Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5868 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the | medium | 6.5 | 0% |
| CVE-2023-6801 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Store | medium | 6.4 | 0% |
| CVE-2023-7069 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all ve | medium | 6.4 | 0% |
| CVE-2024-2130 | cww-companion (WordPress plugin) | The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2024-8747 | email-obfuscate-shortcode (WordPress plugin) | The Email Obfuscate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email-obfuscate' shortcode | medium | 6.4 | 0% |
| CVE-2024-8965 | absolute-reviews (WordPress plugin) | The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all | medium | 6.4 | 0% |
| CVE-2024-9115 | common-tools-for-site (WordPress plugin) | The Common Tools for Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-9117 | mapplic-lite (WordPress plugin) | The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including | medium | 6.4 | 0% |
| CVE-2022-0402 | super-forms (WordPress plugin) | The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana param | medium | 6.1 | 0% |
| CVE-2025-3516 | simple-lightbox (WordPress plugin) | The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/ | medium | 5.9 | 0% |
| CVE-2022-0398 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affili | medium | 5.4 | 0% |
| CVE-2022-2312 | student-result-or-employee-database (WordPress plugin) | The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make log | medium | 5.4 | 0% |
| CVE-2022-44627 | cds-simple-seo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete | medium | 5.4 | 0% |
| CVE-2024-13520 | gift-vouchers (WordPress plugin) | The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data| | medium | 5.3 | 0% |
| CVE-2023-6842 | formidable (WordPress plugin) | The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stor | medium | 4.4 | 0% |
| CVE-2023-4935 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |
| CVE-2023-4937 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco | medium | 4.3 | 0% |
| CVE-2021-39198 | oro/crm | The disqualify lead action may be executed without CSRF token check | medium | 4.2 | 0% |
| CVE-2020-15248 | october/backend | Privilege escalation by backend users assigned to the default "Publisher" system role | medium | 4.0 | 0% |
| CVE-2026-49742 | typo3/cms-core, typo3/cms-filelist | TYPO3 CMS has Broken Access Control in its Media Module | high | 0.0 | 0% |
| CVE-2026-73478 | drupal/diff | This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently r | unknown | 0.0 | 0% |
| CVE-2026-81158 | drupal/entity | The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their proper | unknown | 0.0 | 0% |
| CVE-2026-81165 | drupal/blazy | This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module doe | unknown | 0.0 | 0% |
| CVE-2026-81166 | drupal/digital_signage_framework | The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a displ | unknown | 0.0 | 0% |
| CVE-2026-34564 | ci4-cms-erp/ci4ms | CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2026-50886 | grumpydictator/firefly-iii | Project Firefly III has incorrect access control in the webhook management component | critical | 9.1 | 0% |
| CVE-2024-6022 | contentlock (WordPress plugin) | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to | high | 8.8 | 0% |
| CVE-2024-6023 | contentlock (WordPress plugin) | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a l | high | 8.8 | 0% |
| CVE-2024-6024 | contentlock (WordPress plugin) | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers | high | 8.8 | 0% |
| CVE-2024-3983 | woocommerce-customers-manager (WordPress plugin) | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers t | high | 8.1 | 0% |
| CVE-2023-6938 | oxygen (WordPress plugin) | The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including | medium | 6.4 | 0% |
| CVE-2024-9457 | cssjockey-add-ons (WordPress plugin) | The WP Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, | medium | 6.4 | 0% |
| CVE-2025-4968 | page-builder (WordPress plugin) | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements | medium | 6.4 | 0% |
| CVE-2024-12167 | ultimate-shortcodes-creator (WordPress plugin) | The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in | medium | 6.1 | 0% |
| CVE-2025-26159 | nasirkhan/laravel-starter | Laravel Starter Cross Site Scripting (XSS) | medium | 6.1 | 0% |
| CVE-2022-40695 | seo-redirection (WordPress plugin) | Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-41634 | media-library-plus (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress. | medium | 5.4 | 0% |
| CVE-2022-44740 | creative-mail-by-constant-contact (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress. | medium | 5.4 | 0% |
| CVE-2023-6990 | weaver-xtreme-theme-support (WordPress theme) | The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including | medium | 5.4 | 0% |
| CVE-2024-0790 | bulk-editor (WordPress plugin) | The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers | medium | 5.4 | 0% |
| CVE-2024-2430 | website-content-in-page-or-post (WordPress plugin) | The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before | medium | 5.4 | 0% |
| CVE-2024-3236 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such | medium | 5.4 | 0% |
| CVE-2024-4270 | svgmagic (WordPress plugin) | The SVGMagic WordPress plugin through 1.1 does not sanitize SVG file contents, which enables users with at least the author role to SVG with | medium | 5.4 | 0% |
| CVE-2024-5444 | bible-text (WordPress plugin) | The Bible Text WordPress plugin through 0.2 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2024-5627 | tournamatch (WordPress plugin) | The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as su | medium | 5.4 | 0% |
| CVE-2024-6869 | falang (WordPress plugin) | The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.4 | 0% |
| CVE-2024-13554 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 5.3 | 0% |
| CVE-2026-107844 | contao/core-bundle | Contao: Path traversal in the images controller | medium | 5.3 | 0% |
| CVE-2026-25597 | prestashop/prestashop | PrestaShop affected by time based enumeration in FO login form | medium | 5.3 | 0% |
| CVE-2023-7168 | better-flow-button-for-jetpack (WordPress plugin) | The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |