Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12329 | essential-real-estate (WordPress plugin) | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pag | medium | 4.3 | 0% |
| CVE-2026-23495 | pimcore/admin-ui-classic-bundle | Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing | medium | 4.3 | 0% |
| CVE-2025-31476 | drupal/tacjs | This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficientl | unknown | 0.0 | 0% |
| CVE-2026-26016 | pterodactyl/panel | Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization | critical | 0.0 | 0% |
| CVE-2026-6409 | google/protobuf | Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion | high | 0.0 | 0% |
| CVE-2026-76755 | drupal/gammu_smsd | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-80200 | kimai/kimai | Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler | low | 0.0 | 0% |
| CVE-2024-5034 | sully (WordPress plugin) | The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perfor | high | 8.8 | 0% |
| CVE-2024-13776 | zoomsounds (WordPress plugin) | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can | high | 8.1 | 0% |
| CVE-2026-33043 | wwbn/avideo | AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS | high | 8.1 | 0% |
| CVE-2025-24017 | yeswiki/yeswiki | Unauthenticated DOM Based XSS in YesWiki | high | 7.6 | 0% |
| CVE-2025-0511 | usc-e-shop (WordPress plugin) | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and | high | 7.2 | 0% |
| CVE-2025-0918 | smtp-sendgrid (WordPress plugin) | The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4 due | high | 7.2 | 0% |
| CVE-2025-0953 | smtp-sendinblue (WordPress plugin) | The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2 du | high | 7.2 | 0% |
| CVE-2023-7291 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capab | high | 7.1 | 0% |
| CVE-2024-1634 | calendar-booking (WordPress plugin) | The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabi | medium | 6.5 | 0% |
| CVE-2025-0311 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all ve | medium | 6.4 | 0% |
| CVE-2023-6813 | auth0/wordpress | Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting | medium | 6.1 | 0% |
| CVE-2024-13705 | stageshow (WordPress plugin) | The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate es | medium | 6.1 | 0% |
| CVE-2024-5544 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up | medium | 6.1 | 0% |
| CVE-2024-5809 | wp-ajax-contact-form (WordPress plugin) | The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-6226 | wpstickybar (WordPress plugin) | The WpStickyBar WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 0% |
| CVE-2026-33237 | wwbn/avideo | AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation | medium | 5.5 | 0% |
| CVE-2023-0086 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This | medium | 5.4 | 0% |
| CVE-2024-10563 | woo-cart-count-shortcode (WordPress plugin) | The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outp | medium | 5.4 | 0% |
| CVE-2024-12104 | atarim-visual-collaboration (WordPress plugin) | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due | medium | 5.3 | 0% |
| CVE-2024-11221 | full-screen-\(page\)-background-image-slideshow (WordPress plugin) | The Full Screen (Page) Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which coul | medium | 4.8 | 0% |
| CVE-2024-7769 | clicksold-idx (WordPress plugin) | The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-13608 | track-logins (WordPress plugin) | The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins t | medium | 4.7 | 0% |
| CVE-2024-3754 | alemha-watermark (WordPress plugin) | The Alemha watermarker WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.7 | 0% |
| CVE-2025-11322 | novosga/novosga | NovoSGA: Manipulation of User Creation Page can lead to weak password requirements | low | 3.7 | 0% |
| CVE-2023-2010 | forminator (WordPress plugin) | The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update th | low | 3.1 | 0% |
| CVE-2024-3178 | concrete5/concrete5 | Concrete CMS Cross-site Scripting (XSS) in the Advanced File Search Filter | low | 3.1 | 0% |
| CVE-2024-3179 | concrete5/concrete5 | Concrete CMS Stored XSS in the Custom Class page editing | low | 3.1 | 0% |
| CVE-2024-3180 | concrete5/concrete5 | Concrete CMS Stored XSS in blocks of type file | low | 3.1 | 0% |
| CVE-2024-3181 | concrete5/concrete5 | Concrete CMS Stored XSS in the Search Field | low | 3.1 | 0% |
| CVE-2024-13278 | drupal/diff | This module adds a tab for sufficiently permissioned users. The tab shows all revisions like standard Drupal but it also | unknown | 0.0 | 0% |
| CVE-2024-13281 | drupal/monster_menus | This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. A f | unknown | 0.0 | 0% |
| CVE-2025-3734 | drupal/stage_file_proxy | Stage File Proxy is a general solution for getting production files on a development server on demand. The module doesn | unknown | 0.0 | 0% |
| CVE-2026-33158 | craftcms/cms | Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) | medium | 0.0 | 0% |
| CVE-2026-56385 | craftcms/cms | Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata | low | 0.0 | 0% |
| CVE-2026-50636 | limesurvey/limesurvey | LimeSurvey has a SQL Injection issue | high | 8.8 | 0% |
| CVE-2026-62368 | snipe/snipe-it | Snipe-IT: Stored XSS via Custom Field name in asset-list column headers | high | 8.1 | 0% |
| CVE-2024-12861 | w2s-migrate-woo-to-shopify (WordPress plugin) | The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2 | medium | 6.5 | 0% |
| CVE-2024-2226 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-2788 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Title HTML Tag in all versions | medium | 6.4 | 0% |
| CVE-2024-3053 | forminator (WordPress plugin) | The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-0427 | arforms (WordPress plugin) | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is | medium | 6.3 | 0% |
| CVE-2024-12409 | simplepress (WordPress plugin) | The Simple:Press Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and | medium | 6.1 | 0% |
| CVE-2026-57994 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ public FAQ APIs expose inactive FAQ content | medium | 5.3 | 0% |