Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12733 | affiliateimportereb (WordPress plugin) | The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leadi | medium | 6.1 | 0% |
| CVE-2024-13828 | badgearoo (WordPress plugin) | The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 6.1 | 0% |
| CVE-2025-0368 | banner-garden (WordPress plugin) | The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 0% |
| CVE-2024-1730 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, | medium | 5.4 | 0% |
| CVE-2024-2120 | website-builder (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget | medium | 5.4 | 0% |
| CVE-2024-2121 | elementor-pro (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget i | medium | 5.4 | 0% |
| CVE-2024-2688 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 5.4 | 0% |
| CVE-2024-2732 | themify-shortcodes (WordPress plugin) | The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in | medium | 5.4 | 0% |
| CVE-2024-3730 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_li | medium | 5.4 | 0% |
| CVE-2024-3818 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 5.4 | 0% |
| CVE-2024-9838 | auto-affiliate-links (WordPress plugin) | The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing | medium | 5.4 | 0% |
| CVE-2024-9879 | melapress-file-monitor (WordPress plugin) | The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowi | medium | 5.4 | 0% |
| CVE-2024-2108 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 4.6 | 0% |
| CVE-2023-4626 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ladiflow_save_h | medium | 4.3 | 0% |
| CVE-2023-4627 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() f | medium | 4.3 | 0% |
| CVE-2023-7067 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 4.3 | 0% |
| CVE-2024-1337 | skt-templates (WordPress plugin) | The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveS | medium | 4.3 | 0% |
| CVE-2024-13449 | boom-fest (WordPress plugin) | The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bf_admin_act | medium | 4.3 | 0% |
| CVE-2024-1388 | yuki (WordPress theme) | The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_op | medium | 4.3 | 0% |
| CVE-2024-1649 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2024-1650 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2024-1652 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2024-1653 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 0% |
| CVE-2024-12173 | master-slider (WordPress plugin) | The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users | low | 3.5 | 0% |
| CVE-2024-13125 | everest-forms (WordPress plugin) | The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users | low | 3.5 | 0% |
| CVE-2026-33052 | mantisbt/mantisbt | MantisBT Has Authorization Bypass in Global Profile Creation | medium | 0.0 | 0% |
| CVE-2026-73474 | drupal/entity_share_websub | This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficientl | unknown | 0.0 | 0% |
| CVE-2024-12278 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via any location that typically sanitizes data | high | 7.2 | 0% |
| CVE-2024-13052 | dental-optimizer-patient-generator-app (WordPress plugin) | The Dental Optimizer Patient Generator App WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back i | high | 7.1 | 0% |
| CVE-2025-66307 | getgrav/grav | Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure | medium | 6.5 | 0% |
| CVE-2026-108360 | phpoffice/phpspreadsheet | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | medium | 6.4 | 0% |
| CVE-2025-1325 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing | medium | 6.3 | 0% |
| CVE-2024-10565 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 6.1 | 0% |
| CVE-2024-10566 | slider (WordPress plugin) | The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 6.1 | 0% |
| CVE-2024-10679 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high pr | medium | 6.1 | 0% |
| CVE-2024-41374 | icecoder/icecoder | ICEcoder vulnerable to Cross Site Scripting | medium | 6.1 | 0% |
| CVE-2024-41375 | icecoder/icecoder | ICEcoder vulnerable to Cross Site Scripting | medium | 6.1 | 0% |
| CVE-2024-6493 | header-footer-custom-code (WordPress plugin) | The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow hig | medium | 4.8 | 0% |
| CVE-2024-6850 | carousel-slider (WordPress plugin) | The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-0689 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a meta import in all versions up to, and includ | medium | 4.4 | 0% |
| CVE-2026-120327 | mediaessenz/mail | TYPO3-EXT-SA-2026-037: Open Redirection in extension "Mail" (mail) | unknown | 0.0 | 0% |
| CVE-2026-55806 | drupal/core | Drupal core ships a `rebuild.php` front controller that can be used to rebuild Drupal (clearing the caches and rebuildin | unknown | 0.0 | 0% |
| CVE-2026-33172 | statamic/cms | Statamic has Stored XSS via SVG Sanitization Bypass | high | 8.7 | 0% |
| CVE-2024-12599 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown wid | medium | 6.4 | 0% |
| CVE-2024-9520 | userplus (WordPress plugin) | The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on | medium | 6.3 | 0% |
| CVE-2022-2071 | name-directory (WordPress plugin) | The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as | medium | 6.1 | 0% |
| CVE-2024-12275 | canvasflow (WordPress plugin) | The Canvasflow for WordPress plugin through 1.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-12320 | team-rosters (WordPress plugin) | The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and inc | medium | 6.1 | 0% |
| CVE-2024-8703 | z-downloads (WordPress plugin) | The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could al | medium | 6.1 | 0% |
| CVE-2026-54243 | statamic/cms | Statamic Vulnerable to CSV formula injection in form submission exports | medium | 6.1 | 0% |