Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-1662 | url-media-uploader (WordPress plugin) | The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the | medium | 6.4 | 0% |
| CVE-2025-2893 | gutenverse (WordPress plugin) | The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | 0% |
| CVE-2025-3510 | composer (WordPress plugin) | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2025-3748 | taxonomy-chain-menu (WordPress plugin) | The Taxonomy Chain Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pn_chain_menu shortcode in all ve | medium | 6.4 | 0% |
| CVE-2025-3858 | formality (WordPress plugin) | The Formality plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and includi | medium | 6.4 | 0% |
| CVE-2025-3890 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' short | medium | 6.4 | 0% |
| CVE-2024-12723 | infility-global (WordPress plugin) | The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 0% |
| CVE-2025-1505 | woocommerce-ajax-filters (WordPress plugin) | The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all vers | medium | 6.1 | 0% |
| CVE-2025-67851 | moodle/moodle | Moodle formula injection vulnerability | medium | 6.1 | 0% |
| CVE-2026-22254 | winter/wn-cms-module | Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager | low | 0.0 | 0% |
| CVE-2024-6750 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability | high | 7.3 | 0% |
| CVE-2024-12321 | wc-affiliate (WordPress plugin) | The WC Affiliate WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to | high | 7.1 | 0% |
| CVE-2024-12400 | tour-master (WordPress plugin) | The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross | high | 7.1 | 0% |
| CVE-2024-13874 | web-push-notifications (WordPress plugin) | The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | high | 7.1 | 0% |
| CVE-2024-13875 | wp-pmanager (WordPress plugin) | The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | high | 7.1 | 0% |
| CVE-2024-13878 | spotbot (WordPress plugin) | The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | high | 7.1 | 0% |
| CVE-2024-12163 | goodlayers-core (WordPress plugin) | The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads | medium | 6.5 | 0% |
| CVE-2025-60797 | phppgadmin/phppgadmin | phppgadmin contains a SQL injection vulnerability | medium | 6.5 | 0% |
| CVE-2025-2839 | wp-import-export-lite (WordPress plugin) | The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versio | medium | 6.4 | 0% |
| CVE-2025-3077 | betheme (WordPress plugin) | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all v | medium | 6.4 | 0% |
| CVE-2025-4127 | wp-seo-structured-data-schema (WordPress plugin) | The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Price Range’ parameter in all v | medium | 6.4 | 0% |
| CVE-2022-4552 | fl3r-feelbox (WordPress plugin) | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as es | medium | 6.1 | 0% |
| CVE-2024-11254 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus_name parameter | medium | 6.1 | 0% |
| CVE-2025-0671 | icegram-express (WordPress plugin) | The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privi | medium | 6.1 | 0% |
| CVE-2023-6798 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unaut | medium | 5.4 | 0% |
| CVE-2024-12120 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_ | medium | 5.4 | 0% |
| CVE-2026-44585 | paymenter/paymenter | Paymenter has broken object level authorization via service reference manipulation on ticket creation | medium | 5.4 | 0% |
| CVE-2026-41662 | admidio/admidio | Admidio Missing Minimum Administrator Check in Role Membership Removal | medium | 5.2 | 0% |
| CVE-2022-1760 | core-control (WordPress plugin) | The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-13740 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio | medium | 4.3 | 0% |
| CVE-2025-0661 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the d | medium | 4.3 | 0% |
| CVE-2025-2289 | zegen (WordPress theme) | The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJA | medium | 4.3 | 0% |
| CVE-2025-3863 | post-carousel-slider-for-elementor (WordPress plugin) | The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2025-3880 | social-polls-by-opinionstage (WordPress plugin) | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misco | medium | 4.3 | 0% |
| CVE-2026-30927 | admidio/admidio | Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter | medium | 0.0 | 0% |
| CVE-2024-34434 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Mi | medium | 6.5 | 0% |
| CVE-2024-11731 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slider sho | medium | 6.4 | 0% |
| CVE-2025-1665 | avada-builder (WordPress plugin) | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all v | medium | 6.4 | 0% |
| CVE-2026-34716 | wwbn/avideo | AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification | medium | 6.4 | 0% |
| CVE-2023-48707 | codeigniter4/shield | Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication | medium | 5.0 | 0% |
| CVE-2024-13697 | bp-better-messages (WordPress plugin) | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-S | medium | 4.8 | 0% |
| CVE-2026-53638 | sylius/sylius | Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint | medium | 4.3 | 0% |
| CVE-2026-24415 | devcode-it/openstamanager | OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter | medium | 0.0 | 0% |
| CVE-2026-87937 | drupal/cas_server | This module enables you to turn a Drupal install into the Central Authentication System (CAS) Server. It makes your data | unknown | 0.0 | 0% |
| CVE-2024-3475 | sticky-buttons (WordPress plugin) | The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged | high | 7.5 | 0% |
| CVE-2023-5979 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could al | medium | 6.5 | 0% |
| CVE-2024-10294 | ce21-suite (WordPress plugin) | The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single | medium | 6.5 | 0% |
| CVE-2024-34914 | php-censor/php-censor | PHP Censor uses a weak hashing algorithm for the remember me key | medium | 6.5 | 0% |
| CVE-2024-11826 | quillforms (WordPress plugin) | The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on W | medium | 6.4 | 0% |
| CVE-2024-3714 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gi | medium | 6.4 | 0% |