Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9428 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2021-25025 | eventcalendar (WordPress plugin) | The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, | medium | 4.3 | 0% |
| CVE-2022-0634 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privi | medium | 4.3 | 0% |
| CVE-2023-6223 | learnpress (WordPress plugin) | The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the | medium | 4.3 | 0% |
| CVE-2024-1090 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-1091 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-32877 | yiisoft/yii2 | Reflected Cross-site Scripting in yiisoft/yii2 Debug mode | medium | 4.2 | 0% |
| CVE-2024-5770 | wp-force-ssl (WordPress plugin) | The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch | medium | 4.2 | 0% |
| CVE-2024-13282 | drupal/block_permissions | This module enables you to manage blocks from specific modules in the specific themes. The module doesn't sufficiently | unknown | 0.0 | 0% |
| CVE-2025-13080 | drupal/core | Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HT | low | 0.0 | 0% |
| CVE-2023-6946 | autotitle (WordPress plugin) | The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers t | high | 8.8 | 0% |
| CVE-2024-23517 | scheduling-plugin (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Start Booking Scheduling Plugin – Onli | medium | 6.5 | 0% |
| CVE-2024-12725 | clasify-classified-listing (WordPress plugin) | The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page | medium | 6.1 | 0% |
| CVE-2024-46995 | baserproject/basercms | baserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request | medium | 6.1 | 0% |
| CVE-2023-3142 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2024-32981 | silverstripe/framework | Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload | medium | 5.4 | 0% |
| CVE-2023-6504 | profile-builder (WordPress plugin) | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unautho | medium | 4.3 | 0% |
| CVE-2023-6630 | contact-form-7-dynamic-text-extension (WordPress plugin) | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an | medium | 4.3 | 0% |
| CVE-2024-13854 | education-addon (WordPress plugin) | The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2026-23494 | pimcore/pimcore | Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing | medium | 4.3 | 0% |
| CVE-2024-10545 | nextgen-gallery (WordPress plugin) | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which cou | low | 3.5 | 0% |
| CVE-2024-50347 | laravel/reverb | Laravel Reverb Missing API Signature Verification | high | 0.0 | 0% |
| CVE-2026-32870 | getkirby/cms | Kirby has XML injection in its XML creator toolkit | medium | 0.0 | 0% |
| CVE-2025-47776 | mantisbt/mantisbt | MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling | critical | 9.1 | 0% |
| CVE-2024-5767 | sitetweet (WordPress plugin) | The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c | high | 8.8 | 0% |
| CVE-2024-2088 | social-networks-auto-poster-facebook-twitter-g (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | high | 8.5 | 0% |
| CVE-2025-67507 | filament/filament | Filament multi-factor authentication (app) recovery codes can be used multiple times | high | 8.1 | 0% |
| CVE-2022-3946 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to | medium | 6.5 | 0% |
| CVE-2023-50874 | ajax-load-more (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scrol | medium | 6.5 | 0% |
| CVE-2023-6645 | post-grid (WordPress plugin) | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in | medium | 6.4 | 0% |
| CVE-2024-5024 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mepr_screenname' and 'mepr_key' parameter in a | medium | 6.1 | 0% |
| CVE-2024-5282 | wp-affiliate-platform (WordPress plugin) | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 0% |
| CVE-2024-6272 | spidercontacts (WordPress plugin) | The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-9934 | wp-imagezoom (WordPress plugin) | The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading | medium | 6.1 | 0% |
| CVE-2021-27908 | mautic/core | Mautic vulnerable to secret data exfiltration via symfony parameters | medium | 5.8 | 0% |
| CVE-2024-43435 | moodle/moodle | Moodle has insufficient capability checks | medium | 5.3 | 0% |
| CVE-2025-4691 | easync-booking (WordPress plugin) | The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Objec | medium | 5.3 | 0% |
| CVE-2026-35449 | wwbn/avideo | AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php | medium | 5.3 | 0% |
| CVE-2026-48166 | filament/filament | Filament: Timing-based user enumeration on login page | medium | 5.3 | 0% |
| CVE-2023-4500 | order-tracking (WordPress plugin) | The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, a | medium | 4.7 | 0% |
| CVE-2022-2275 | wp-edit-menu (WordPress plugin) | The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin d | medium | 4.3 | 0% |
| CVE-2024-10365 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2025-48493 | yiisoft/yii2-redis | Yii 2 Redis may expose AUTH parameters in logs in case of connection failure | medium | 0.0 | 0% |
| CVE-2026-25482 | craftcms/commerce | Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) | medium | 0.0 | 0% |
| CVE-2023-0759 | cockpit-hq/cockpit | privilege chaining in cockpit-hq/cockpit | high | 8.8 | 0% |
| CVE-2023-1330 | redirection (WordPress plugin) | The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers | medium | 6.5 | 0% |
| CVE-2024-0837 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter G | medium | 6.4 | 0% |
| CVE-2024-1796 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 0% |
| CVE-2024-2127 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom att | medium | 6.4 | 0% |
| CVE-2024-2471 | foogallery (WordPress plugin) | The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as 'Title', 'Alt Text', ' | medium | 6.4 | 0% |