Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9241 | pdf-image-generator (WordPress plugin) | The PDF Image Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropr | medium | 6.1 | 0% |
| CVE-2024-9375 | captcha-bank (WordPress plugin) | The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer | medium | 6.1 | 0% |
| CVE-2024-9607 | wd-facebook-feed (WordPress plugin) | The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appr | medium | 6.1 | 0% |
| CVE-2024-9864 | eventprime (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in | medium | 6.1 | 0% |
| CVE-2021-24822 | stylish-cost-calculator (WordPress plugin) | The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (avail | medium | 5.4 | 0% |
| CVE-2023-7287 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing | medium | 5.4 | 0% |
| CVE-2024-2017 | countdown-builder (WordPress plugin) | The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capab | medium | 5.4 | 0% |
| CVE-2024-9584 | image-map-pro (WordPress plugin) | The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2022-3459 | woocommerce-multiple-free-gift (WordPress plugin) | The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This | medium | 5.3 | 0% |
| CVE-2024-5857 | funnelforms-free (WordPress plugin) | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to un | medium | 5.3 | 0% |
| CVE-2025-32378 | shopware/core, shopware/platform | Shopware default newsletter opt-in settings allow for mass sign-up abuse | medium | 5.3 | 0% |
| CVE-2025-31673 | drupal/core | Bulk operations allow authorized users to modify several nodes at once from the Content page (`/admin/content`). A site | medium | 4.6 | 0% |
| CVE-2023-4728 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publish_lp() fu | medium | 4.3 | 0% |
| CVE-2024-11134 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_booki | medium | 4.3 | 0% |
| CVE-2025-3437 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a mi | medium | 4.3 | 0% |
| CVE-2026-25633 | statamic/cms | Statamic CMS's missing authorization allows access to assets | medium | 4.3 | 0% |
| CVE-2026-59882 | guzzlehttp/psr7 | guzzlehttp/psr7: Host Confusion via Weak URI Host Validation | medium | 4.2 | 0% |
| CVE-2025-9823 | mautic/core | Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add | medium | 0.0 | 0% |
| CVE-2026-29069 | craftcms/cms | Craft CMS has unauthenticated activation email trigger with potential user enumeration | high | 0.0 | 0% |
| CVE-2024-13349 | stockdio-historical-chart (WordPress plugin) | The Stockdio Historical Chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stockdio-historical-chart' | medium | 6.4 | 0% |
| CVE-2024-13470 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu | medium | 6.4 | 0% |
| CVE-2024-13612 | bp-better-messages (WordPress plugin) | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored C | medium | 6.4 | 0% |
| CVE-2024-2691 | wp-event-manager (WordPress plugin) | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | medium | 6.4 | 0% |
| CVE-2024-7599 | advanced-sermons (WordPress plugin) | The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermon_video_embed’ parameter in all version | medium | 6.4 | 0% |
| CVE-2023-47526 | chartify (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chart Builder Team Chartify – WordPres | medium | 5.9 | 0% |
| CVE-2025-25197 | dnadesign/silverstripe-elemental | Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report | medium | 5.4 | 0% |
| CVE-2025-57757 | contao/contao, contao/core-bundle | Contao can disclose sensitive information in the news module | medium | 5.3 | 0% |
| CVE-2023-6594 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions | medium | 4.4 | 0% |
| CVE-2023-1028 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to mis | medium | 4.3 | 0% |
| CVE-2025-66306 | getgrav/grav | Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel | medium | 4.3 | 0% |
| CVE-2025-3735 | drupal/panelizer | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-114524 | drupal/custom_formatters | The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a | unknown | 0.0 | 0% |
| CVE-2026-73477 | drupal/quicktabs | This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tab | unknown | 0.0 | 0% |
| CVE-2026-44832 | snipe/snipe-it | Snipe-IT has Privilege Escalation via API Permissions Assignment | high | 8.8 | 0% |
| CVE-2022-4888 | abandoned-cart-recovery (WordPress plugin), advanced-free-gifts (WordPress plugin), checkout-fields-manager (WordPress plugin) +7 more | The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooComme | medium | 6.5 | 0% |
| CVE-2023-4013 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its l | medium | 6.5 | 0% |
| CVE-2024-13340 | wp-meta-data-filter-and-taxonomy-filter (WordPress plugin) | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdf_results_b | medium | 6.4 | 0% |
| CVE-2024-5222 | responsive-add-ons (WordPress plugin) | The Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2022-3149 | wp-custom-cursors (WordPress plugin) | The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow a | medium | 6.1 | 0% |
| CVE-2024-1743 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back i | medium | 5.9 | 0% |
| CVE-2024-37959 | power-bi-embedded (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Atlas Public Policy Power BI Em | medium | 5.9 | 0% |
| CVE-2026-49858 | api-platform/core, api-platform/hal, api-platform/json-api | API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate | medium | 5.9 | 0% |
| CVE-2022-2171 | progressive-license (WordPress plugin) | The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2024-3111 | h5p (WordPress plugin) | The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malic | medium | 5.4 | 0% |
| CVE-2024-4377 | dot-on-paper-shortcodes (WordPress plugin) | The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2024-5448 | paypal-pay-now\,-buy-now\,-donation-and-cart-buttons-shortcode (WordPress plugin) | The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its short | medium | 5.4 | 0% |
| CVE-2021-24705 | nex-forms (WordPress plugin) | The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings | medium | 4.8 | 0% |
| CVE-2024-41709 | backdrop/backdrop | Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places | medium | 4.8 | 0% |
| CVE-2025-3583 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2023-1346 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |