Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-35448 | wwbn/avideo | AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php | low | 3.7 | 0% |
| CVE-2024-11140 | real-wp-shop-lite-ajax-ecommerce-shopping-cart (WordPress plugin) | The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which c | low | 3.5 | 0% |
| CVE-2024-3996 | smart-post-show (WordPress plugin) | The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege user | low | 3.5 | 0% |
| CVE-2024-6711 | event-tickets-with-ticket-scanner (WordPress plugin) | The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users wi | low | 3.5 | 0% |
| CVE-2026-46635 | twig/twig | Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) | low | 0.0 | 0% |
| CVE-2026-56094 | apache-solr-for-typo3/solr | TYPO3-EXT-SA-2026-025: Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) | unknown | 0.0 | 0% |
| CVE-2026-56384 | craftcms/cms | Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission | medium | 0.0 | 0% |
| CVE-2026-34569 | ci4-cms-erp/ci4ms | CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.9 | 0% |
| CVE-2026-34559 | ci4-cms-erp/ci4ms | CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2024-7423 | stream (WordPress plugin) | The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to miss | high | 8.8 | 0% |
| CVE-2024-9545 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_con | medium | 6.4 | 0% |
| CVE-2026-77616 | mediawiki/semantic-media-wiki | Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token | medium | 6.1 | 0% |
| CVE-2023-44990 | wolf---wordpress-posts-bulk-editor-and-products-manager-professional (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plu | medium | 5.9 | 0% |
| CVE-2022-33177 | booking (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations | medium | 5.4 | 0% |
| CVE-2024-11108 | serious-slider (WordPress plugin) | The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2024-0974 | social-media-widget (WordPress plugin) | The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-2872 | swift-framework (WordPress plugin) | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-4753 | wp-secure-maintenance (WordPress plugin) | The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-4959 | frontend-checklist (WordPress plugin) | The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-5799 | cm-popup (WordPress plugin) | The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privil | medium | 4.8 | 0% |
| CVE-2024-7879 | wp-ulike (WordPress plugin) | The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-8378 | safe-svg (WordPress plugin) | The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for examp | medium | 4.8 | 0% |
| CVE-2024-9835 | rss-feed-widget (WordPress plugin) | The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attr | medium | 4.8 | 0% |
| CVE-2021-3991 | dolibarr/dolibarr | Improper Authorization in dolibarr/dolibarr | medium | 4.3 | 0% |
| CVE-2024-6799 | yith-essential-kit-for-woocommerce-1 (WordPress plugin) | The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 4.3 | 0% |
| CVE-2025-3644 | moodle/moodle | Moodle's AJAX section delete does not respect course_can_delete_section() | medium | 4.3 | 0% |
| CVE-2026-32699 | facturascripts/facturascripts | FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field | medium | 4.3 | 0% |
| CVE-2025-3951 | wp-optimize (WordPress plugin) | The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could all | medium | 4.1 | 0% |
| CVE-2024-10515 | seo-plugin-by-squirrly-seo (WordPress plugin) | In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to imple | low | 3.5 | 0% |
| CVE-2024-2220 | call-\/-chat-\/-contact-button (WordPress plugin) | The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users | low | 3.5 | 0% |
| CVE-2025-7899 | in2code/powermail | Powermail extension for TYPO3 allows Insecure Direct Object Reference | medium | 0.0 | 0% |
| CVE-2026-33035 | wwbn/avideo | Unauthenticated Reflected XSS via innerHTML in AVideo | medium | 0.0 | 0% |
| CVE-2026-81162 | drupal/dxpr_builder | The [DXPR Builder](https://www.drupal.org/project/dxpr_builder) module provides a visual / AI page builder for Drupal. T | unknown | 0.0 | 0% |
| CVE-2023-6390 | wordpress-users (WordPress plugin) | The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers t | high | 8.8 | 0% |
| CVE-2023-7074 | wp-social-bookmark-menu (WordPress plugin) | The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow att | high | 8.8 | 0% |
| CVE-2024-11640 | vikrentcar (WordPress plugin) | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl | high | 8.8 | 0% |
| CVE-2026-3105 | mautic/core | Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting | high | 7.6 | 0% |
| CVE-2024-4222 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing cap | high | 7.3 | 0% |
| CVE-2025-2940 | ninja-tables (WordPress plugin) | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and incl | high | 7.2 | 0% |
| CVE-2024-3632 | smart-image-gallery (WordPress plugin) | The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attac | medium | 6.8 | 0% |
| CVE-2025-1481 | shortcode-cleaner-lite (WordPress plugin) | The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the downlo | medium | 6.5 | 0% |
| CVE-2025-26526 | moodle/moodle | Moodle's feedback response viewing and deletions did not respect Separate Groups mode | medium | 6.5 | 0% |
| CVE-2026-34395 | wwbn/avideo | AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php | medium | 6.5 | 0% |
| CVE-2026-34740 | wwbn/avideo | AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation | medium | 6.5 | 0% |
| CVE-2024-0845 | pdf-viewer-for-elementor (WordPress plugin) | The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to | medium | 6.4 | 0% |
| CVE-2024-2350 | cafe-lite (WordPress plugin) | The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and C | medium | 6.4 | 0% |
| CVE-2024-4364 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all version | medium | 6.4 | 0% |
| CVE-2024-4376 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all | medium | 6.4 | 0% |
| CVE-2024-4378 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's menu and shape widgets i | medium | 6.4 | 0% |
| CVE-2024-4401 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ and 'eae_slider_animation' param | medium | 6.4 | 0% |