Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13651 | unusedcss (WordPress plugin) | The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c | medium | 4.3 | 0% |
| CVE-2024-13703 | crm-customer-relationship-management-by-vcita (WordPress plugin) | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che | medium | 4.3 | 0% |
| CVE-2025-1408 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-2942 | order-delivery-date-for-woocommerce (WordPress plugin) | The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthen | medium | 4.3 | 0% |
| CVE-2024-5167 | cm-e-mail-blacklist (WordPress plugin) | The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item fro | high | 8.1 | 0% |
| CVE-2024-5091 | skt-addons-for-elementor (WordPress plugin) | The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Age Gate and Creative Slider | high | 7.4 | 0% |
| CVE-2025-2800 | wp-event-manager (WordPress plugin) | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | high | 7.2 | 0% |
| CVE-2024-5090 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SiteOrigin Blog Widget in a | medium | 6.4 | 0% |
| CVE-2025-3862 | contest-gallery (WordPress plugin) | Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and includin | medium | 6.4 | 0% |
| CVE-2025-6975 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ca | medium | 6.1 | 0% |
| CVE-2025-30148 | silverstripe/framework | Silverstripe Framework has a XSS vulnerability in HTML editor | medium | 5.4 | 0% |
| CVE-2026-82396 | sulu/sulu | Sulu: Stored XSS via media download inline-disposition override | medium | 5.4 | 0% |
| CVE-2024-45612 | contao/core-bundle | Contao affected by insert tag injection via canonical URL | medium | 5.3 | 0% |
| CVE-2024-6489 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 5.3 | 0% |
| CVE-2023-6487 | luckywp-table-of-contents (WordPress plugin) | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions | medium | 4.4 | 0% |
| CVE-2025-24374 | twig/twig | Twig security issue where escaping was missing when using null coalesce operator | medium | 4.3 | 0% |
| CVE-2026-100909 | october/october | October CMS: Incomplete Scheme Validation in Image Resizer | low | 3.9 | 0% |
| CVE-2026-118561 | drupal/single_content_sync | Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The m | unknown | 0.0 | 0% |
| CVE-2026-118565 | drupal/groupexpro | Integration with GroupEx PRO system, decoupled from Open Y. The module does not sufficiently validate user inputs in so | unknown | 0.0 | 0% |
| CVE-2026-44655 | mantisbt/mantisbt | MantisBT has Stored XSS on Move Attachments Admin Page | high | 0.0 | 0% |
| CVE-2026-52823 | kimai/kimai | Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes | medium | 0.0 | 0% |
| CVE-2026-55643 | snipe/snipe-it | Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode | high | 0.0 | 0% |
| CVE-2026-96391 | drupal/webform_rest | This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to w | unknown | 0.0 | 0% |
| CVE-2023-23941 | swag/paypal | Payment information sent to PayPal not necessarily identical to created order | high | 7.5 | 0% |
| CVE-2024-45232 | in2code/powermail | "powermail" (powermail) Insecure Direct Object Reference (IDOR) | high | 7.3 | 0% |
| CVE-2026-41660 | admidio/admidio | Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP | high | 7.1 | 0% |
| CVE-2019-25317 | kimai/kimai | Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions | medium | 6.4 | 0% |
| CVE-2024-12118 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the htm | medium | 6.4 | 0% |
| CVE-2025-2892 | all-in-one-seo (WordPress plugin) | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Sc | medium | 6.4 | 0% |
| CVE-2025-3487 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | 0% |
| CVE-2022-3847 | showing-url-in-qr-code (WordPress plugin) | The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation a | medium | 6.1 | 0% |
| CVE-2024-3215 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.3 | 0% |
| CVE-2025-57756 | contao/contao, contao/core-bundle | Contao discloses sensitive information in the front end search index | medium | 5.3 | 0% |
| CVE-2024-12033 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() funct | medium | 4.3 | 0% |
| CVE-2024-1719 | paypal-\&-stripe-add-on (WordPress plugin) | The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2024-6254 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This | medium | 4.3 | 0% |
| CVE-2021-36915 | profile-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file an | medium | 4.2 | 0% |
| CVE-2025-1203 | slider\,-gallery\,-and-carousel (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which cou | low | 3.5 | 0% |
| CVE-2026-25484 | craftcms/commerce | Craft Commerce has Stored XSS in Product Type Name | medium | 0.0 | 0% |
| CVE-2026-25485 | craftcms/composer | Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2026-25487 | craftcms/commerce | Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2026-25490 | craftcms/commerce | Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2026-25522 | craftcms/commerce | Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2026-32813 | admidio/admidio | Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter) | high | 8.0 | 0% |
| CVE-2025-5282 | wp-travel-engine (WordPress plugin) | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a | high | 7.5 | 0% |
| CVE-2026-48505 | filament/filament | Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission | high | 7.4 | 0% |
| CVE-2025-2325 | wp-test-email (WordPress plugin) | The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1 | high | 7.2 | 0% |
| CVE-2024-1439 | moodle/moodle | Moodle Improper Access Control vulnerability | medium | 6.5 | 0% |
| CVE-2024-10266 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all | medium | 6.4 | 0% |
| CVE-2024-10484 | ultimate-addons-for-gutenberg (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in | medium | 6.4 | 0% |