Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-55374 | jleehr/canto-saas-api | canto-saas-api: Authenticated API requests can be redirected via unencoded path variables | medium | 4.8 | 0% |
| CVE-2021-24836 | temporary-login-without-password (WordPress plugin) | The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, w | medium | 4.3 | 0% |
| CVE-2022-3880 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have pr | medium | 6.5 | 0% |
| CVE-2024-10268 | mp3-music-player-by-sonaar (WordPress plugin) | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-3345 | woolentor-addons (WordPress plugin) | The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woolentorsearch shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-4361 | siteorigin-panels (WordPress plugin) | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortc | medium | 6.4 | 0% |
| CVE-2024-4634 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hfe_svg_mime_types’ functio | medium | 6.4 | 0% |
| CVE-2024-4876 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popover_header_text’ | medium | 6.4 | 0% |
| CVE-2024-12467 | pago-redsys-tpv-grafreak (WordPress plugin) | The Pago por Redsys plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'Ds_MerchantParameters' parameter in all ve | medium | 6.1 | 0% |
| CVE-2024-34003 | moodle/moodle | Moodle Authenticated LFI risk in some misconfigured shared hosting environments | medium | 5.9 | 0% |
| CVE-2022-36798 | mega-addons-for-visual-composer (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress. | medium | 5.4 | 0% |
| CVE-2023-2171 | badgeos (WordPress plugin) | The BadgeOS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including | medium | 5.4 | 0% |
| CVE-2024-3978 | wordpress-jitsi-shortcode (WordPress plugin) | The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not validate and escape some of its shortcode attributes before outputting t | medium | 5.4 | 0% |
| CVE-2024-11299 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the W | medium | 5.3 | 0% |
| CVE-2024-11645 | float-block (WordPress plugin) | The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-9776 | image-gallery (WordPress plugin) | The ImagePress – Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, a | medium | 4.4 | 0% |
| CVE-2025-67857 | moodle/moodle | Moodle Inserts Sensitive Information Into Sent Data | medium | 4.3 | 0% |
| CVE-2025-46346 | yeswiki/yeswiki | YesWiki Stored XSS Vulnerability in Comments | low | 0.0 | 0% |
| CVE-2024-10646 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | high | 7.2 | 0% |
| CVE-2025-69197 | pterodactyl/panel | Pterodactyl TOTPs can be reused during validity window | medium | 6.5 | 0% |
| CVE-2024-5199 | spotify-play-button (WordPress plugin) | The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2024-4970 | widget-bundle (WordPress plugin) | The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2023-4648 | wp-customer-reviews (WordPress plugin) | The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and includin | medium | 4.4 | 0% |
| CVE-2022-1956 | shortcut-macros (WordPress plugin) | The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which coul | medium | 4.3 | 0% |
| CVE-2024-0372 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of da | medium | 4.3 | 0% |
| CVE-2024-1078 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ays_quick_st | medium | 4.3 | 0% |
| CVE-2024-34006 | moodle/moodle | Moodle Unsanitized HTML in site log for config_log_created | medium | 4.3 | 0% |
| CVE-2024-35720 | album-gallery (WordPress plugin) | Missing Authorization vulnerability in A WP Life Album Gallery – WordPress Gallery.This issue affects Album Gallery – WordPress Gallery: fro | medium | 4.3 | 0% |
| CVE-2025-54139 | elmsln/haxcms | HAX CMS application pages vulnerable to clickjacking | medium | 4.3 | 0% |
| CVE-2024-9654 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack | low | 3.7 | 0% |
| CVE-2024-13266 | drupal/responsive_menu | This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and | unknown | 0.0 | 0% |
| CVE-2024-34007 | moodle/moodle | Moodle Logout CSRF in admin/tool/mfa/auth.php | medium | 0.0 | 0% |
| CVE-2026-18260 | drupal/disable_login | An advisory for this issue has been issued at <https://www.drupal.org/sa-contrib-2026-110> and an additional issue was i | unknown | 0.0 | 0% |
| CVE-2026-33297 | wwbn/avideo | AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php | medium | 0.0 | 0% |
| CVE-2026-49738 | typo3/cms-core | TYPO3 CMS has Broken Access Control in its File Abstraction Layer | low | 0.0 | 0% |
| CVE-2023-25365 | october/october | October CMS Cross-site Scripting vulnerability | high | 7.8 | 0% |
| CVE-2024-5784 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on | high | 7.1 | 0% |
| CVE-2022-4016 | booster-for-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for Woo | medium | 6.5 | 0% |
| CVE-2025-5956 | hrm (WordPress plugin) | The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the aja | medium | 6.5 | 0% |
| CVE-2024-1377 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author_meta_tag’ attribute of the | medium | 6.4 | 0% |
| CVE-2024-1987 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all vers | medium | 6.4 | 0% |
| CVE-2024-2337 | easy-testimonials (WordPress plugin) | The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonials_grid ' shortcode in a | medium | 6.4 | 0% |
| CVE-2024-6340 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all | medium | 6.4 | 0% |
| CVE-2026-71478 | league/commonmark | league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes | medium | 6.1 | 0% |
| CVE-2023-41241 | surecart (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SureCart WordPress Ecommerce For Creating Fast Online Stores plugin <= 2.5 | medium | 5.9 | 0% |
| CVE-2025-1063 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in | medium | 5.3 | 0% |
| CVE-2025-14757 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including | medium | 5.3 | 0% |
| CVE-2024-10362 | social-media-share-buttons-\&-social-sharing-icons (WordPress plugin) | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which | medium | 4.8 | 0% |
| CVE-2024-12743 | mailpoet (WordPress plugin) | The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-12770 | wp-ulike (WordPress plugin) | The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |