Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4477 | wp-logs-book (WordPress plugin) | The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin da | medium | 5.4 | 0% |
| CVE-2023-1340 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1341 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1342 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1343 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1344 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-1345 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2024-13652 | ecpay-ecommerce-for-woocommerce (WordPress plugin) | The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2025-4431 | featured-image-plus (WordPress plugin) | The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a m | medium | 4.3 | 0% |
| CVE-2025-4683 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due t | medium | 4.3 | 0% |
| CVE-2025-13784 | yungifez/skuul | yungifez Skuul School Management System vulnerable to XSS via SVG | low | 2.4 | 0% |
| CVE-2025-58449 | mahocommerce/maho | Maho is Vulnerable to Authenticated Remote Code Execution via File Upload | high | 0.0 | 0% |
| CVE-2024-1217 | kali-forms (WordPress plugin) | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation | high | 7.6 | 0% |
| CVE-2024-13329 | solidres (WordPress plugin) | The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | high | 7.1 | 0% |
| CVE-2024-13733 | skt-blocks (WordPress plugin) | The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's skt-blocks/ | medium | 6.4 | 0% |
| CVE-2024-13858 | buddyboss-platform (WordPress plugin) | The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ paramete | medium | 6.4 | 0% |
| CVE-2024-9173 | gf-custom-style (WordPress plugin) | The GF Custom Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2025-3488 | wpml (WordPress plugin) | The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_switcher shortcode in versions 3.6 | medium | 6.4 | 0% |
| CVE-2026-48493 | snipe/snipe-it | Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment | medium | 5.5 | 0% |
| CVE-2024-10583 | popup-maker (WordPress plugin) | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to St | medium | 5.4 | 0% |
| CVE-2024-12610 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check | medium | 5.3 | 0% |
| CVE-2025-1483 | ltl-freight-quotes (WordPress plugin) | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi | medium | 5.3 | 0% |
| CVE-2026-33759 | wwbn/avideo | AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents | medium | 5.3 | 0% |
| CVE-2024-13208 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which coul | medium | 4.3 | 0% |
| CVE-2024-48899 | moodle/moodle | Moodle IDOR when accessing list of course badges | medium | 4.3 | 0% |
| CVE-2025-4101 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a mi | medium | 4.3 | 0% |
| CVE-2026-90936 | froxlor/froxlor | Froxlor: Authenticated customers can read other customers' allowed sender aliases | medium | 4.3 | 0% |
| CVE-2025-64112 | statamic/cms | Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation | high | 8.0 | 0% |
| CVE-2024-7713 | chatgpt-assistant (WordPress plugin) | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticat | high | 7.5 | 0% |
| CVE-2026-76846 | getgrav/grav | Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when co | high | 7.5 | 0% |
| CVE-2025-6212 | ultimate-addons-for-contact-form-7 (WordPress plugin) | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3. | high | 7.2 | 0% |
| CVE-2026-56701 | getgrav/grav | Grav is Vulnerable to XXE via SVG Upload | medium | 6.5 | 0% |
| CVE-2024-5265 | wpbakery-page-builder-clipboard (WordPress plugin) | The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link attribute within the vc_single_i | medium | 6.4 | 0% |
| CVE-2024-5938 | boot-store (WordPress theme) | The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode | medium | 6.4 | 0% |
| CVE-2024-9452 | branding (WordPress plugin) | The Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1. | medium | 6.4 | 0% |
| CVE-2023-7086 | svg-uploads-support (WordPress plugin) | The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as A | medium | 5.4 | 0% |
| CVE-2023-7088 | inventivo (WordPress plugin) | The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow us | medium | 5.4 | 0% |
| CVE-2024-10151 | auto-iframe (WordPress plugin) | The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2024-11841 | tithe.ly-giving-button (WordPress plugin) | The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2024-46994 | baserproject/basercms | baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts and Contents list Feature | medium | 5.4 | 0% |
| CVE-2025-4571 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due t | medium | 5.4 | 0% |
| CVE-2024-12807 | social-share-buttons (WordPress plugin) | The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2024-10606 | wp-travel-engine (WordPress plugin) | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data | medium | 4.3 | 0% |
| CVE-2026-120329 | mediaessenz/mail | TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail) | unknown | 0.0 | 0% |
| CVE-2026-120332 | mediaessenz/mail | TYPO3-EXT-SA-2026-037: Cross-Site Scripting in extension "Mail" (mail) | unknown | 0.0 | 0% |
| CVE-2026-45072 | symfony/symfony, symfony/twig-bridge, symfony/web-profiler-bundle | Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering | low | 0.0 | 0% |
| CVE-2026-46637 | twig/cssinliner-extra, twig/markdown-extra | Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` | low | 0.0 | 0% |
| CVE-2026-31889 | shopware/core, shopware/platform | Shopware vulnerable to a potential take over of app credentials | high | 8.9 | 0% |
| CVE-2026-41175 | statamic/cms | Statamic: Unsafe method invocation via query value resolution allows data destruction | high | 8.1 | 0% |
| CVE-2026-21447 | bagisto/bagisto | Bagisto has IDOR in Customer Order Reorder Functionality | high | 7.1 | 0% |