | wwbn/avideo | AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment | high | 8.6 | 0% |
| CVE-2023-6964 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all vers | high | 8.5 | 0% |
| CVE-2024-45690 | moodle/moodle | Moodle IDOR when deleting OAuth2 linked accounts | high | 7.5 | 0% |
| CVE-2026-53637 | sylius/sylius | Sylius: Cart FormComponent allows modification or deletion of an already-completed order | medium | 6.5 | 0% |
| CVE-2024-9027 | wpzoom-shortcodes (WordPress plugin) | The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2024-9895 | clover-online-orders (WordPress plugin) | The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo_receipt_link shortc | medium | 6.4 | 0% |
| CVE-2024-9967 | wp-show-more (WordPress plugin) | The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_more shortcode in all versions up t | medium | 6.4 | 0% |
| CVE-2024-6019 | music-request-manager (WordPress plugin) | The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticat | medium | 6.1 | 0% |
| CVE-2023-2021 | nilsteampassnet/teampass | nilsteampassnet/teampass vulnerable to stored cross-site scripting (XSS) | medium | 5.8 | 0% |
| CVE-2024-0452 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_ | medium | 5.0 | 0% |
| CVE-2024-0453 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_ | medium | 5.0 | 0% |
| CVE-2024-25119 | typo3/cms-core | TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key | medium | 4.9 | 0% |
| CVE-2022-0638 | microweber/microweber | Cross-Site Request Forgery microweber | medium | 4.3 | 0% |
| CVE-2024-7429 | zotpress (WordPress plugin) | The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_proce | medium | 4.3 | 0% |
| CVE-2024-9364 | wp-sendgrid-mailer (WordPress plugin) | The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mail | medium | 4.3 | 0% |
| CVE-2024-0628 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the | low | 3.8 | 0% |
| CVE-2025-7053 | cockpit-hq/cockpit | Cockpit - Content Platform vulnerable to XSS through name or email argument names | low | 3.5 | 0% |
| CVE-2025-8678 | johnbillion/wp-crontrol | WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery | medium | 0.0 | 0% |
| CVE-2026-120330 | mediaessenz/mail | TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail) | unknown | 0.0 | 0% |
| CVE-2026-34579 | mantisbt/mantisbt | MantisBT has an authorization bypass in private issue monitoring | medium | 0.0 | 0% |
| CVE-2026-41325 | getkirby/cms | Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection | high | 0.0 | 0% |
| CVE-2025-2103 | soundrise (WordPress plugin) | The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a m | high | 8.8 | 0% |
| CVE-2024-6637 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and includi | high | 7.3 | 0% |
| CVE-2024-11720 | acf-frontend-form-element (WordPress plugin) | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up t | high | 7.2 | 0% |
| CVE-2024-3137 | uvdesk/core-framework | UVDesk Community Helpdesk Improper Privilege Management | high | 7.1 | 0% |
| CVE-2024-10233 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_subscr | medium | 6.4 | 0% |
| CVE-2024-1042 | wp-radio (WordPress plugin) | The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to unauthorized modification of da | medium | 6.4 | 0% |
| CVE-2024-4892 | buddypress (WordPress plugin) | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-11327 | clickwhale (WordPress plugin) | The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Refle | medium | 6.1 | 0% |
| CVE-2024-13363 | adthrive-ads (WordPress plugin) | The Raptive Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'poc' parameter in all versions up to, and incl | medium | 6.1 | 0% |
| CVE-2024-6494 | wordpress-file-upload (WordPress plugin) | The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthe | medium | 6.1 | 0% |
| CVE-2023-41731 | wordpress-publish-post-email-notification (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress publish post email notification plugin < | medium | 5.9 | 0% |
| CVE-2022-43491 | advanced-dynamic-pricing-for-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin s | medium | 5.4 | 0% |
| CVE-2024-0828 | play-ht (WordPress plugin) | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to unauthorized access of functio | medium | 5.4 | 0% |
| CVE-2024-13741 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all ver | medium | 5.4 | 0% |
| CVE-2024-9587 | linkz-ai (WordPress plugin) | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_linkz' f | medium | 5.4 | 0% |
| CVE-2024-13605 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-6335 | tracking-code-manager (WordPress plugin) | The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-6617 | header-footer-custom-code (WordPress plugin) | The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow hig | medium | 4.8 | 0% |