Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3474 | wow-skype-buttons (WordPress plugin) | The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logg | high | 8.8 | 0% |
| CVE-2024-3476 | side-menu-lite (WordPress plugin) | The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged | high | 8.8 | 0% |
| CVE-2026-42843 | getgrav/grav-plugin-api | Grav API Privilege Escalation to Super Admin | high | 8.8 | 0% |
| CVE-2025-53368 | starcitizentools/citizen-skin | starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions | high | 8.6 | 0% |
| CVE-2023-2842 | wp-inventory-manager (WordPress plugin) | The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins de | high | 8.1 | 0% |
| CVE-2026-47231 | admidio/admidio | Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders | high | 8.1 | 0% |
| CVE-2026-55409 | filament/forms | Filament: Disabled RichEditor field state can be used for XSS | high | 7.6 | 0% |
| CVE-2026-75831 | getgrav/grav | Grav: Stored XSS via Markdown audio/video media <source> URL | high | 7.6 | 0% |
| CVE-2025-30152 | sylius/paypal-plugin | Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout | medium | 6.5 | 0% |
| CVE-2024-1238 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button ID parameter in all versio | medium | 6.4 | 0% |
| CVE-2024-4695 | move-addons (WordPress plugin) | The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-47618 | sulu/sulu | Cross-site Scripting via uploaded SVG | medium | 6.1 | 0% |
| CVE-2022-38059 | access-code-feeder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress. | medium | 5.5 | 0% |
| CVE-2024-4759 | mime-types-extended (WordPress plugin) | The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Au | medium | 5.5 | 0% |
| CVE-2025-48958 | froxlor/froxlor | Froxlor has an HTML Injection Vulnerability | medium | 5.5 | 0% |
| CVE-2024-13368 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 4.3 | 0% |
| CVE-2024-6410 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio | medium | 4.3 | 0% |
| CVE-2024-7030 | clover-online-orders (WordPress plugin) | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 4.3 | 0% |
| CVE-2025-12189 | bread-butter (WordPress plugin) | The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to C | medium | 4.3 | 0% |
| CVE-2025-58769 | auth0/auth0-php | auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import | low | 3.3 | 0% |
| CVE-2024-48900 | moodle/moodle | Moodle IDOR when accessing list of badge recipients | medium | 0.0 | 0% |
| CVE-2026-112239 | nitsan/ns-t3ai | TYPO3-EXT-SA-2026-035: Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai) | unknown | 0.0 | 0% |
| CVE-2026-18985 | drupal/edit_in_place_field | This module provides formatters to allow in-place editing in a View or other display (full content, teaser...). The mod | unknown | 0.0 | 0% |
| CVE-2026-55483 | snipe/snipe-it | Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation | medium | 0.0 | 0% |
| CVE-2024-11641 | vikbooking (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ | high | 8.8 | 0% |
| CVE-2024-11601 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Vide | high | 8.1 | 0% |
| CVE-2023-6007 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capabilit | high | 7.3 | 0% |
| CVE-2023-3412 | image-map-pro-lite (WordPress plugin) | The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in | medium | 6.4 | 0% |
| CVE-2023-6877 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Store | medium | 6.4 | 0% |
| CVE-2024-3563 | genesis-blocks (WordPress plugin) | The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-4697 | cowidgets-elementor-addons (WordPress plugin) | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_tag’ parameter in all ve | medium | 6.4 | 0% |
| CVE-2024-4868 | extensions-for-elementor (WordPress plugin) | The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's EE Events and EE Flipbox wid | medium | 6.4 | 0% |
| CVE-2024-5457 | pandavideo (WordPress plugin) | The Panda Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and includin | medium | 6.4 | 0% |
| CVE-2024-5504 | rife-elementor-extensions (WordPress plugin) | The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute within t | medium | 6.4 | 0% |
| CVE-2024-8267 | radio-player (WordPress plugin) | The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Stored Cross-Site | medium | 6.4 | 0% |
| CVE-2024-8323 | easy-pricing-tables (WordPress plugin) | The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFam | medium | 6.4 | 0% |
| CVE-2024-8442 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-8858 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘piechart_settings’ parameter in | medium | 6.4 | 0% |
| CVE-2024-8861 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up | medium | 6.4 | 0% |
| CVE-2024-9127 | sola-testimonials (WordPress plugin) | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alignment’ parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2024-9178 | woo-floating-cart-lite (WordPress plugin) | The XT Floating Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions | medium | 6.4 | 0% |
| CVE-2024-9505 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget | medium | 6.4 | 0% |
| CVE-2024-9897 | streamweasels-twitch-integration (WordPress plugin) | The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-twitch-embed shor | medium | 6.4 | 0% |
| CVE-2025-48447 | drupal/lightgallery | This module integrates Drupal with LightGallery, enabling the use of the LightGallery library with any image field or vi | medium | 6.3 | 0% |
| CVE-2024-11204 | forumwp (WordPress plugin) | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all v | medium | 6.1 | 0% |
| CVE-2024-5969 | aiomatic (WordPress plugin) | The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and inclu | medium | 5.8 | 0% |
| CVE-2023-1160 | cockpit-hq/cockpit | Cockpit Uses Platform-Dependent Third Party Components | medium | 5.5 | 0% |
| CVE-2023-1515 | pimcore/pimcore | Pimcore vulnerable to Cross-site Scripting (XSS) in Redirects | medium | 5.4 | 0% |
| CVE-2024-11768 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password vali | medium | 5.3 | 0% |
| CVE-2024-13318 | essential-wp-real-estate (WordPress plugin) | The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_li | medium | 5.3 | 0% |