Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3926 | wp-oauth-server (WordPress plugin) | The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could all | medium | 6.5 | 0% |
| CVE-2022-4266 | bulk-delete-users-by-email (WordPress plugin) | The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to mak | medium | 6.5 | 0% |
| CVE-2023-6805 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind | medium | 6.4 | 0% |
| CVE-2024-10187 | mycred (WordPress plugin) | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, an | medium | 6.4 | 0% |
| CVE-2024-3639 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Posts Grid widget in al | medium | 6.4 | 0% |
| CVE-2024-4160 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-4342 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, i | medium | 6.4 | 0% |
| CVE-2024-4385 | envo-extra (WordPress plugin) | The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1 | medium | 6.4 | 0% |
| CVE-2024-4458 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in several widgets via URL parameters | medium | 6.4 | 0% |
| CVE-2024-4459 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in al | medium | 6.4 | 0% |
| CVE-2024-4821 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbo | medium | 6.4 | 0% |
| CVE-2024-5229 | primary-addon-for-elementor (WordPress plugin) | The Primary Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in a | medium | 6.4 | 0% |
| CVE-2024-5576 | tutor-lms-elementor-addons (WordPress plugin) | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute wi | medium | 6.4 | 0% |
| CVE-2024-6263 | wp-lightbox-2 (WordPress plugin) | The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-8045 | advanced-backgrounds (WordPress plugin) | The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all ver | medium | 6.4 | 0% |
| CVE-2024-8103 | wp-category-dropdown (WordPress plugin) | The WP Category Dropdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-8317 | wpadcenter (WordPress plugin) | The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ad_alignment’ attribut | medium | 6.4 | 0% |
| CVE-2024-8919 | confetti-fall-animation (WordPress plugin) | The Confetti Fall Animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'confetti-fall-animation' sho | medium | 6.4 | 0% |
| CVE-2024-8964 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all ve | medium | 6.4 | 0% |
| CVE-2024-11107 | system-dashboard (WordPress plugin) | The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which cou | medium | 6.1 | 0% |
| CVE-2022-38139 | rd-station (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress. | medium | 5.4 | 0% |
| CVE-2024-12768 | responsive-iframe (WordPress plugin) | The Responsive iframe WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a | medium | 5.4 | 0% |
| CVE-2025-3643 | moodle/moodle | Moodle has reflected Cross-site Scripting risk in policy tool | medium | 5.4 | 0% |
| CVE-2024-11133 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_ | medium | 5.3 | 0% |
| CVE-2024-8520 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | 0% |
| CVE-2024-2218 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privi | medium | 4.6 | 0% |
| CVE-2023-4839 | wp-google-maps (WordPress plugin) | The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to | medium | 4.4 | 0% |
| CVE-2022-1591 | wordpress-ping-optimizer (WordPress plugin) | The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could al | medium | 4.3 | 0% |
| CVE-2026-55462 | snipe/snipe-it | Snipe-IT has an authorization bypass on print inventory page | medium | 4.3 | 0% |
| CVE-2026-55703 | snipe/snipe-it | Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET | medium | 4.3 | 0% |
| CVE-2026-64664 | statamic/cms | Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence | medium | 4.3 | 0% |
| CVE-2024-12109 | product-labels-for-woocommerce-\(sale-badges\) (WordPress plugin) | The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a | medium | 4.1 | 0% |
| CVE-2026-25483 | craftcms/commerce | Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration | medium | 0.0 | 0% |
| CVE-2024-12810 | jobcareer (WordPress theme) | The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of dat | high | 8.8 | 0% |
| CVE-2025-66296 | getgrav/grav | Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover | high | 8.8 | 0% |
| CVE-2025-53369 | starcitizentools/short-description | Citizen Short Description stored XSS vulnerability through wikitext | high | 8.6 | 0% |
| CVE-2026-33493 | wwbn/avideo | AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter | high | 7.1 | 0% |
| CVE-2024-11496 | infility-global (WordPress plugin) | The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infilit | medium | 6.5 | 0% |
| CVE-2025-3438 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all ver | medium | 6.5 | 0% |
| CVE-2024-10057 | rss-feed-widget (WordPress plugin) | The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all v | medium | 6.4 | 0% |
| CVE-2024-10226 | arconix-shortcodes (WordPress plugin) | The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2024-1427 | the-post-grid (WordPress plugin) | The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 6.4 | 0% |
| CVE-2024-1565 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for Wor | medium | 6.4 | 0% |
| CVE-2024-3603 | osm (WordPress plugin) | The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osm_map' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2024-3638 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Marquee Text Widget, Tes | medium | 6.4 | 0% |
| CVE-2024-3925 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-5219 | google-maps-easy (WordPress plugin) | The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions | medium | 6.4 | 0% |
| CVE-2024-5419 | cf7-widget-elementor (WordPress plugin) | The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7_red | medium | 6.4 | 0% |
| CVE-2024-6264 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions u | medium | 6.4 | 0% |
| CVE-2024-6480 | sip-reviews-shortcode-woocommerce (WordPress plugin) | The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'no_of_reviews' attribut | medium | 6.4 | 0% |