Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-30741 | pixelfed/pixelfed | Pixelfed may allow unauthorized actor to view private posts and private users | medium | 4.3 | 0% |
| CVE-2024-13270 | drupal/freelinking | This module enables you to configure a wiki-like input filter that allows users to create links to site and external con | unknown | 0.0 | 0% |
| CVE-2024-13271 | drupal/content_entity_clone | This module enables you to "clone" a content entity, i.e. to create a new content pre-filled with data from another enti | unknown | 0.0 | 0% |
| CVE-2025-7031 | drupal/config_pages_viewer | This module enables you to use [config\_pages](https://www.drupal.org/project/config_pages) as a content entity. The mo | unknown | 0.0 | 0% |
| CVE-2026-55481 | snipe/snipe-it | Snipe-IT has CSS Injection via `header_color` Setting | medium | 0.0 | 0% |
| CVE-2026-96398 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2022-44737 | all-in-one-wp-security-\&-firewall (WordPress plugin) | Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on Wor | medium | 6.5 | 0% |
| CVE-2024-10269 | easy-svg (WordPress plugin) | The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-10325 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all | medium | 6.4 | 0% |
| CVE-2024-11230 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all vers | medium | 6.4 | 0% |
| CVE-2024-12463 | arena-liveblog-and-chat-tool (WordPress plugin) | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arena_ | medium | 6.4 | 0% |
| CVE-2024-13584 | picture-gallery (WordPress plugin) | The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-13599 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including | medium | 6.4 | 0% |
| CVE-2024-3565 | custom-post-widget (WordPress plugin) | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_block' s | medium | 6.4 | 0% |
| CVE-2024-4488 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘inline_list’ parameter in versi | medium | 6.4 | 0% |
| CVE-2024-4489 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ fun | medium | 6.4 | 0% |
| CVE-2024-4665 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel | medium | 6.4 | 0% |
| CVE-2024-5152 | element-ready-lite (WordPress plugin) | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all vers | medium | 6.4 | 0% |
| CVE-2024-5161 | magical-addons-for-elementor (WordPress plugin) | The Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) plugin for WordPress is vuln | medium | 6.4 | 0% |
| CVE-2024-5177 | hash-elements (WordPress plugin) | The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter within multiple widgets in all v | medium | 6.4 | 0% |
| CVE-2024-5191 | branda-white-labeling (WordPress plugin) | The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ | medium | 6.4 | 0% |
| CVE-2024-5224 | cardoza-facebook-like-box (WordPress plugin) | The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardoz | medium | 6.4 | 0% |
| CVE-2024-5426 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ p | medium | 6.4 | 0% |
| CVE-2024-5571 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 0% |
| CVE-2024-5646 | futurio-extra (WordPress plugin) | The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘header_size’ attribute within the Advanced Text | medium | 6.4 | 0% |
| CVE-2024-9421 | login-logout-shortcode (WordPress plugin) | The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2024-9445 | display-medium-posts (WordPress plugin) | The Display Medium Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_medium_posts shortcode i | medium | 6.4 | 0% |
| CVE-2024-9674 | debrandify (WordPress plugin) | The Debrandify · Remove or Replace WordPress Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads | medium | 6.4 | 0% |
| CVE-2024-13100 | opsi-israel-domestic-shipments (WordPress plugin) | The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the | medium | 6.1 | 0% |
| CVE-2024-32597 | wp-smart-import (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows | medium | 5.9 | 0% |
| CVE-2023-0728 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-3410 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, | medium | 5.4 | 0% |
| CVE-2024-6283 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL parameter of the De Gallery widge | medium | 5.4 | 0% |
| CVE-2026-54181 | backpack/crud | Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted | medium | 5.4 | 0% |
| CVE-2026-72832 | getgrav/grav | Grav: Stored XSS via quoted-attribute bypass in detectXss | medium | 5.4 | 0% |
| CVE-2024-12620 | animategl (WordPress plugin) | The AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin for WordPress is vulnerable to unauthorized modifica | medium | 5.3 | 0% |
| CVE-2025-4370 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_u | medium | 5.3 | 0% |
| CVE-2024-13095 | wp-triggers-lite (WordPress plugin) | The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing ad | medium | 4.8 | 0% |
| CVE-2025-3502 | wp-maps (WordPress plugin) | The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-3198 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_ | medium | 4.3 | 0% |
| CVE-2023-3200 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_ord | medium | 4.3 | 0% |
| CVE-2023-3201 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_ord | medium | 4.3 | 0% |
| CVE-2023-3203 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_p | medium | 4.3 | 0% |
| CVE-2024-4874 | bricks (WordPress plugin) | The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via th | medium | 4.3 | 0% |
| CVE-2025-3513 | sureforms (WordPress plugin) | The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users | low | 3.5 | 0% |
| CVE-2025-54476 | joomla/filter | Joomla! CMS vulnerable to XSS via the input filter | medium | 0.0 | 0% |
| CVE-2026-15088 | drupal/development_environment | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-16642 | drupal/email_login_otp | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-16643 | drupal/lunr_filters | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-56093 | apache-solr-for-typo3/solr | TYPO3-EXT-SA-2026-025: Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) | unknown | 0.0 | 0% |