Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2949 | wp-carousel-free (WordPress plugin) | The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid fo | medium | 6.4 | 0% |
| CVE-2024-9618 | master-addons (WordPress plugin) | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnera | medium | 6.4 | 0% |
| CVE-2026-55475 | snipe/snipe-it | Snipe-IT's import created_by can be overwritten | medium | 5.7 | 0% |
| CVE-2022-1757 | pagebar (WordPress plugin) | The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a | medium | 5.4 | 0% |
| CVE-2022-36288 | download-manager (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | medium | 5.4 | 0% |
| CVE-2024-10504 | arforms (WordPress plugin) | The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputt | medium | 5.4 | 0% |
| CVE-2024-45292 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks | medium | 5.4 | 0% |
| CVE-2025-1262 | advanced-google-recaptcha (WordPress plugin) | The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it po | medium | 5.3 | 0% |
| CVE-2021-24730 | logo-showcase-with-slick-slider (WordPress plugin) | The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_d | medium | 4.3 | 0% |
| CVE-2022-0363 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, al | medium | 4.3 | 0% |
| CVE-2024-10319 | xpro-elementor-addons (WordPress plugin) | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 4.3 | 0% |
| CVE-2024-10352 | magical-addons-for-elementor (WordPress plugin) | The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2024-9541 | news-kit-elementor-addons (WordPress plugin) | The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2 | medium | 4.3 | 0% |
| CVE-2024-9889 | elementinvader-addons-for-elementor (WordPress plugin) | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl | medium | 4.3 | 0% |
| CVE-2026-32817 | admidio/admidio | Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion | critical | 9.1 | 0% |
| CVE-2025-48446 | drupal/commerce_alphabank_redirect | This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't | high | 8.8 | 0% |
| CVE-2023-50892 | thegem (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Pu | high | 7.1 | 0% |
| CVE-2022-3882 | wp-memory (WordPress plugin) | The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authoris | medium | 6.5 | 0% |
| CVE-2022-3883 | stopbadbots (WordPress plugin) | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authori | medium | 6.5 | 0% |
| CVE-2024-4445 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 6.5 | 0% |
| CVE-2026-48500 | filament/filament | Filament: Unauthenticated temporary file upload on auth pages | medium | 6.5 | 0% |
| CVE-2024-10080 | easy-post-types (WordPress plugin) | The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4 | medium | 6.4 | 0% |
| CVE-2024-1419 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ attribute of the Header Me | medium | 6.4 | 0% |
| CVE-2024-1506 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tags' attribute of | medium | 6.4 | 0% |
| CVE-2024-2345 | filebird (WordPress plugin) | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fold | medium | 6.4 | 0% |
| CVE-2024-2392 | blocksy-companion (WordPress plugin) | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions u | medium | 6.4 | 0% |
| CVE-2024-2803 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions | medium | 6.4 | 0% |
| CVE-2024-2919 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Cou | medium | 6.4 | 0% |
| CVE-2024-3285 | ml-slider (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 6.4 | 0% |
| CVE-2024-3343 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2025-4577 | custom-facebook-feed (WordPress plugin) | The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2025-51489 | moonshine/moonshine | MoonShine Arbitrary File Upload Vulnerability | medium | 4.5 | 0% |
| CVE-2024-0893 | schema-app-structured-data-for-schemaorg (WordPress plugin) | The Schema App Structured Data plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-11844 | ideapush (WordPress plugin) | The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the idea_push_taxo | medium | 4.3 | 0% |
| CVE-2024-12596 | lifterlms (WordPress plugin) | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missi | medium | 4.3 | 0% |
| CVE-2024-1955 | wp-hide-backed-notices (WordPress plugin) | The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o | medium | 4.3 | 0% |
| CVE-2024-3602 | promolayer-popup-builder (WordPress plugin) | The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2024-3711 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the f | medium | 4.3 | 0% |
| CVE-2024-4788 | boostify-header-footer-builder (WordPress plugin) | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2024-50701 | nilsteampassnet/teampass | TeamPass does not properly check whether a folder is in a user's allowed folders list | medium | 4.3 | 0% |
| CVE-2024-5438 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions | medium | 4.3 | 0% |
| CVE-2024-5449 | wp-dark-mode (WordPress plugin) | The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is | medium | 4.3 | 0% |
| CVE-2024-6987 | orchid-store (WordPress plugin) | The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchid_sto | medium | 4.3 | 0% |
| CVE-2024-9531 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification | medium | 4.3 | 0% |
| CVE-2024-12767 | buddyboss-platform (WordPress plugin) | The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private p | low | 3.5 | 0% |
| CVE-2026-45063 | symfony/security-http, symfony/symfony | Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator | high | 0.0 | 0% |
| CVE-2026-96377 | drupal/combined_image_style | This module enables you to combine multiple image styles into a single image derivative. The module does not sufficient | unknown | 0.0 | 0% |
| CVE-2026-41143 | yeswiki/yeswiki | YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave() | high | 8.8 | 0% |
| CVE-2026-76839 | getgrav/grav | Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via | high | 7.7 | 0% |
| CVE-2024-50355 | librenms/librenms | LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints | high | 7.2 | 0% |