Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6669 | chatbot (WordPress plugin) | The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up | medium | 5.5 | 0% |
| CVE-2023-4923 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 5.4 | 0% |
| CVE-2023-4926 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 5.4 | 0% |
| CVE-2024-12595 | ahathat (WordPress plugin) | The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attrib | medium | 4.7 | 0% |
| CVE-2023-4942 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |
| CVE-2024-11724 | gdpr-cookie-consent (WordPress plugin) | The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) plugin for WordPress is | medium | 4.3 | 0% |
| CVE-2024-13541 | adirectory (WordPress plugin) | The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabil | medium | 4.3 | 0% |
| CVE-2024-55891 | typo3/cms-install | TYPO3 Information Disclosure via Exception Handling/Logger | low | 3.1 | 0% |
| CVE-2024-28864 | ilicmiljan/secure-props | [TagAwareCipher] - Decryption Failure (Regex Match) | low | 2.6 | 0% |
| CVE-2026-8827 | friendsoftypo3/tt-address | TYPO3 SQL Injection in extension "Address List" (tt_address) | high | 0.0 | 0% |
| CVE-2025-48448 | drupal/admin_audit_trail | The Admin Audit Trail module tracks logs of specific events that you'd like to review. When the submodule Admin Audit Tr | high | 7.5 | 0% |
| CVE-2024-47638 | online-booking-\&-scheduling-calendar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Cale | high | 7.1 | 0% |
| CVE-2023-5006 | wp-discord-invite (WordPress plugin) | The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated a | medium | 6.5 | 0% |
| CVE-2024-13361 | gpt3-ai-content-generator (WordPress plugin) | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicg_sav | medium | 6.3 | 0% |
| CVE-2026-84308 | phpseclib/phpseclib | phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery | medium | 6.3 | 0% |
| CVE-2024-12370 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding r | medium | 5.3 | 0% |
| CVE-2024-43430 | moodle/moodle | Moodle has insufficient access control | medium | 5.3 | 0% |
| CVE-2024-43433 | moodle/moodle | Moodle's user/power level management inconsistent with suspended users | medium | 5.3 | 0% |
| CVE-2024-47057 | mautic/core | Mautic allows user name enumeration due to response time difference on password reset form | medium | 5.3 | 0% |
| CVE-2024-5545 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-8658 | mycred (WordPress plugin) | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, an | medium | 5.3 | 0% |
| CVE-2024-8678 | revolut-gateway-for-woocommerce (WordPress plugin) | The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 5.3 | 0% |
| CVE-2023-6494 | woo-smart-quick-view (WordPress plugin) | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all version | medium | 4.4 | 0% |
| CVE-2022-3126 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2022-3151 | wp-custom-cursors (WordPress plugin) | The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-13832 | ut-elementor-addons-lite (WordPress plugin) | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 v | medium | 4.3 | 0% |
| CVE-2024-13873 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 4.3 | 0% |
| CVE-2025-3915 | aeropage-sync-for-airtable (WordPress plugin) | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aer | medium | 4.3 | 0% |
| CVE-2025-10352 | melisplatform/melis-core | Melis Platform CMS Unauthenticated Admin Account Creation | critical | 0.0 | 0% |
| CVE-2026-31820 | sylius/sylius | Sylius affected by IDOR in Cart and Checkout LiveComponents | high | 0.0 | 0% |
| CVE-2026-33480 | wwbn/avideo | AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy | high | 8.6 | 0% |
| CVE-2024-13864 | countdown-timer (WordPress plugin) | The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to | high | 7.1 | 0% |
| CVE-2023-0502 | wp-news (WordPress plugin) | The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in a | medium | 6.5 | 0% |
| CVE-2023-0522 | enable\/disable-auto-login-when-register (WordPress plugin) | The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, whi | medium | 6.5 | 0% |
| CVE-2023-1093 | oauth-single-sign-on (WordPress plugin) | The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allo | medium | 6.5 | 0% |
| CVE-2023-1331 | redirection (WordPress plugin) | The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged | medium | 6.5 | 0% |
| CVE-2026-47227 | admidio/admidio | Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php | medium | 6.5 | 0% |
| CVE-2024-46996 | baserproject/basercms | baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature | medium | 6.3 | 0% |
| CVE-2024-11849 | pods (WordPress plugin) | The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 6.1 | 0% |
| CVE-2024-12096 | exhibit-to-wp-gallery (WordPress plugin) | The Exhibit to WP Gallery WordPress plugin through 0.0.2 does not sanitise and escape a parameter before outputting it back in the page, lea | medium | 6.1 | 0% |
| CVE-2024-3519 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up t | medium | 6.1 | 0% |
| CVE-2024-6667 | kbucket (WordPress plugin) | The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the | medium | 6.1 | 0% |
| CVE-2024-8734 | lucas-string-replace (WordPress plugin) | The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without approp | medium | 6.1 | 0% |
| CVE-2025-6977 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘pm_get | medium | 6.1 | 0% |
| CVE-2024-53277 | silverstripe/framework | Silverstripe Framework has a XSS in form messages | medium | 5.4 | 0% |
| CVE-2024-8397 | gdpr-cookie-consent (WordPress plugin) | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allo | medium | 5.4 | 0% |
| CVE-2024-3268 | youtube-showcase (WordPress plugin) | The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modifi | medium | 5.3 | 0% |
| CVE-2024-9686 | order-notification-for-telegram (WordPress plugin) | The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability chec | medium | 5.3 | 0% |
| CVE-2024-7355 | organization-chart (WordPress plugin) | The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parame | medium | 4.9 | 0% |
| CVE-2026-25125 | october/rain | October Rain has Environment Variable Exfiltration via INI Parser Interpolation | medium | 4.9 | 0% |