Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10885 | searchiq (WordPress plugin) | The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortc | medium | 6.4 | 0% |
| CVE-2024-11782 | wp-mailster (WordPress plugin) | The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mst_subscribe' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-11897 | mightyforms (WordPress plugin) | The Contact Form, Survey & Form Builder – MightyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mi | medium | 6.4 | 0% |
| CVE-2024-11898 | scratch-win-giveaways-for-website-facebook (WordPress plugin) | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vu | medium | 6.4 | 0% |
| CVE-2024-9073 | gtg-advanced-blocks (WordPress plugin) | The GutenGeek Free Gutenberg Blocks for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in | medium | 6.4 | 0% |
| CVE-2024-9848 | product-customizer-light (WordPress plugin) | The Product Customizer Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, a | medium | 6.4 | 0% |
| CVE-2023-1866 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 5.4 | 0% |
| CVE-2023-3427 | salon-booking-system (WordPress plugin) | The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is d | medium | 5.4 | 0% |
| CVE-2023-4689 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This | medium | 5.4 | 0% |
| CVE-2023-4690 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This | medium | 5.4 | 0% |
| CVE-2025-48202 | in2code/femanager | The femanager TYPO3 extension allows Insecure Direct Object Reference | medium | 5.3 | 0% |
| CVE-2020-15247 | october/cms | Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. | medium | 5.2 | 0% |
| CVE-2015-10146 | wp-responsive-slider-with-lightbox (WordPress plugin) | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and inc | medium | 4.9 | 0% |
| CVE-2015-10147 | easy-testimonial-rotator (WordPress plugin) | The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and i | medium | 4.9 | 0% |
| CVE-2023-1029 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to mis | medium | 4.3 | 0% |
| CVE-2023-1068 | read-more-excerpt-link (WordPress plugin) | The Download Read More Excerpt Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0 | medium | 4.3 | 0% |
| CVE-2023-2286 | wp-security-audit-log (WordPress plugin) | The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missin | medium | 4.3 | 0% |
| CVE-2023-2352 | chp-ads-block-detector (WordPress plugin) | The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is | medium | 4.3 | 0% |
| CVE-2023-2563 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2023-3199 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_ | medium | 4.3 | 0% |
| CVE-2023-3202 | mstore-api (WordPress plugin) | The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebas | medium | 4.3 | 0% |
| CVE-2023-3407 | subscribe2 (WordPress plugin) | The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to miss | medium | 4.3 | 0% |
| CVE-2026-55825 | contao/contao, contao/core-bundle | Contao: Possible path traversal in job download URIs | low | 3.1 | 0% |
| CVE-2025-3638 | moodle/moodle | Moodle has a CSRF risk in Brickfield tool's analysis request action | low | 0.0 | 0% |
| CVE-2025-8361 | drupal/config_pages | This module enables you to access an edit page for a config page. The module doesn't sufficiently check the access perm | unknown | 0.0 | 0% |
| CVE-2026-73476 | drupal/externalauth | This module enables you to authenticate Drupal users against external identity providers. The module does not sufficien | unknown | 0.0 | 0% |
| CVE-2024-5943 | wp-nested-pages (WordPress plugin) | The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due t | high | 8.8 | 0% |
| CVE-2025-49137 | elmsln/haxcms | Hax CMS Stored Cross-Site Scripting vulnerability | high | 8.5 | 0% |
| CVE-2026-69088 | getgrav/grav | Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure | high | 8.1 | 0% |
| CVE-2026-29788 | miraheze/ts-portal | TSPortal: Any user can forge self-deletion requests for any account | high | 7.5 | 0% |
| CVE-2023-30616 | form-block (WordPress plugin) | Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery | medium | 6.5 | 0% |
| CVE-2024-35761 | online-booking-\&-scheduling-calendar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduli | medium | 6.5 | 0% |
| CVE-2024-10150 | bamazoo-button-generator (WordPress plugin) | The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-12452 | ziggeo (WordPress plugin) | The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeo_event' shortcode in all versions up to | medium | 6.4 | 0% |
| CVE-2024-13395 | threepress (WordPress plugin) | The Threepress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'threepress' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2024-13576 | gumlet-video (WordPress plugin) | The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to | medium | 6.4 | 0% |
| CVE-2024-13757 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_layer shor | medium | 6.4 | 0% |
| CVE-2024-13802 | bandsintown (WordPress plugin) | The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintown_events' shortcode in | medium | 6.4 | 0% |
| CVE-2024-4971 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all ver | medium | 6.4 | 0% |
| CVE-2024-5251 | ultimate-addons-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_pricing shortc | medium | 6.4 | 0% |
| CVE-2024-5252 | ultimate-addons-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shor | medium | 6.4 | 0% |
| CVE-2024-5253 | ultimate-addons-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ult_team shortcode in al | medium | 6.4 | 0% |
| CVE-2024-5254 | ultimate-addons-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_banner sho | medium | 6.4 | 0% |
| CVE-2024-5255 | ultimate-addons-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_dual_color shor | medium | 6.4 | 0% |
| CVE-2024-9064 | inline-svg-elementor (WordPress plugin) | The Elementor Inline SVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and i | medium | 6.4 | 0% |
| CVE-2025-1410 | pie-calendar (WordPress plugin) | The Events Calendar Made Simple – Pie Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's piecal sho | medium | 6.4 | 0% |
| CVE-2025-1802 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘marker_title’, 'notif | medium | 6.4 | 0% |
| CVE-2025-3457 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2025-3458 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2025-62796 | privatebin/privatebin | PrivateBin is missing HTML sanitization of attached filename in file size hint | medium | 5.8 | 0% |