Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8369 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-prot | medium | 5.3 | 0% |
| CVE-2026-34973 | thorsten/phpmyfaq | phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure | medium | 5.3 | 0% |
| CVE-2023-6624 | import-users-from-csv-with-meta (WordPress plugin) | The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in | medium | 4.9 | 0% |
| CVE-2024-5004 | cm-popup (WordPress plugin) | The CM Popup Plugin for WordPress WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could all | medium | 4.8 | 0% |
| CVE-2022-0164 | coming-soon-and-maintenance-mode (WordPress plugin) | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail | medium | 4.3 | 0% |
| CVE-2024-12331 | filester (WordPress plugin) | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2025-54869 | setasign/fpdi | FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service | medium | 0.0 | 0% |
| CVE-2026-116675 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization | high | 0.0 | 0% |
| CVE-2026-44657 | mantisbt/mantisbt | MantisBT Vulnerable to Stored XSS in File Download | high | 0.0 | 0% |
| CVE-2022-4017 | booster-elite-woocommerce (WordPress plugin), booster-for-woocommerce (WordPress plugin), booster-plus-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for Woo | high | 8.8 | 0% |
| CVE-2023-6532 | wp-blogs-planetarium (WordPress plugin) | The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attac | high | 8.8 | 0% |
| CVE-2026-43884 | wwbn/avideo | AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() | high | 7.7 | 0% |
| CVE-2024-13704 | super-testimonial (WordPress plugin) | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions u | high | 7.2 | 0% |
| CVE-2024-22075 | grumpydictator/firefly-iii | Firefly III allows webhooks HTML Injection. | medium | 6.5 | 0% |
| CVE-2026-47226 | admidio/admidio | Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges | medium | 6.5 | 0% |
| CVE-2023-6744 | divi (WordPress plugin) | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-2787 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title HTML Tag in all versions | medium | 6.4 | 0% |
| CVE-2026-1193 | mineadmin/mineadmin | MineAdmin has Incorrect Privilege Assignment | medium | 6.3 | 0% |
| CVE-2024-8799 | custom-banners (WordPress plugin) | The Custom Banners plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate | medium | 6.1 | 0% |
| CVE-2024-9462 | poll-maker (WordPress plugin) | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting via poll setti | medium | 5.5 | 0% |
| CVE-2021-24912 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could al | medium | 5.4 | 0% |
| CVE-2024-9599 | popup-box (WordPress plugin) | The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 0% |
| CVE-2024-13537 | c9-blocks (WordPress plugin) | The C9 Blocks plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.7.7. This is due the plugin | medium | 5.3 | 0% |
| CVE-2026-33041 | wwbn/avideo | AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php | medium | 5.3 | 0% |
| CVE-2024-7891 | floating-contact-button (WordPress plugin) | The Floating Contact Button WordPress plugin before 2.8 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-27087 | getkirby/cms | Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type | medium | 4.6 | 0% |
| CVE-2022-2387 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure | medium | 4.3 | 0% |
| CVE-2026-3058 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28. | medium | 4.3 | 0% |
| CVE-2026-86203 | pocketmine/pocketmine-mp | PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state | low | 3.7 | 0% |
| CVE-2026-11914 | drupal/composer | The security team is marking the Composer module for Drupal project unsupported. There is a known security issue with th | unknown | 0.0 | 0% |
| CVE-2026-45065 | symfony/routing, symfony/symfony | Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection | medium | 0.0 | 0% |
| CVE-2026-48784 | symfony/routing, symfony/symfony | Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normal | medium | 0.0 | 0% |
| CVE-2026-76758 | drupal/postlight_parser | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2024-3406 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers | high | 8.8 | 0% |
| CVE-2024-3643 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in | high | 8.8 | 0% |
| CVE-2026-41230 | froxlor/froxlor | Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add() | high | 8.5 | 0% |
| CVE-2026-33692 | wwbn/avideo | AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration | high | 7.5 | 0% |
| CVE-2024-12607 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'mj_smgt_show_e | medium | 6.5 | 0% |
| CVE-2024-13781 | hero-maps-premium (WordPress plugin) | The Hero Maps Premium plugin for WordPress is vulnerable to SQL Injection via several AJAX actions in all versions up to, and including, 2.3 | medium | 6.5 | 0% |
| CVE-2025-5998 | password-protect-wordpress (WordPress plugin) | The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, how | medium | 6.5 | 0% |
| CVE-2026-34733 | wwbn/avideo | AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard | medium | 6.5 | 0% |
| CVE-2024-12736 | bu-section-editing (WordPress plugin) | The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leadin | medium | 6.1 | 0% |
| CVE-2024-25399 | intelliants/subrion | Subrion CMS vulnerable to Cross Site Scripting | medium | 6.1 | 0% |
| CVE-2024-3917 | pet-manager (WordPress plugin) | The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 0% |
| CVE-2024-6715 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-48 | medium | 6.1 | 0% |
| CVE-2024-7692 | flaming-forms (WordPress plugin) | The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-10705 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includ | medium | 5.4 | 0% |
| CVE-2026-104181 | filament/filament | Filament: Multi-factor authentication (app) management actions do not require password reauthentication | medium | 5.4 | 0% |
| CVE-2022-4100 | wp-cerber (WordPress plugin) | The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin imp | medium | 5.3 | 0% |
| CVE-2025-14072 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can | medium | 5.3 | 0% |