Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-51404 | my-agile-privacy (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyAgilePrivacy My Agile Privacy – The | medium | 6.5 | 0% |
| CVE-2023-51532 | icegram-engage (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lea | medium | 6.5 | 0% |
| CVE-2024-24713 | auto-listings (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Auto Listings Auto Listings – Car L | medium | 6.5 | 0% |
| CVE-2024-5344 | the-plus-addons-for-elementor (WordPress plugin) | The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attr | medium | 6.1 | 0% |
| CVE-2026-55461 | snipe/snipe-it | Snipe-IT has an Open Redirect After User Edit | medium | 6.1 | 0% |
| CVE-2023-51372 | hashbar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HashBar – WordPress Notifica | medium | 5.9 | 0% |
| CVE-2022-38704 | seo-redirection (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirec | medium | 5.4 | 0% |
| CVE-2024-6392 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing c | medium | 5.4 | 0% |
| CVE-2023-5821 | thumbnail-carousel-slider (WordPress plugin) | The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce | medium | 4.3 | 0% |
| CVE-2024-5942 | page-or-post-clone (WordPress plugin) | The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via | medium | 4.3 | 0% |
| CVE-2024-7848 | user-private-files (WordPress plugin) | The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version | medium | 4.3 | 0% |
| CVE-2023-50824 | insert-or-embed-articulate-content (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Batt Insert or Embed Articulate | medium | 6.5 | 0% |
| CVE-2023-5884 | word-balloon (WordPress plugin) | The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attac | medium | 6.5 | 0% |
| CVE-2025-6550 | the-pack-addon (WordPress plugin) | The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all ver | medium | 6.4 | 0% |
| CVE-2022-0642 | jivochat (WordPress plugin) | The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and d | medium | 5.4 | 0% |
| CVE-2022-1112 | autolinks (WordPress plugin) | The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as | medium | 5.4 | 0% |
| CVE-2022-1759 | rb-internal-links (WordPress plugin) | The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attack | medium | 5.4 | 0% |
| CVE-2022-1763 | static-page-extended (WordPress plugin) | Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin s | medium | 5.4 | 0% |
| CVE-2022-1764 | wp-chgfontsize (WordPress plugin) | The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 5.4 | 0% |
| CVE-2022-1780 | latex (WordPress plugin) | The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to m | medium | 5.4 | 0% |
| CVE-2022-1781 | posttabs (WordPress plugin) | The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2022-1787 | sideblog (WordPress plugin) | The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make | medium | 5.4 | 0% |
| CVE-2022-1792 | quick-subscribe (WordPress plugin) | The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 5.4 | 0% |
| CVE-2024-10867 | borderless (WordPress plugin) | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site | medium | 5.4 | 0% |
| CVE-2024-50702 | nilsteampassnet/teampass | TeamPass mail_me operation authorization issue | medium | 5.4 | 0% |
| CVE-2024-8123 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t | medium | 5.4 | 0% |
| CVE-2023-29428 | superb-social-media-share-buttons-and-follow-buttons (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1. | medium | 5.3 | 0% |
| CVE-2023-26524 | quiz-and-survey-master (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plug | medium | 4.3 | 0% |
| CVE-2023-5531 | wp-responsive-slider-with-lightbox (WordPress plugin) | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. T | medium | 4.3 | 0% |
| CVE-2024-10695 | futurio-extra (WordPress plugin) | The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor | medium | 4.3 | 0% |
| CVE-2024-12062 | charity-addon-for-elementor (WordPress plugin) | The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.3 via t | medium | 4.3 | 0% |
| CVE-2024-13737 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 4.3 | 0% |
| CVE-2024-7721 | html5-video-player (WordPress plugin) | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a | medium | 4.3 | 0% |
| CVE-2024-8910 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 4.3 | 0% |
| CVE-2025-10039 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio | medium | 4.3 | 0% |
| CVE-2024-2179 | concrete5/concrete5 | Concrete CMS Stored Cross-site Scripting vulnerability | low | 2.2 | 0% |
| CVE-2023-52084 | winter/wn-backend-module | Winter CMS Stored XSS through Backend ColorPicker FormWidget | low | 2.0 | 0% |
| CVE-2026-100871 | sylius/sylius | CVE-2026-100871: JWT audience confusion allows shop customer to authenticate as administrator | unknown | 0.0 | 0% |
| CVE-2026-11915 | drupal/bfap_sb | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-15087 | drupal/clean_node_api | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-32262 | craftcms/cms | Craft CMS has a Path Traversal Vulnerability in AssetsController | medium | 0.0 | 0% |
| CVE-2026-84923 | drupal/otp_verification | This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently valid | unknown | 0.0 | 0% |
| CVE-2026-33080 | filament/tables | Filament Unvalidated Range and Values summarizer values can be used for XSS | high | 7.3 | 0% |
| CVE-2024-5791 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'w | high | 7.2 | 0% |
| CVE-2024-37262 | online-booking-\&-scheduling-calendar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita.Com Online Booking & Sche | high | 7.1 | 0% |
| CVE-2024-12494 | bmlt-meeting-map (WordPress plugin) | The BMLT Meeting Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bmlt_meeting_map' shortcode in all | medium | 6.4 | 0% |
| CVE-2024-13379 | c9-admin-dashboard (WordPress plugin) | The C9 Admin Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-13441 | bilingual-linker (WordPress plugin) | The Bilingual Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bl_otherlang_link_1 parameter in all versions | medium | 6.4 | 0% |
| CVE-2024-13548 | power-ups-for-elementor (WordPress plugin) | The Power Ups for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'magic-button' shortcode in a | medium | 6.4 | 0% |
| CVE-2024-13563 | front-end-only-users (WordPress plugin) | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all vers | medium | 6.4 | 0% |