Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2405 | wp-popup-builder (WordPress plugin) | The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated | medium | 4.3 | 0% |
| CVE-2023-4940 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |
| CVE-2024-12102 | typer-core (WordPress plugin) | The Typer Core plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.6 via the 'elementor-tem | medium | 4.3 | 0% |
| CVE-2026-56095 | apache-solr-for-typo3/solr | TYPO3-EXT-SA-2026-025: Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) | unknown | 0.0 | 0% |
| CVE-2026-81168 | drupal/captcha_protected_page | This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficie | unknown | 0.0 | 0% |
| CVE-2024-8795 | ba-book-everything (WordPress plugin) | The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This i | high | 8.8 | 0% |
| CVE-2026-45578 | wwbn/avideo | AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL | high | 8.8 | 0% |
| CVE-2022-4537 | hide-my-wp (WordPress plugin) | The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. T | medium | 6.5 | 0% |
| CVE-2025-5842 | mdl-shortcodes (WordPress plugin) | The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-12166 | ultimate-shortcodes-creator (WordPress plugin) | The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all | medium | 6.1 | 0% |
| CVE-2025-1511 | user-registration (WordPress plugin) | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Reflected | medium | 6.1 | 0% |
| CVE-2022-40131 | page-views-count (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset t | medium | 5.4 | 0% |
| CVE-2022-43488 | advanced-dynamic-pricing-for-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule typ | medium | 5.4 | 0% |
| CVE-2024-10818 | jsfiddle-shortcode (WordPress plugin) | The JSFiddle Shortcode WordPress plugin before 1.1.3 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2024-11718 | tarteaucitron-wp (WordPress plugin), couleurcitron/tarteaucitron-wp | The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users | medium | 5.4 | 0% |
| CVE-2024-5440 | dynamic-content-personalization (WordPress plugin) | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes befo | medium | 5.4 | 0% |
| CVE-2024-8851 | polls-cp (WordPress plugin) | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users s | medium | 5.4 | 0% |
| CVE-2024-8854 | polls-cp (WordPress plugin) | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users s | medium | 5.4 | 0% |
| CVE-2024-9238 | avif-uploader (WordPress plugin) | The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author t | medium | 5.4 | 0% |
| CVE-2024-9645 | post-grid (WordPress plugin) | The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of i | medium | 5.4 | 0% |
| CVE-2024-9662 | cyan-backup (WordPress plugin) | The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 0% |
| CVE-2024-9663 | cyan-backup (WordPress plugin) | The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 0% |
| CVE-2024-6362 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting the | medium | 4.6 | 0% |
| CVE-2022-3556 | cab-fare-calculator (WordPress plugin) | The Cab fare calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vehicle title setting in versions up to, a | medium | 4.4 | 0% |
| CVE-2024-2324 | fileorganizer (WordPress plugin) | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload | medium | 4.4 | 0% |
| CVE-2024-3946 | wp-todo (WordPress plugin) | The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3. | medium | 4.4 | 0% |
| CVE-2024-6518 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 4.4 | 0% |
| CVE-2024-6520 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 4.4 | 0% |
| CVE-2024-6521 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 4.4 | 0% |
| CVE-2024-10787 | lastudio-element-kit (WordPress plugin) | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4 | medium | 4.3 | 0% |
| CVE-2024-12472 | post-duplicator (WordPress plugin) | The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_dupl | medium | 4.3 | 0% |
| CVE-2025-3292 | user-registration (WordPress plugin) | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure D | medium | 4.3 | 0% |
| CVE-2026-46723 | tpwd/ke_search | TYPO3 ke_search path traversal from arbitrary table configuration input | medium | 0.0 | 0% |
| CVE-2026-55793 | craftcms/cms | Craft CMS: Stored XSS via Structure entry title in table view | medium | 0.0 | 0% |
| CVE-2023-6845 | commenttweets (WordPress plugin) | The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users | high | 8.8 | 0% |
| CVE-2024-3756 | mf-gig-calendar (WordPress plugin) | The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in C | high | 7.5 | 0% |
| CVE-2024-10631 | countdown-timer-for-wordpress-block-editor (WordPress plugin) | The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before | medium | 6.5 | 0% |
| CVE-2024-22150 | powerfolio (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PWR Plugins Portfolio & Image Gallery | medium | 6.5 | 0% |
| CVE-2024-24712 | social-login (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login Word | medium | 6.5 | 0% |
| CVE-2024-25594 | mywaze (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Savvy Wordpress Development MyWaze all | medium | 6.5 | 0% |
| CVE-2024-5382 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthor | medium | 6.5 | 0% |
| CVE-2024-5674 | newsletter (WordPress plugin) | The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issu | medium | 6.5 | 0% |
| CVE-2024-6755 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on | medium | 6.5 | 0% |
| CVE-2026-45703 | pimcore/pimcore | Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export | medium | 6.4 | 0% |
| CVE-2023-3052 | page-builder-by-azexo (WordPress plugin) | The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This | medium | 6.3 | 0% |
| CVE-2024-6590 | wpgsi (WordPress plugin) | The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as | medium | 6.3 | 0% |
| CVE-2023-6956 | easyazon (WordPress plugin) | The EasyAzon – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘easyazon-clo | medium | 6.1 | 0% |
| CVE-2024-10647 | ws-form (WordPress plugin) | The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due t | medium | 6.1 | 0% |
| CVE-2024-10685 | cf7-redirect-thank-you-page (WordPress plugin) | The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in | medium | 6.1 | 0% |
| CVE-2024-6073 | wp-estore (WordPress plugin) | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.1 | 0% |