Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10472 | stylish-price-list (WordPress plugin) | The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 5.9 | 0% |
| CVE-2024-2001 | cockpit-hq/cockpit | Cockpit CMS Cross-Site Scripting vulnerability | medium | 5.5 | 0% |
| CVE-2022-38095 | advanced-dynamic-pricing-for-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress. | medium | 5.4 | 0% |
| CVE-2023-2143 | enable-svg\,-webp-\&-ico-upload (WordPress plugin) | The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vuln | medium | 5.4 | 0% |
| CVE-2024-8121 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a miss | medium | 5.4 | 0% |
| CVE-2023-50462 | t3s/content-consent | Insecure Direct Object Reference in extension "Content Consent" (content_consent) | medium | 5.3 | 0% |
| CVE-2026-25523 | openmage/magento-lts | Magento's X-Original-Url header can expose admin url | medium | 5.3 | 0% |
| CVE-2023-6498 | complianz-gdpr (WordPress plugin) | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all version | medium | 4.4 | 0% |
| CVE-2022-34654 | manage-notification-e-mails (WordPress plugin) | Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress. | medium | 4.3 | 0% |
| CVE-2022-40671 | rate-my-post (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress. | medium | 4.3 | 0% |
| CVE-2023-2087 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due t | medium | 4.3 | 0% |
| CVE-2024-12131 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 4.3 | 0% |
| CVE-2024-13306 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which coul | medium | 4.3 | 0% |
| CVE-2024-1804 | tutor-lms-migration-tool (WordPress plugin) | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-32818 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data an | medium | 4.3 | 0% |
| CVE-2024-6709 | sync-post-with-other-site (WordPress plugin) | The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-6836 | funnel-builder (WordPress plugin) | The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells | medium | 4.3 | 0% |
| CVE-2024-8427 | frontend-post-submission-manager-lite (WordPress plugin) | The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modificatio | medium | 4.3 | 0% |
| CVE-2024-9067 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 4.3 | 0% |
| CVE-2024-9361 | bulk-image-resizer (WordPress plugin) | The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of da | medium | 4.3 | 0% |
| CVE-2024-9685 | notification-for-telegram (WordPress plugin) | The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2026-31867 | craftcms/commerce | Craft Commerce: Potential IDOR in Commerce carts | medium | 0.0 | 0% |
| CVE-2024-4404 | elementskit (WordPress plugin) | The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'rende | high | 8.5 | 0% |
| CVE-2026-43873 | wwbn/avideo | AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configure | high | 7.5 | 0% |
| CVE-2024-3667 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in al | high | 7.4 | 0% |
| CVE-2026-25129 | psy/psysh | PsySH has Local Privilege Escalation via CWD .psysh.php auto-load | medium | 6.7 | 0% |
| CVE-2026-45139 | ci4-cms-erp/ci4ms | CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations | medium | 6.5 | 0% |
| CVE-2024-10168 | profit-products-tables-for-woocommerce (WordPress plugin) | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-10186 | event-post (WordPress plugin) | The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode in all versions up to | medium | 6.4 | 0% |
| CVE-2024-10189 | anchor-episodes-index (WordPress plugin) | The Anchor Episodes Index (Spotify for Podcasters) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's anchor | medium | 6.4 | 0% |
| CVE-2024-10323 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions | medium | 6.4 | 0% |
| CVE-2024-12475 | wp-multi-store-locator (WordPress plugin) | The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due | medium | 6.4 | 0% |
| CVE-2024-13153 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions | medium | 6.4 | 0% |
| CVE-2024-2455 | element-pack (WordPress plugin) | The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t | medium | 6.4 | 0% |
| CVE-2024-2618 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versio | medium | 6.4 | 0% |
| CVE-2024-3307 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget's att | medium | 6.4 | 0% |
| CVE-2024-3557 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpgmza shortcode | medium | 6.4 | 0% |
| CVE-2024-3926 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-4045 | optinmonster (WordPress plugin) | The Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-4087 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widg | medium | 6.4 | 0% |
| CVE-2024-4273 | essential-real-estate (WordPress plugin) | The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ere_property_map' shortcode in | medium | 6.4 | 0% |
| CVE-2024-4288 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scrip | medium | 6.4 | 0% |
| CVE-2024-4313 | table-addons-for-elementor (WordPress plugin) | The Table Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-4375 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_layer' sh | medium | 6.4 | 0% |
| CVE-2024-4391 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Event Calendar widget in a | medium | 6.4 | 0% |
| CVE-2024-4470 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide_inf | medium | 6.4 | 0% |
| CVE-2024-4485 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-4553 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_member | medium | 6.4 | 0% |
| CVE-2024-4570 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, an | medium | 6.4 | 0% |
| CVE-2024-4626 | jetwidgets-for-elementor (WordPress plugin) | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in | medium | 6.4 | 0% |