Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10893 | wp-booking-calendar (WordPress plugin) | The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-12566 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could all | medium | 4.8 | 0% |
| CVE-2024-12567 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could | medium | 4.8 | 0% |
| CVE-2024-12568 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which c | medium | 4.8 | 0% |
| CVE-2024-6462 | dl-yandex-metrika (WordPress plugin) | The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-6693 | wp-content-copy-protection-\&-no-right-click (WordPress plugin) | The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-6797 | dl-robots.txt (WordPress plugin) | The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2024-6798 | dl-verification (WordPress plugin) | The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2024-8187 | smart-post-show (WordPress plugin) | The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-8702 | backup-database (WordPress plugin) | The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2024-4271 | svgator (WordPress plugin) | The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG wi | medium | 4.6 | 0% |
| CVE-2024-0859 | affiliates-manager (WordPress plugin) | The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This i | medium | 4.3 | 0% |
| CVE-2024-10321 | widgetkit-for-elementor (WordPress plugin) | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 4.3 | 0% |
| CVE-2024-10897 | tutor-lms-elementor-addons (WordPress plugin) | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-8494 | website-builder (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2025-10909 | novosga/novosga | Mangati NovoSGA XSS vulnerability in /admin | low | 2.4 | 0% |
| CVE-2025-14840 | drupal/http_client_manager | Http Client Manager introduces a new Guzzle based plugin which allows you to manage HTTP clients using Guzzle Service De | unknown | 0.0 | 0% |
| CVE-2025-59020 | typo3/cms-backend | TYPO3 CMS Allows Broken Access Control in Edit Document Controller | medium | 0.0 | 0% |
| CVE-2026-47266 | verbb/formie | formie's unauthenticated front-end submission editing can overwrite existing submissions | high | 0.0 | 0% |
| CVE-2026-49216 | symfony/ux-autocomplete | symfony/ux-autocomplete: XSS via unescaped AJAX response data | medium | 0.0 | 0% |
| CVE-2019-25710 | dolibarr/dolibarr | Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php | high | 8.2 | 0% |
| CVE-2026-28557 | wpforo (WordPress plugin) | wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reass | medium | 6.5 | 0% |
| CVE-2026-47233 | admidio/admidio | Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 | medium | 6.5 | 0% |
| CVE-2024-13551 | abc-notation (WordPress plugin) | The ABC Notation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abcjs' shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-6495 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text widget in | medium | 6.4 | 0% |
| CVE-2025-0939 | magicform (WordPress plugin) | The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX a | medium | 6.3 | 0% |
| CVE-2024-12586 | chalet-montagne.com-tools (WordPress plugin) | The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 0% |
| CVE-2025-2077 | simple-amazon-affiliate (WordPress plugin) | The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up | medium | 6.1 | 0% |
| CVE-2025-3057 | drupal/core | Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Sc | medium | 6.1 | 0% |
| CVE-2025-70792 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2024-13692 | woo-refund-and-exchange-lite (WordPress plugin) | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPre | medium | 5.4 | 0% |
| CVE-2024-5417 | gutentor (WordPress plugin) | The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/pos | medium | 5.4 | 0% |
| CVE-2024-10779 | cowidgets-elementor-addons (WordPress plugin) | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via | medium | 5.3 | 0% |
| CVE-2024-10551 | sticky-social-icons (WordPress plugin) | The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-3282 | wp-table-builder (WordPress plugin) | The WP Table Builder WordPress plugin through 1.5.0 does not sanitise and escape some of its Table data, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-3635 | the-post-grid (WordPress plugin) | The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-6481 | search-\&-filter (WordPress plugin) | The Search & Filter Pro WordPress plugin before 2.5.18 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2024-6722 | chatbot-support-ai (WordPress plugin) | The Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot WordPress plugin through 1.0.2 does not sanitise and escape some of its se | medium | 4.8 | 0% |
| CVE-2025-2524 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-9769 | video-gallery (WordPress plugin) | The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in a | medium | 4.4 | 0% |
| CVE-2022-4426 | mautic-integration-for-woocommerce (WordPress plugin) | The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not en | medium | 4.3 | 0% |
| CVE-2023-4161 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustom | medium | 4.3 | 0% |
| CVE-2024-50341 | symfony/security-bundle, symfony/symfony | Symfony's `Security::login` does not take into account custom `user_checker` | low | 3.1 | 0% |
| CVE-2023-52083 | winter/wn-system-module | Winter CMS Stored XSS through privileged upload of Media Manager file followed by renaming | low | 2.0 | 0% |
| CVE-2024-13290 | drupal/ohdear_integration | Integrates your Drupal website with the Oh Dear monitoring app. Cached data of monitoring results is accessible to non- | unknown | 0.0 | 0% |
| CVE-2024-13302 | drupal/pages_restriction | Module to restrict access from anonymous and regular users to configured pre-defined pages. The module does not adequat | unknown | 0.0 | 0% |
| CVE-2024-13303 | drupal/download_all_files | This module provides a field formatter for the field type 'file' called `Table of files with download all link` . The m | unknown | 0.0 | 0% |
| CVE-2026-100870 | sylius/sylius | CVE-2026-100870: Administrator password-reset link is built from the request Host header, allowing reset-token theft | unknown | 0.0 | 0% |
| CVE-2025-59839 | starcitizenwiki/embedvideo | Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes | high | 8.6 | 0% |
| CVE-2026-32300 | opensource-workshop/connect-cms | Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information | high | 8.1 | 0% |