Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-0433 | master-addons (WordPress plugin) | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnera | medium | 6.4 | 0% |
| CVE-2025-0512 | structured-content (WordPress plugin) | The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_busine | medium | 6.4 | 0% |
| CVE-2026-77607 | mediawiki/semantic-media-wiki | Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS | medium | 6.1 | 0% |
| CVE-2026-77608 | mediawiki/semantic-media-wiki | Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters) | medium | 6.1 | 0% |
| CVE-2026-77610 | mediawiki/semantic-media-wiki | Semantic MediaWiki has a query debug output XSS (`DebugFormatter`) | medium | 6.1 | 0% |
| CVE-2025-9824 | mautic/core | Mautic Vulnerable to User Enumeration via Response Timing | medium | 5.9 | 0% |
| CVE-2024-13772 | civi (WordPress plugin) | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up | medium | 5.6 | 0% |
| CVE-2024-0592 | related-posts-for-wp (WordPress plugin) | The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1 | medium | 5.4 | 0% |
| CVE-2024-3887 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Form Builder widget in al | medium | 5.4 | 0% |
| CVE-2024-7491 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versi | medium | 5.3 | 0% |
| CVE-2026-33688 | wwbn/avideo | AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint | medium | 5.3 | 0% |
| CVE-2024-32792 | hummingbird (WordPress plugin) | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects | medium | 4.3 | 0% |
| CVE-2026-15079 | drupal/login_disable | The Login Disable module prevents users from logging in to your Drupal site unless they know the secret key to add to th | unknown | 0.0 | 0% |
| CVE-2025-63523 | feehi/feehicms | FeehiCMS fails to enforce server-side immutability | medium | 6.5 | 0% |
| CVE-2024-12444 | wp-dispensary (WordPress plugin) | The WP Dispensary plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpd_menu' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2024-12451 | html5-chat (WordPress plugin) | The HTML5 chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'HTML5CHAT' shortcode in all versions up t | medium | 6.4 | 0% |
| CVE-2024-13661 | wp-table-editor (WordPress plugin) | The Table Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wptableeditor_vtabs' shortcode in all v | medium | 6.4 | 0% |
| CVE-2024-13859 | buddyboss-platform (WordPress plugin) | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in al | medium | 6.4 | 0% |
| CVE-2024-13860 | buddyboss-platform (WordPress plugin) | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions | medium | 6.4 | 0% |
| CVE-2024-5533 | divi (WordPress theme) | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 due to insufficient i | medium | 6.4 | 0% |
| CVE-2025-2330 | widgetkit-for-elementor (WordPress plugin) | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+m | medium | 6.4 | 0% |
| CVE-2025-2918 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all | medium | 6.4 | 0% |
| CVE-2025-3878 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify | medium | 6.4 | 0% |
| CVE-2025-5236 | ninjateam-telegram (WordPress plugin) | The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versio | medium | 6.4 | 0% |
| CVE-2025-70844 | kantorge/yaffa | yaffa vulnerable to Cross Site Scripting | medium | 6.1 | 0% |
| CVE-2023-1871 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to mis | medium | 5.4 | 0% |
| CVE-2023-2526 | google-maps-easy (WordPress plugin) | The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. This is due | medium | 5.4 | 0% |
| CVE-2025-1507 | googleanalytics (WordPress plugin) | The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi | medium | 5.3 | 0% |
| CVE-2026-33294 | wwbn/avideo | AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources | medium | 5.0 | 0% |
| CVE-2025-47706 | drupal/miniorange_2fa | The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't | unknown | 0.0 | 0% |
| CVE-2026-47344 | typo3/html-sanitizer | TYPO3 HTML Sanitizer allows Cross-site Scripting | low | 0.0 | 0% |
| CVE-2026-47759 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes | high | 8.7 | 0% |
| CVE-2026-47762 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments | high | 8.7 | 0% |
| CVE-2025-4594 | tournamatch (WordPress plugin) | The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcod | medium | 6.4 | 0% |
| CVE-2024-3059 | enl-newsletter (WordPress plugin) | The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in ad | medium | 5.7 | 0% |
| CVE-2025-27411 | redaxo/source | REDAXO allows Arbitrary File Upload in the mediapool page | medium | 5.4 | 0% |
| CVE-2026-23643 | cakephp/cakephp | CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting | medium | 5.4 | 0% |
| CVE-2022-4872 | chained-products (WordPress plugin) | The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option | medium | 4.3 | 0% |
| CVE-2023-0497 | ht-portfolio (WordPress plugin) | The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged | medium | 4.3 | 0% |
| CVE-2024-5473 | simple-photoswipe (WordPress plugin) | The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.0 | 0% |
| CVE-2025-47705 | drupal/iframeremove | This module enables you to add a filter to text formats (Full HTML, Filtered HTML), which will remove every iframe where | unknown | 0.0 | 0% |
| CVE-2025-8675 | drupal/ai_seo_link_advisor | This module enables you to provide SEO analysis and recommendations for a given URL. The module doesn't sufficiently sa | unknown | 0.0 | 0% |
| CVE-2026-41897 | mantisbt/mantisbt | MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field | medium | 0.0 | 0% |
| CVE-2026-55542 | snipe/snipe-it | Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL | low | 0.0 | 0% |
| CVE-2026-41670 | admidio/admidio | Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest | high | 8.2 | 0% |
| CVE-2024-5551 | wp-staging (WordPress plugin) | The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu | high | 7.5 | 0% |
| CVE-2025-1513 | contest-gallery (WordPress plugin) | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Bu | high | 7.2 | 0% |
| CVE-2025-62414 | bagisto/bagisto | bagisto has Cross Site Scripting (XSS) in Create New Customer | medium | 6.9 | 0% |
| CVE-2025-62415 | bagisto/bagisto | bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML) | medium | 6.9 | 0% |
| CVE-2025-62418 | bagisto/bagisto | bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG) | medium | 6.9 | 0% |