Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-48897 | moodle/moodle | moodle: IDOR in edit/delete RSS feed | medium | 6.5 | 0% |
| CVE-2024-48898 | moodle/moodle | moodle: Some users can delete audiences of other reports | medium | 6.5 | 0% |
| CVE-2025-3780 | wc-frontend-manager (WordPress plugin) | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unaut | medium | 6.5 | 0% |
| CVE-2024-13734 | card-elements-for-elementor (WordPress plugin) | The Card Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Profile Card widget in al | medium | 6.4 | 0% |
| CVE-2024-6155 | greenshift-animation-and-page-builder-blocks (WordPress plugin) | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request For | medium | 6.4 | 0% |
| CVE-2024-6261 | final-tiles-grid-gallery-lite (WordPress plugin) | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGalle | medium | 6.4 | 0% |
| CVE-2024-6458 | wc-product-table-lite (WordPress plugin) | The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability ch | medium | 6.4 | 0% |
| CVE-2025-1405 | post-type-x (WordPress plugin) | The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all | medium | 6.4 | 0% |
| CVE-2025-1571 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Imag | medium | 6.4 | 0% |
| CVE-2025-1689 | paypal-checkout (WordPress plugin) | The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in vers | medium | 6.4 | 0% |
| CVE-2025-1690 | stripe-checkout (WordPress plugin) | The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up | medium | 6.4 | 0% |
| CVE-2025-4943 | lastudio-element-kit (WordPress plugin) | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-lakit-element-link’ | medium | 6.4 | 0% |
| CVE-2024-7888 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 6.3 | 0% |
| CVE-2022-36417 | cardoza-3d-tag-cloud (WordPress plugin) | Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress. | medium | 6.1 | 0% |
| CVE-2024-37156 | sulu/form-bundle | TokenController formName not sanitized in hidden input | medium | 6.1 | 0% |
| CVE-2024-12308 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2024-5309 | form-vibes (WordPress plugin) | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due t | medium | 5.4 | 0% |
| CVE-2025-4405 | hot-random-image (WordPress plugin) | The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and i | medium | 4.9 | 0% |
| CVE-2025-2104 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insuf | medium | 4.3 | 0% |
| CVE-2025-0692 | simple-video-management-system (WordPress plugin) | The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high | low | 3.5 | 0% |
| CVE-2025-26528 | moodle/moodle | Moodle has a stored XSS in ddimageortext question type | low | 3.4 | 0% |
| CVE-2022-29454 | bp-better-messages (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload file | low | 3.1 | 0% |
| CVE-2026-3216 | drupal/canvas | This module enables you to easily theme and build an entire website using only their browser, without the need to write | unknown | 0.0 | 0% |
| CVE-2025-66844 | getgrav/grav | Grav may be vulnerable to SSRF attack via Twig Templates | critical | 9.1 | 0% |
| CVE-2024-9990 | crypto (WordPress plugin) | The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing n | high | 8.8 | 0% |
| CVE-2021-27917 | mautic/core, mautic/core-lib | Mautic has an XSS in contact tracking and page hits report | high | 7.3 | 0% |
| CVE-2024-13668 | wordpress-activity-o-meter (WordPress plugin) | The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, | high | 7.1 | 0% |
| CVE-2024-3492 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin | medium | 6.4 | 0% |
| CVE-2024-5317 | newsletter (WordPress plugin) | The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and includin | medium | 6.4 | 0% |
| CVE-2025-1455 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all ve | medium | 6.4 | 0% |
| CVE-2025-1456 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCoun | medium | 6.4 | 0% |
| CVE-2025-3100 | wedevs-project-manager (WordPress plugin) | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerabl | medium | 6.4 | 0% |
| CVE-2025-29746 | koillection/koillection | Koillection Cross Site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2023-2279 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due t | medium | 5.4 | 0% |
| CVE-2023-4248 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing | medium | 5.4 | 0% |
| CVE-2024-1809 | wp-analytify (WordPress plugin) | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access | medium | 5.4 | 0% |
| CVE-2025-4520 | uncanny-automator (WordPress plugin) | The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple | medium | 5.4 | 0% |
| CVE-2024-3866 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all | medium | 4.7 | 0% |
| CVE-2025-46350 | yeswiki/yeswiki | Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting | low | 3.8 | 0% |
| CVE-2026-42610 | getgrav/grav | Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass | medium | 6.5 | 0% |
| CVE-2024-11453 | gs-pinterest-portfolio (WordPress plugin) | The WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout plugin for WordPress is vulnerable to Stored Cross-S | medium | 6.4 | 0% |
| CVE-2025-13534 | wsdesk (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, an | medium | 6.3 | 0% |
| CVE-2024-12334 | wc-affiliate (WordPress plugin) | The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any para | medium | 6.1 | 0% |
| CVE-2024-38874 | jweiland/events2 | events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability | medium | 5.4 | 0% |
| CVE-2026-23476 | facturascripts/facturascripts | FacturaScripts is Vulnerable to Reflected XSS | medium | 5.4 | 0% |
| CVE-2024-8660 | concrete5/concrete5 | Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block | medium | 4.8 | 0% |
| CVE-2022-3850 | find-and-replace-all (WordPress plugin) | The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a l | medium | 4.3 | 0% |
| CVE-2023-5776 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. Thi | medium | 4.3 | 0% |
| CVE-2023-6748 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 v | medium | 4.3 | 0% |
| CVE-2024-7836 | themify-builder (WordPress plugin) | The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify | medium | 4.3 | 0% |