Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13583 | simple-gallery-with-filter (WordPress plugin) | The Simple Gallery with Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'c2tw_sgwf' shortcode in a | medium | 6.4 | 0% |
| CVE-2024-2695 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2024-2861 | wp-user-avatar (WordPress plugin) | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up | medium | 6.4 | 0% |
| CVE-2024-6432 | custom-post-widget (WordPress plugin) | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within | medium | 6.4 | 0% |
| CVE-2025-0897 | modal-window (WordPress plugin) | The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' | medium | 6.4 | 0% |
| CVE-2023-6987 | string-locator (WordPress plugin) | The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to | medium | 6.1 | 0% |
| CVE-2024-5889 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘co | medium | 6.1 | 0% |
| CVE-2025-6740 | contact-form-cfdb7 (WordPress plugin) | The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions | medium | 6.1 | 0% |
| CVE-2025-70791 | microweber/microweber | Microweber has a Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2024-2310 | wp-google-review-slider (WordPress plugin) | The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege | medium | 5.9 | 0% |
| CVE-2024-13849 | cookie-notice-bar (WordPress plugin) | The Cookie Notice Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.0 due to i | medium | 5.5 | 0% |
| CVE-2024-13850 | simple-add-pages-or-posts (WordPress plugin) | The Simple add pages or posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.0 | medium | 5.5 | 0% |
| CVE-2022-40219 | favicon-switcher (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SedLex FavIcon Switcher plugin <= 1.2.11 at WordPress allows plugin settings change. | medium | 5.4 | 0% |
| CVE-2023-0685 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0722 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0724 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0725 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2023-0726 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due t | medium | 5.4 | 0% |
| CVE-2024-2346 | filebird (WordPress plugin) | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all | medium | 5.4 | 0% |
| CVE-2024-47050 | mautic/core, mautic/core-lib | Mautic vulnerable to XSS in contact/company tracking (no authentication) | medium | 5.4 | 0% |
| CVE-2024-13482 | icegram-engage (WordPress plugin) | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-10543 | tumult-hype-animations (WordPress plugin) | The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypean | medium | 4.3 | 0% |
| CVE-2024-10693 | skt-addons-for-elementor (WordPress plugin) | The SKT Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.3 via the Un | medium | 4.3 | 0% |
| CVE-2024-10770 | envo-extra (WordPress plugin) | The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-tem | medium | 4.3 | 0% |
| CVE-2024-12059 | elementinvader-addons-for-elementor (WordPress plugin) | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl | medium | 4.3 | 0% |
| CVE-2024-1218 | kali-forms (WordPress plugin) | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modificat | medium | 4.3 | 0% |
| CVE-2024-13374 | wp-table-manager (WordPress plugin) | The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptm_getFolders AJAX | medium | 4.3 | 0% |
| CVE-2024-9542 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6. | medium | 4.3 | 0% |
| CVE-2026-80199 | kimai/kimai | Kimai: Username enumeration via timing on X-AUTH-USER | low | 3.7 | 0% |
| CVE-2026-26188 | solspace/craft-freeform | Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue | low | 0.0 | 0% |
| CVE-2024-10711 | ithemelandco-woo-report (WordPress plugin) | The WooCommerce Report plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is | high | 8.8 | 0% |
| CVE-2024-7492 | mainwp-child-reports (WordPress plugin) | The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is | high | 8.8 | 0% |
| CVE-2025-12082 | drupal/civictheme | CivicTheme is a design system and theme framework used to build content-rich Drupal websites. It includes editorial work | high | 7.5 | 0% |
| CVE-2025-9954 | drupal/acquia_dam | This module enables you to connect a Drupal site to the Acquia DAM service, which syncs media from the third party servi | high | 7.5 | 0% |
| CVE-2024-5542 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C | high | 7.2 | 0% |
| CVE-2023-0500 | wp-film-studio (WordPress plugin) | The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logge | medium | 6.5 | 0% |
| CVE-2023-0501 | wp-insurance (WordPress plugin) | The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged | medium | 6.5 | 0% |
| CVE-2023-1624 | wpcode (WordPress plugin) | The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the | medium | 6.5 | 0% |
| CVE-2023-2326 | gravity-forms-google-sheets-connector (WordPress plugin) | The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does | medium | 6.5 | 0% |
| CVE-2023-3507 | woocommerce-pre-orders (WordPress plugin) | The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to m | medium | 6.5 | 0% |
| CVE-2023-3508 | woocommerce-pre-orders (WordPress plugin) | The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attacker | medium | 6.5 | 0% |
| CVE-2023-3720 | upload-media-by-url (WordPress plugin) | The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make log | medium | 6.5 | 0% |
| CVE-2025-60798 | phppgadmin/phppgadmin | phppgadmin contains a SQL injection vulnerability | medium | 6.5 | 0% |
| CVE-2026-41655 | admidio/admidio | Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials | medium | 6.5 | 0% |
| CVE-2024-13735 | hurrytimer (WordPress plugin) | The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | medium | 6.4 | 0% |
| CVE-2024-41380 | microweber/microweber | Microweber Cross Site Scripting (XSS) vulnerability | medium | 6.1 | 0% |
| CVE-2024-41381 | microweber/microweber | Microweber Cross Site Scripting (XSS) vulnerability | medium | 6.1 | 0% |
| CVE-2024-5859 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the | medium | 6.1 | 0% |
| CVE-2024-8729 | easy-social-share-buttons (WordPress plugin) | The Easy Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without a | medium | 6.1 | 0% |
| CVE-2026-4267 | johnbillion/query-monitor | The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI | medium | 6.1 | 0% |