Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10054 | happyforms (WordPress plugin) | The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-10107 | rafflepress (WordPress plugin) | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could al | medium | 4.8 | 0% |
| CVE-2024-10143 | mb-custom-post-types-\&-custom-taxonomies (WordPress plugin) | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could al | medium | 4.8 | 0% |
| CVE-2024-10144 | robo-gallery (WordPress plugin) | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, whi | medium | 4.8 | 0% |
| CVE-2024-10145 | social-pug (WordPress plugin) | The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-10149 | social-slider-widget (WordPress plugin) | The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2024-10475 | contact-form-\&-lead-form-elementor-builder (WordPress plugin) | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings | medium | 4.8 | 0% |
| CVE-2024-10639 | auto-prune-posts (WordPress plugin) | The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-11109 | wp-google-review-slider (WordPress plugin) | The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-11189 | social-share-and-social-locker (WordPress plugin) | The Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2024-11266 | geocache-stat-bar-widget (WordPress plugin) | The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | 0% |
| CVE-2024-11843 | panorama (WordPress plugin) | The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-12679 | google-website-translator (WordPress plugin) | The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-12680 | google-website-translator (WordPress plugin) | The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-12716 | simple-basic-contact-form (WordPress plugin) | The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2024-12739 | mobile-contact-bar (WordPress plugin) | The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2024-12800 | ip-based-login (WordPress plugin) | The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as adm | medium | 4.8 | 0% |
| CVE-2024-12808 | wp-erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not san | medium | 4.8 | 0% |
| CVE-2024-13053 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-13127 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-13313 | aweber (WordPress plugin) | The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-13357 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-13382 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2024-13383 | hd-quiz (WordPress plugin) | The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-13384 | robo-gallery (WordPress plugin) | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, whi | medium | 4.8 | 0% |
| CVE-2024-13486 | icegram-engage (WordPress plugin) | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-13616 | vikbooking-hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow | medium | 4.8 | 0% |
| CVE-2024-13621 | gdpr-framework (WordPress plugin) | The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | 0% |
| CVE-2024-13729 | podlove-podcast-publisher (WordPress plugin) | The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privi | medium | 4.8 | 0% |
| CVE-2024-13730 | podlove-podcast-publisher (WordPress plugin) | The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | 0% |
| CVE-2024-1663 | ultimate-noindex-nofollow-tool-ii (WordPress plugin) | The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow hig | medium | 4.8 | 0% |
| CVE-2024-2869 | easy-property-listings (WordPress plugin) | The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-3062 | save-as-pdf (WordPress plugin) | The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2024-5026 | cm-tooltip-glossary (WordPress plugin) | The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-6478 | ctt-expresso-para-woocommerce (WordPress plugin) | The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high p | medium | 4.8 | 0% |
| CVE-2024-7758 | stylish-price-list (WordPress plugin) | The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-7759 | pwa-for-wp-\&-amp (WordPress plugin) | The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-8426 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2024-8617 | quiz-maker (WordPress plugin) | The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users suc | medium | 4.8 | 0% |
| CVE-2024-8620 | mappress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-8701 | events-calendar (WordPress plugin) | The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-9182 | maspik (WordPress plugin) | The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-9227 | powerpress (WordPress plugin) | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a | medium | 4.8 | 0% |
| CVE-2024-9236 | team---wordpress-team-members-showcase (WordPress plugin) | The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | medium | 4.8 | 0% |
| CVE-2024-9390 | registrationmagic (WordPress plugin) | The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2022-2657 | multivendor-marketplace-solution-for-woocommerce---wc-marketplace (WordPress plugin) | The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actio | medium | 4.3 | 0% |
| CVE-2024-4004 | advanced-cron-manager (WordPress plugin) | The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege | low | 3.5 | 0% |
| CVE-2024-4091 | responsive-gallery-grid (WordPress plugin) | The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privile | low | 3.5 | 0% |
| CVE-2025-48914 | drupal/cookies | This module provides a format filter, which allows you to "disable" certain HTML elements (e.g. remove their src attribu | unknown | 0.0 | 0% |
| CVE-2025-48915 | drupal/cookies | The COOKIES module protects users from executing JavaScript code provided by third parties, e.g., to display ads or trac | unknown | 0.0 | 0% |