Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6849 | preloader-plus (WordPress plugin) | The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads | medium | 6.4 | 0% |
| CVE-2025-0371 | jetelements (WordPress plugin) | The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, | medium | 6.4 | 0% |
| CVE-2025-0805 | mortgage-loan-calculator (WordPress plugin) | The Mortgage Calculator / Loan Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortc | medium | 6.4 | 0% |
| CVE-2025-1287 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2025-1406 | newpost-catch (WordPress plugin) | The Newpost Catch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's npc shortcode in all versions up to, an | medium | 6.4 | 0% |
| CVE-2025-1489 | wp-appbox (WordPress plugin) | The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and | medium | 6.4 | 0% |
| CVE-2025-2225 | responsive-addons-for-elementor (WordPress plugin) | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cros | medium | 6.4 | 0% |
| CVE-2025-5341 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | 0% |
| CVE-2024-13825 | email-keep (WordPress plugin) | The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | medium | 6.1 | 0% |
| CVE-2025-0613 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, | medium | 6.1 | 0% |
| CVE-2023-28172 | wp-maps (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS (formerly WP Google Map Plugin) pl | medium | 5.4 | 0% |
| CVE-2024-10584 | directorypress (WordPress plugin) | The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG | medium | 5.4 | 0% |
| CVE-2025-67856 | moodle/moodle | Moodle has an authorization logic flaw | medium | 5.4 | 0% |
| CVE-2025-62396 | moodle/moodle | Moodle's error handling leads to sensitive information disclosure | medium | 5.3 | 0% |
| CVE-2023-6446 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and i | medium | 4.4 | 0% |
| CVE-2023-6497 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting | medium | 4.4 | 0% |
| CVE-2024-0657 | internal-links (WordPress plugin) | The Internal Link Juicer: SEO Auto Linker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings | medium | 4.4 | 0% |
| CVE-2024-0664 | meks-smart-social-widget (WordPress plugin) | The Meks Smart Social Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meks Smart Social Widget in all versi | medium | 4.4 | 0% |
| CVE-2024-0688 | pubsubhubbub (WordPress plugin) | The "WebSub (FKA. PubSubHubbub)" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to | medium | 4.4 | 0% |
| CVE-2024-0703 | sticky-buttons (WordPress plugin) | The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versi | medium | 4.4 | 0% |
| CVE-2025-23204 | api-platform/core | API Platform Core does not call GraphQl securityAfterResolver | medium | 4.4 | 0% |
| CVE-2022-3336 | event-monster (WordPress plugin) | The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged | medium | 4.3 | 0% |
| CVE-2025-47937 | typo3/cms-core | TYPO3 Allows Information Disclosure via DBAL Restriction Handling | low | 3.7 | 0% |
| CVE-2025-26531 | moodle/moodle | Moodle has an IDOR in badges allows disabling of arbitrary badges | low | 3.1 | 0% |
| CVE-2026-62237 | getgrav/grav | Grav: Authenticated ReDoS via regex_replace in Twig Sandbox | medium | 0.0 | 0% |
| CVE-2026-8350 | concrete5/concrete5 | Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php | high | 0.0 | 0% |
| CVE-2026-42611 | getgrav/grav | Grav is Vulnerable to Stored XSS via Tag Injection | high | 8.9 | 0% |
| CVE-2026-41060 | wwbn/avideo | WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL | high | 7.7 | 0% |
| CVE-2025-66468 | aimeos/ai-cms-grapesjs | Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors | high | 7.6 | 0% |
| CVE-2022-4125 | popup-manager (WordPress plugin) | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sa | medium | 4.3 | 0% |
| CVE-2022-47177 | wp-easypay (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions. | medium | 4.3 | 0% |
| CVE-2023-1807 | stax-addons-for-elementor (WordPress plugin) | The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, an | medium | 4.3 | 0% |
| CVE-2026-25488 | craftcms/commerce | Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2026-30662 | concrete5/concrete5 | ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads | medium | 6.5 | 0% |
| CVE-2026-47230 | admidio/admidio | Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders | medium | 6.5 | 0% |
| CVE-2026-48067 | filament/actions, filament/tables | Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields | medium | 6.5 | 0% |
| CVE-2026-61449 | getgrav/grav | Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer | medium | 6.5 | 0% |
| CVE-2024-12525 | easy-mls-listings-import (WordPress plugin) | The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' | medium | 6.4 | 0% |
| CVE-2024-13464 | library-bookshelves (WordPress plugin) | The Library Bookshelves plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bookshelf' shortcode in all vers | medium | 6.4 | 0% |
| CVE-2024-13658 | ngg-smart-image-search (WordPress plugin) | The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' sho | medium | 6.4 | 0% |
| CVE-2024-13679 | buybox-widget (WordPress plugin) | The Widget BUY.BOX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buybox-widget' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-13769 | puzzles (WordPress plugin) | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to | medium | 6.4 | 0% |
| CVE-2024-5641 | one-click-order-reorder (WordPress plugin) | The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th | medium | 6.4 | 0% |
| CVE-2024-5668 | foobox-image-lightbox (WordPress plugin) | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML da | medium | 6.4 | 0% |
| CVE-2024-9595 | tablepress (WordPress plugin) | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content | medium | 6.4 | 0% |
| CVE-2024-13319 | themify-builder (WordPress plugin) | The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate | medium | 6.1 | 0% |
| CVE-2024-13404 | link-library (WordPress plugin) | The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, an | medium | 6.1 | 0% |
| CVE-2024-13406 | xml-for-google-merchant-center (WordPress plugin) | The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feed_id' parameter in all v | medium | 6.1 | 0% |
| CVE-2025-61183 | webreinvent/vaahcms | VaahCMS is vulnerable to XSS through its Avatar Upload endpoint | medium | 6.1 | 0% |
| CVE-2025-1440 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function | medium | 5.3 | 0% |