Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5601 | mediavine-create (WordPress plugin) | The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Schema Meta shortcode in all vers | medium | 6.4 | 0% |
| CVE-2024-5640 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-5645 | envo-extra (WordPress plugin) | The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_css_id’ parameter within the Button widget | medium | 6.4 | 0% |
| CVE-2024-6930 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's booki | medium | 6.4 | 0% |
| CVE-2024-9057 | curatorio (WordPress plugin) | The Curator.io: Show all your social media posts in a beautiful feed. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-9172 | demo-importer-plus (WordPress plugin) | The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-9242 | memberful-wp (WordPress plugin) | The Memberful – Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'memberful_buy_subscrip | medium | 6.4 | 0% |
| CVE-2024-9425 | advanced-category-and-custom-taxonomy-image (WordPress plugin) | The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ad_tax_im | medium | 6.4 | 0% |
| CVE-2022-4941 | wc-multivendor-membership (WordPress plugin) | The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing | medium | 6.3 | 0% |
| CVE-2023-4924 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability c | medium | 5.4 | 0% |
| CVE-2026-33685 | wwbn/avideo | AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data | medium | 5.3 | 0% |
| CVE-2023-0926 | custom-permalinks (WordPress plugin) | The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insuf | medium | 4.4 | 0% |
| CVE-2022-3451 | product-stock-manager (WordPress plugin) | The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowin | medium | 4.3 | 0% |
| CVE-2023-6883 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple A | medium | 4.3 | 0% |
| CVE-2024-1124 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing cap | medium | 4.3 | 0% |
| CVE-2024-12114 | foogallery (WordPress plugin) | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct | medium | 4.3 | 0% |
| CVE-2024-13716 | fx-calculators (WordPress plugin) | The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_ | medium | 4.3 | 0% |
| CVE-2024-2298 | affiliate-toolkit-starter (WordPress plugin) | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability che | medium | 4.3 | 0% |
| CVE-2025-3736 | drupal/simple_gtm | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2025-3737 | drupal/gmap_store_locator | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2025-3738 | drupal/google_optimize | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2025-3739 | drupal/d8_google_optimize_hide_page | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2025-48011 | drupal/one_time_password | This module enables you to allow users to include a second authentication method in addition to password authentication. | unknown | 0.0 | 0% |
| CVE-2025-8092 | drupal/cookies | This module allows you to manage video media items using the COOKiES module (disabling external video elements). These e | unknown | 0.0 | 0% |
| CVE-2023-4277 | realia (WordPress plugin) | The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing | high | 8.8 | 0% |
| CVE-2024-11052 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cal | high | 7.2 | 0% |
| CVE-2024-13497 | tripetto (WordPress plugin) | The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site | high | 7.2 | 0% |
| CVE-2023-3011 | armember-membership (WordPress plugin) | The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missin | medium | 6.5 | 0% |
| CVE-2023-6892 | ean-for-woocommerce (WordPress plugin) | The EAN for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_ean_product_meta' shortco | medium | 6.4 | 0% |
| CVE-2024-0256 | starbox (WordPress plugin) | The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versio | medium | 6.4 | 0% |
| CVE-2024-0824 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Anything functionality in | medium | 6.4 | 0% |
| CVE-2024-10453 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-1049 | vimeography (WordPress plugin) | The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget' | medium | 6.4 | 0% |
| CVE-2024-1057 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2024-1081 | interactive-3d-flipbook-powered-physics-engine (WordPress plugin) | The 3D FlipBook – PDF Flipbook WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bookmark feature | medium | 6.4 | 0% |
| CVE-2024-12205 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all vers | medium | 6.4 | 0% |
| CVE-2024-1327 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image box widget in all versions up | medium | 6.4 | 0% |
| CVE-2024-1364 | elementor-pro (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions u | medium | 6.4 | 0% |
| CVE-2024-1421 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribut | medium | 6.4 | 0% |
| CVE-2024-1426 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter G | medium | 6.4 | 0% |
| CVE-2024-1429 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter G | medium | 6.4 | 0% |
| CVE-2024-1521 | elementor-pro (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an SVGZ file uploaded via the Form w | medium | 6.4 | 0% |
| CVE-2024-1534 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions | medium | 6.4 | 0% |
| CVE-2024-1582 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgmza' shortco | medium | 6.4 | 0% |
| CVE-2024-1767 | blocksy (WordPress plugin) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2 | medium | 6.4 | 0% |
| CVE-2024-1802 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-1805 | page-builder (WordPress plugin) | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and i | medium | 6.4 | 0% |
| CVE-2024-1840 | page-builder (WordPress plugin) | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Author tag attribute in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-1841 | page-builder (WordPress plugin) | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Title tag attribute in all versions up to, and i | medium | 6.4 | 0% |
| CVE-2024-1842 | page-builder (WordPress plugin) | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Heading tag attribute in all versions up to, a | medium | 6.4 | 0% |