Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12393 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status mes | medium | 5.4 | 0% |
| CVE-2024-12267 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insuffi | medium | 5.3 | 0% |
| CVE-2024-7381 | cf-geoplugin (WordPress plugin) | The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks | medium | 5.3 | 0% |
| CVE-2024-7390 | wp-testimonial-widget (WordPress plugin) | The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the f | medium | 5.3 | 0% |
| CVE-2026-55515 | snipe/snipe-it | Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint | medium | 5.0 | 0% |
| CVE-2023-6456 | wp-review-slider (WordPress plugin) | The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-10555 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow hi | medium | 4.8 | 0% |
| CVE-2024-13493 | sensly-online-presence (WordPress plugin) | The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-7618 | peepso-core (WordPress plugin) | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 4.4 | 0% |
| CVE-2024-7655 | peepso-core (WordPress plugin) | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 4.4 | 0% |
| CVE-2025-0935 | media-library-plus (WordPress plugin) | The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on sev | medium | 4.3 | 0% |
| CVE-2025-3628 | moodle/moodle | Moodle reveals student identities through assignment submissions search on anonymous submissions | medium | 4.3 | 0% |
| CVE-2025-3636 | moodle/moodle | Moodle allows IDOR in RSS block, which allows access to additional RSS feeds | medium | 4.3 | 0% |
| CVE-2026-15081 | drupal/location_selector | The Location Selector module provides a Views filter for selecting location values. One of the provided Views filters d | unknown | 0.0 | 0% |
| CVE-2026-26987 | librenms/librenms | LibreNMS affected by reflected xss via email field | medium | 0.0 | 0% |
| CVE-2026-42844 | getgrav/grav | Low-privileged Grav API users can create super-admin accounts via blueprint-upload | high | 0.0 | 0% |
| CVE-2026-55476 | snipe/snipe-it | Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter | medium | 0.0 | 0% |
| CVE-2026-41064 | wwbn/avideo | WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection | critical | 9.3 | 0% |
| CVE-2024-2739 | advanced-search (WordPress plugin) | The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in u | high | 8.7 | 0% |
| CVE-2026-41056 | wwbn/avideo | WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover | high | 8.1 | 0% |
| CVE-2026-42552 | flightphp/core | Flight vulnerable to sensitive information disclosure via default error handler | high | 7.5 | 0% |
| CVE-2022-4443 | brutebank (WordPress plugin) | The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make | medium | 6.5 | 0% |
| CVE-2022-4548 | optimize-images-alt-text-\(alt-tag\)-\&-names-for-seo-using-ai (WordPress plugin) | The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its sett | medium | 6.5 | 0% |
| CVE-2023-6958 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-1508 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'settings['title_tags']' a | medium | 6.4 | 0% |
| CVE-2024-1568 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 | medium | 6.4 | 0% |
| CVE-2025-5944 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in | medium | 6.4 | 0% |
| CVE-2023-2405 | crm-customer-relationship-management-by-vcita (WordPress plugin) | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7. | medium | 6.1 | 0% |
| CVE-2023-1789 | grumpydictator/firefly-iii | Firefly III vulnerable to improper input validation | medium | 5.9 | 0% |
| CVE-2024-2234 | himer (WordPress plugin) | The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such a | medium | 5.4 | 0% |
| CVE-2025-43717 | pear/http_request2 | PEAR HTTP_Request2 vulnerable to Cross-site Scripting | medium | 5.4 | 0% |
| CVE-2023-5911 | wp-custom-cursors-\|-wordpress-cursor-plugin (WordPress plugin) | The WP Custom Cursors | WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could | medium | 4.8 | 0% |
| CVE-2024-3276 | foobox (WordPress plugin) | The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 do | medium | 4.8 | 0% |
| CVE-2024-0977 | timeline-widget-addon-for-elementor (WordPress plugin) | The Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) plugin for WordPress is vulnerable to Stored Cross-Si | medium | 4.4 | 0% |
| CVE-2024-12113 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 4.3 | 0% |
| CVE-2024-13639 | expand-maker (WordPress plugin) | The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check | medium | 4.3 | 0% |
| CVE-2024-1689 | woo-tools (WordPress plugin) | The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wooco | medium | 4.3 | 0% |
| CVE-2025-11726 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including | medium | 4.3 | 0% |
| CVE-2026-43885 | wwbn/avideo | AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization | high | 0.0 | 0% |
| CVE-2023-6196 | audio-merchant (WordPress plugin) | The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due | high | 8.8 | 0% |
| CVE-2026-34587 | getkirby/cms | Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering | high | 8.1 | 0% |
| CVE-2024-13698 | jobify (WordPress theme) | The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capabili | medium | 6.5 | 0% |
| CVE-2025-28254 | leantime/leantime | Leantime affected by Improper Neutralization of HTML Tags | medium | 6.5 | 0% |
| CVE-2024-4702 | mega-elements-addons-for-elementor (WordPress plugin) | The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, an | medium | 6.4 | 0% |
| CVE-2024-5039 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 0% |
| CVE-2024-5554 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-29906 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Tax | medium | 5.9 | 0% |
| CVE-2024-13798 | post-grid (WordPress plugin) | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, an | medium | 5.3 | 0% |
| CVE-2024-5170 | logo-manager-for-enamad (WordPress plugin) | The Logo Manager For Enamad WordPress plugin through 0.7.1 does not sanitise and escape in its widgets settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-1766 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and | medium | 4.4 | 0% |