Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13128 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-2643 | my-sticky-bar (WordPress plugin) | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does no | medium | 4.8 | 0% |
| CVE-2024-6708 | profile-builder (WordPress plugin) | The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the a | medium | 4.8 | 0% |
| CVE-2024-8618 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-8759 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-2258 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 4.4 | 0% |
| CVE-2022-4707 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This i | medium | 4.3 | 0% |
| CVE-2023-48714 | silverstripe/framework | Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter | medium | 4.3 | 0% |
| CVE-2023-6598 | speedycache (WordPress plugin) | The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache | medium | 4.3 | 0% |
| CVE-2024-4002 | carousel\,-slider\,-gallery-by-wp-carousel (WordPress plugin) | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could a | low | 3.5 | 0% |
| CVE-2024-13288 | drupal/monster_menus | This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. In | unknown | 0.0 | 0% |
| CVE-2025-12998 | codingms/modules | TYPO3 Modules Extension has Improper Authentication vulnerability | high | 0.0 | 0% |
| CVE-2026-114573 | drupal/monster_menus | This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page su | unknown | 0.0 | 0% |
| CVE-2019-25214 | wpshopify (WordPress plugin) | The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versio | high | 7.2 | 0% |
| CVE-2024-29142 | better-search (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebberZone Better Search – Relevant se | high | 7.1 | 0% |
| CVE-2022-2449 | resmush.it-image-optimizer (WordPress plugin) | The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its A | medium | 6.5 | 0% |
| CVE-2024-12336 | wc-affiliate (WordPress plugin) | The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missin | medium | 6.5 | 0% |
| CVE-2025-2267 | wp01 (WordPress plugin) | The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capabili | medium | 6.5 | 0% |
| CVE-2024-10784 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-4374 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up t | medium | 6.4 | 0% |
| CVE-2023-4826 | socialdriver (WordPress plugin) | The SocialDriver WordPress theme before version 2024 has a prototype pollution vulnerability that could allow an attacker to inject arbitrar | medium | 6.1 | 0% |
| CVE-2024-11644 | wp-svg (WordPress plugin) | The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/ | medium | 5.9 | 0% |
| CVE-2024-45406 | craftcms/cms | Craft CMS vulnerable to stored XSS in breadcrumb list and title fields | medium | 5.5 | 0% |
| CVE-2024-6710 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contri | medium | 5.4 | 0% |
| CVE-2024-3899 | envira-gallery (WordPress plugin) | The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow | medium | 4.8 | 0% |
| CVE-2024-4384 | cssable-countdown (WordPress plugin) | The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-10853 | buy-one-click-woocommerce (WordPress plugin) | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-13425 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 4.3 | 0% |
| CVE-2024-13429 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 4.3 | 0% |
| CVE-2025-8068 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an impro | medium | 4.3 | 0% |
| CVE-2026-86202 | pocketmine/pocketmine-mp | PocketMine-MP: Network amplification vulnerability with `ActorEventPacket` | medium | 4.3 | 0% |
| CVE-2025-8093 | drupal/alogin | This module allows users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security. | unknown | 0.0 | 0% |
| CVE-2024-8490 | propertyhive (WordPress plugin) | The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due | high | 8.8 | 0% |
| CVE-2026-33651 | wwbn/avideo | AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat() | high | 8.1 | 0% |
| CVE-2024-2322 | woocommerce-cart-abandonment-recovery (WordPress plugin) | The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow att | medium | 6.8 | 0% |
| CVE-2022-3879 | car-dealer (WordPress plugin) | The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in a | medium | 6.5 | 0% |
| CVE-2024-13596 | wp-survey-and-poll (WordPress plugin) | The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'id' at | medium | 6.5 | 0% |
| CVE-2024-2650 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-4373 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 0% |
| CVE-2024-5060 | include-lottie-animation-for-elementor (WordPress plugin) | The LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in | medium | 6.4 | 0% |
| CVE-2024-3241 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2024-5713 | if-so (WordPress plugin) | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outpu | medium | 5.4 | 0% |
| CVE-2024-6243 | html-forms (WordPress plugin) | The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as | medium | 4.8 | 0% |
| CVE-2024-6270 | community-events (WordPress plugin) | The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-6910 | eventon (WordPress plugin) | The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-7918 | pocket-widget (WordPress plugin) | The Pocket Widget WordPress plugin through 0.1.3 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2024-10084 | contact-form-7-dynamic-text-extension (WordPress plugin) | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Basic Information Disclosure in all versions up to, and in | medium | 4.3 | 0% |
| CVE-2024-7063 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the | medium | 4.3 | 0% |
| CVE-2024-13116 | crelly-slider (WordPress plugin) | The Crelly Slider WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users su | low | 3.8 | 0% |
| CVE-2026-113459 | nitsan/ns-t3ai | TYPO3-EXT-SA-2026-035: Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai) | unknown | 0.0 | 0% |