Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13693 | enfold (WordPress theme) | The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in al | medium | 5.3 | 0% |
| CVE-2024-43429 | moodle/moodle | Moodle has user information visibility control issues in gradebook reports | medium | 5.3 | 0% |
| CVE-2024-43432 | moodle/moodle | Moodle authorization headers preserved between "emulated redirects" | medium | 5.3 | 0% |
| CVE-2026-33763 | wwbn/avideo | AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle | medium | 5.3 | 0% |
| CVE-2026-34364 | wwbn/avideo | AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php | medium | 5.3 | 0% |
| CVE-2024-10939 | image-widget (WordPress plugin) | The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privi | medium | 4.8 | 0% |
| CVE-2024-11636 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which | medium | 4.8 | 0% |
| CVE-2024-3937 | playlist-for-youtube (WordPress plugin) | The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-3973 | house-manager (WordPress plugin) | The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 4.8 | 0% |
| CVE-2024-4381 | commonsbooking (WordPress plugin) | The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-6498 | collect.chat (WordPress plugin) | The Chatbot for WordPress by Collect.chat ⚡️ WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could al | medium | 4.8 | 0% |
| CVE-2024-8857 | wordpress-auction (WordPress plugin) | The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2025-64049 | redaxo/source | REDAXO CMS is vulnerable to XSS through its module management component | medium | 4.8 | 0% |
| CVE-2026-118550 | drupal/ai | This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule provides a Search API | unknown | 0.0 | 0% |
| CVE-2023-2549 | feather-login-page (WordPress plugin) | The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including | high | 8.8 | 0% |
| CVE-2023-4276 | absolute-privacy (WordPress plugin) | The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to | high | 8.8 | 0% |
| CVE-2025-48445 | drupal/commerce_eurobank_redirect | This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't | high | 8.8 | 0% |
| CVE-2024-22159 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF – WordPress Posts Bulk | high | 7.1 | 0% |
| CVE-2024-23508 | pdf-poster (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plu | high | 7.1 | 0% |
| CVE-2024-24927 | brooklyn (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnitedThemes Brooklyn | Creative Multi | high | 7.1 | 0% |
| CVE-2026-84192 | librenms/librenms | LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates | high | 7.1 | 0% |
| CVE-2026-41201 | ci4-cms-erp/ci4ms | CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS | medium | 6.8 | 0% |
| CVE-2025-6739 | wpquiz (WordPress plugin) | The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and i | medium | 6.5 | 0% |
| CVE-2024-10180 | cf7-repeatable-fields (WordPress plugin) | The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's field_group shortc | medium | 6.4 | 0% |
| CVE-2024-9049 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Group | medium | 6.4 | 0% |
| CVE-2025-1328 | mrlegend-typedjs (WordPress plugin) | The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter i | medium | 6.4 | 0% |
| CVE-2025-7035 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mla_tag_cloud and mla_term_li | medium | 6.4 | 0% |
| CVE-2023-5866 | thorsten/phpmyfaq | Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq | medium | 6.3 | 0% |
| CVE-2024-4450 | ali2woo-lite (WordPress plugin) | The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on | medium | 6.3 | 0% |
| CVE-2024-7858 | media-library-plus (WordPress plugin) | The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functio | medium | 6.3 | 0% |
| CVE-2023-7194 | meris-wp-theme (WordPress plugin) | The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Ref | medium | 6.1 | 0% |
| CVE-2024-11277 | 404-solution (WordPress plugin) | The 404 Solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 2.35.19 | medium | 6.1 | 0% |
| CVE-2024-8726 | mailchimp-forms-by-mailmunch (WordPress plugin) | The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg withou | medium | 6.1 | 0% |
| CVE-2025-0470 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting | medium | 6.1 | 0% |
| CVE-2024-11357 | goodlayers-core (WordPress plugin) | The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contr | medium | 5.9 | 0% |
| CVE-2022-30337 | wp-meta-seo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin <= 4.4.8 at WordPress allows an attacker to update the soci | medium | 5.4 | 0% |
| CVE-2022-32289 | popup-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change. | medium | 5.4 | 0% |
| CVE-2022-45071 | wpml (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-3630 | hl-twitter (WordPress plugin) | The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 5.4 | 0% |
| CVE-2024-3633 | webp-\&-svg-support (WordPress plugin) | The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Au | medium | 5.4 | 0% |
| CVE-2024-8444 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting. | medium | 5.4 | 0% |
| CVE-2024-10632 | nokaut-offers-box (WordPress plugin) | The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege use | medium | 4.8 | 0% |
| CVE-2024-11190 | jwp-a11y (WordPress plugin) | The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-12874 | top-comments (WordPress plugin) | The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-6665 | kbucket (WordPress plugin) | The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2024-6713 | pvn-auth-popup (WordPress plugin) | The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-7556 | simple-share (WordPress plugin) | The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2023-0385 | custom-404-pro (WordPress plugin) | The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to | medium | 4.3 | 0% |
| CVE-2026-55472 | snipe/snipe-it | Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation | medium | 4.3 | 0% |
| CVE-2024-51992 | orchid/platform | Orchid Platform has Method Exposure Vulnerability in Modals | medium | 4.1 | 0% |