Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-29906 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Tax | medium | 5.9 | 0% |
| CVE-2024-13798 | post-grid (WordPress plugin) | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, an | medium | 5.3 | 0% |
| CVE-2024-5170 | logo-manager-for-enamad (WordPress plugin) | The Logo Manager For Enamad WordPress plugin through 0.7.1 does not sanitise and escape in its widgets settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-1766 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and | medium | 4.4 | 0% |
| CVE-2024-2958 | svs-pricing-tables (WordPress plugin) | The SVS Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via pricing table settings in all versions up to, a | medium | 4.4 | 0% |
| CVE-2024-13601 | majestic-support (WordPress plugin) | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Ref | medium | 4.3 | 0% |
| CVE-2024-13855 | prime-addons-for-elementor (WordPress plugin) | The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2025-10316 | lavitto/typo3-form-to-database | TYPO3 "Form to Database" extension susceptible to Cross-site Scripting | low | 0.0 | 0% |
| CVE-2026-81205 | drupal/ldap_auth | This module enables users to authenticate using LDAP or Active Directory credentials. The module does not sufficiently | unknown | 0.0 | 0% |
| CVE-2026-25759 | statamic/cms | Statamic CMS vulnerable to privilege escalation via stored cross-site scripting | high | 8.7 | 0% |
| CVE-2026-57440 | starcitizenwiki/embedvideo | Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled | high | 7.5 | 0% |
| CVE-2025-1561 | apppresser (WordPress plugin) | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all ver | high | 7.2 | 0% |
| CVE-2024-24801 | owl-carousel (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt OWL Carousel – WordPress Owl | medium | 6.5 | 0% |
| CVE-2024-10055 | support-chat (WordPress plugin) | The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 0% |
| CVE-2024-10178 | gutentor (WordPress plugin) | The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th | medium | 6.4 | 0% |
| CVE-2024-10308 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Countdown widget in all vers | medium | 6.4 | 0% |
| CVE-2024-10872 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block i | medium | 6.4 | 0% |
| CVE-2024-2785 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate widget in all versions | medium | 6.4 | 0% |
| CVE-2024-2798 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget container | medium | 6.4 | 0% |
| CVE-2024-2922 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget tags in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-3559 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_content]' parameter versions | medium | 6.4 | 0% |
| CVE-2024-3645 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Counter widget in | medium | 6.4 | 0% |
| CVE-2024-3889 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Accordi | medium | 6.4 | 0% |
| CVE-2024-5162 | prettyphoto (WordPress plugin) | The WordPress prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-9443 | basticom-framework (WordPress plugin) | The Basticom Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2023-46074 | freshmail-for-wordpress (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Borbis Media FreshMail For WordPress plugin <= 2.3.2 versions. | medium | 5.8 | 0% |
| CVE-2024-2470 | simple-ajax-chat (WordPress plugin) | The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 5.4 | 0% |
| CVE-2024-43437 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2024-4756 | wp-backpack (WordPress plugin) | The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 0% |
| CVE-2024-6766 | shortcodes-ultimate (WordPress plugin) | The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2024-9020 | list-category-posts (WordPress plugin) | The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2024-12611 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in | medium | 5.3 | 0% |
| CVE-2024-13544 | zarinpal-paid-download (WordPress plugin) | The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as adm | medium | 4.8 | 0% |
| CVE-2024-54774 | dcat/laravel-admin | Dcat Admin Cross-site Scripting (XSS) vulnerability | medium | 4.8 | 0% |
| CVE-2024-7052 | forminator-forms (WordPress plugin) | The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2024-10582 | music-player-for-elementor (WordPress plugin) | The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due t | medium | 4.3 | 0% |
| CVE-2024-3073 | easy-wp-smtp (WordPress plugin) | The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versio | low | 2.7 | 0% |
| CVE-2026-55792 | craftcms/cms | Craft CMS: Sensitive File Disclosure / Server-Side File Read | medium | 0.0 | 0% |
| CVE-2026-32277 | opensource-workshop/connect-cms | Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View | high | 8.7 | 0% |
| CVE-2024-3597 | export-wp-page-to-static-html (WordPress plugin) | The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This | high | 7.1 | 0% |
| CVE-2024-56365 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class | high | 7.1 | 0% |
| CVE-2026-43875 | wwbn/avideo | AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover | medium | 6.8 | 0% |
| CVE-2024-2697 | swift-framework (WordPress plugin) | The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting | medium | 6.5 | 0% |
| CVE-2023-2439 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, | medium | 6.4 | 0% |
| CVE-2026-55482 | snipe/snipe-it | Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update | medium | 6.3 | 0% |
| CVE-2024-13332 | transfinanz (WordPress plugin) | The TransFinanz WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 0% |
| CVE-2024-10076 | jetpack (WordPress plugin), jetpack-boost (WordPress plugin) | The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when sw | medium | 5.9 | 0% |
| CVE-2022-40632 | wpforo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion. | medium | 5.4 | 0% |
| CVE-2024-12042 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pro | medium | 5.4 | 0% |
| CVE-2024-13457 | event-tickets (WordPress plugin) | The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi | medium | 5.3 | 0% |