Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8284 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2024-8492 | hustle (WordPress plugin) | The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-8493 | the-events-calendar (WordPress plugin) | The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-8542 | everest-forms (WordPress plugin) | The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-8670 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2026-41656 | admidio/admidio | Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read | medium | 4.5 | 0% |
| CVE-2024-11852 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulner | medium | 4.3 | 0% |
| CVE-2024-3893 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a | medium | 4.3 | 0% |
| CVE-2024-5665 | easy-login-woocommerce (WordPress plugin) | The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capa | medium | 4.3 | 0% |
| CVE-2024-6033 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due | medium | 4.3 | 0% |
| CVE-2024-2753 | concrete5/concrete5 | Concrete CMS Stored XSS on the calendar color settings screen | low | 2.0 | 0% |
| CVE-2026-34744 | mantisbt/mantisbt | MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue | medium | 0.0 | 0% |
| CVE-2026-46721 | evoweb/sf-register | TYPO3 sf_register extension allows unauthorized assignment of frontend user groups | medium | 0.0 | 0% |
| CVE-2026-49981 | twig/twig | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` | high | 0.0 | 0% |
| CVE-2024-12314 | rapid-cache (WordPress plugin) | The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin sto | high | 7.2 | 0% |
| CVE-2024-46998 | baserproject/basercms | baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature | high | 7.1 | 0% |
| CVE-2024-49758 | librenms/librenms | LibreNMS has a stored XSS in ExamplePlugin with Device's Notes | medium | 6.8 | 0% |
| CVE-2026-32279 | opensource-workshop/connect-cms | Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin | medium | 6.8 | 0% |
| CVE-2023-22713 | gutenberg-blocks-for-wordpress-download-manager (WordPress plugin) | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager p | medium | 6.5 | 0% |
| CVE-2023-23664 | convertbox-auto-embed (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ConvertBox ConvertBox Auto Embed WordPress plugin <= 1.0.19 versions | medium | 6.5 | 0% |
| CVE-2023-23670 | fancy-comments (WordPress plugin) | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin <= 1.2.10 versions. | medium | 6.5 | 0% |
| CVE-2023-23685 | portfolio (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin <= 2.8.10 version | medium | 6.5 | 0% |
| CVE-2023-45067 | wordpress-simple-html-sitemap (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions. | medium | 6.5 | 0% |
| CVE-2024-9657 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.5 | 0% |
| CVE-2024-39682 | cooked (WordPress plugin) | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1 | medium | 6.4 | 0% |
| CVE-2024-4569 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, an | medium | 6.4 | 0% |
| CVE-2024-5088 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2022-38454 | kraken-image-optimizer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io Image Optimizer plugin <= 2.6.5 at WordPress. | medium | 5.4 | 0% |
| CVE-2025-3471 | sureforms (WordPress plugin) | The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which cou | medium | 4.9 | 0% |
| CVE-2024-12719 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_aj | medium | 4.3 | 0% |
| CVE-2024-1861 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unautho | medium | 4.3 | 0% |
| CVE-2024-8771 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | medium | 4.3 | 0% |
| CVE-2024-41676 | openmage/magento-lts | Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs | medium | 4.1 | 0% |
| CVE-2026-33160 | craftcms/cms | Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL | low | 0.0 | 0% |
| CVE-2026-87938 | drupal/csp_log | The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom sto | unknown | 0.0 | 0% |
| CVE-2024-8548 | kb-support (WordPress plugin) | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due | high | 8.1 | 0% |
| CVE-2025-12466 | drupal/simple_oauth | This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with a | high | 7.5 | 0% |
| CVE-2024-10322 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up | medium | 6.4 | 0% |
| CVE-2024-2492 | powerpack-lite-for-elementor (WordPress plugin) | The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Tweet widget in all ver | medium | 6.4 | 0% |
| CVE-2024-2513 | wp-chat-app (WordPress plugin) | The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-2783 | gamipress (WordPress plugin) | The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-2847 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | 0% |
| CVE-2025-0350 | wow-carousel-for-divi-lite (WordPress plugin) | The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting v | medium | 6.4 | 0% |
| CVE-2025-1005 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion widget i | medium | 6.4 | 0% |
| CVE-2025-4669 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2025-4670 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 6.4 | 0% |
| CVE-2025-4208 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all vers | medium | 6.3 | 0% |
| CVE-2024-47173 | aimeos/ai-admin-graphql | ai-admin-graphql has a Denial of service vulnerability in SaaS and marketplace setups | medium | 5.5 | 0% |
| CVE-2024-9025 | sight (WordPress plugin) | The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-10326 | rometheme-for-elementor (WordPress plugin) | The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |