Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-10000 | learning-management-system (WordPress plugin) | The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2024-13867 | listivo (WordPress theme) | The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in al | medium | 6.1 | 0% |
| CVE-2025-4429 | gearside-developer-dashboard (WordPress plugin) | The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the p | medium | 6.1 | 0% |
| CVE-2024-2749 | vikbooking-hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its | medium | 5.9 | 0% |
| CVE-2025-13081 | drupal/core | Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the | medium | 5.9 | 0% |
| CVE-2023-0551 | rest-api-to-miniprogram (WordPress plugin) | The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authen | medium | 5.4 | 0% |
| CVE-2023-47552 | image-hover-effects (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Image Hover Effects – WordPress Plugin.This issue affects Image Hover Effects | medium | 5.4 | 0% |
| CVE-2023-7288 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capabili | medium | 5.4 | 0% |
| CVE-2023-7289 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability | medium | 5.4 | 0% |
| CVE-2025-68951 | thorsten/phpmyfaq | phpMyFAQ has Stored XSS in user list via admin-managed display_name | medium | 5.4 | 0% |
| CVE-2025-48013 | drupal/quick_node_block | This module provides a block to easily display a rendered node. Access to the rendered node isn't validated before rend | medium | 5.3 | 0% |
| CVE-2025-48444 | drupal/quick_node_block | This module provides a block to easily display a rendered node. The module doesn't check access to content before displ | medium | 5.3 | 0% |
| CVE-2024-2405 | float-menu (WordPress plugin) | The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in ad | medium | 4.5 | 0% |
| CVE-2024-8488 | survey-maker (WordPress plugin) | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Survey fields in all versions up to, and including, 4 | medium | 4.4 | 0% |
| CVE-2023-6491 | strong-testimonials (WordPress plugin) | The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the w | medium | 4.3 | 0% |
| CVE-2023-7292 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized notification dismissal due to a missing cap | medium | 4.3 | 0% |
| CVE-2024-10614 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the canc | medium | 4.3 | 0% |
| CVE-2024-11911 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_ | medium | 4.3 | 0% |
| CVE-2024-12855 | adforest (WordPress theme) | The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX action | medium | 4.3 | 0% |
| CVE-2024-1376 | event-post (WordPress plugin) | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdat | medium | 4.3 | 0% |
| CVE-2024-1803 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 4.3 | 0% |
| CVE-2024-4088 | attire-blocks (WordPress plugin) | The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 0% |
| CVE-2024-4661 | wp-reset (WordPress plugin) | The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax func | medium | 4.3 | 0% |
| CVE-2024-5860 | tickera-event-ticketing-system (WordPress plugin) | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-6883 | event-espresso-decaf (WordPress plugin) | The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings m | medium | 4.3 | 0% |
| CVE-2024-8437 | wp-easy-gallery (WordPress plugin) | The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check o | medium | 4.3 | 0% |
| CVE-2024-24821 | composer/composer | Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php | high | 8.8 | 0% |
| CVE-2024-37519 | premium-blocks-for-gutenburg (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Blocks – Gutenberg Bloc | medium | 6.5 | 0% |
| CVE-2025-0865 | wp-media-category-management (WordPress plugin) | The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to m | medium | 6.5 | 0% |
| CVE-2024-10715 | mappress-google-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map block in all versions | medium | 6.4 | 0% |
| CVE-2024-13445 | elementor (WordPress plugin) | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bord | medium | 6.4 | 0% |
| CVE-2024-3513 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title tag (postTitle | medium | 6.4 | 0% |
| CVE-2024-4473 | sydney-toolbox (WordPress plugin) | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up | medium | 6.4 | 0% |
| CVE-2024-4581 | slider-revolution (WordPress plugin) | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Add Layer widget in all versions up | medium | 6.4 | 0% |
| CVE-2024-4705 | testimonials-widget (WordPress plugin) | The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all ver | medium | 6.4 | 0% |
| CVE-2024-7629 | responsive-video (WordPress plugin) | The Responsive video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's video settings function in all versi | medium | 6.4 | 0% |
| CVE-2024-8627 | ultimate-tinymce (WordPress plugin) | The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-8723 | 012-ps-multi-languages (WordPress plugin) | The 012 Ps Multi Languages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via translated titles in all versions up to, an | medium | 6.4 | 0% |
| CVE-2024-9366 | easy-menu-manager-wpzest (WordPress plugin) | The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-9703 | arconix-shortcodes (WordPress plugin) | The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2025-1064 | easy-login-woocommerce (WordPress plugin) | The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_ | medium | 6.4 | 0% |
| CVE-2024-10703 | registrations-for-the-events-calendar (WordPress plugin) | The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could all | medium | 6.1 | 0% |
| CVE-2024-11272 | pirate-forms (WordPress plugin) | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, | medium | 6.1 | 0% |
| CVE-2024-11273 | contact-form (WordPress plugin) | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, | medium | 6.1 | 0% |
| CVE-2024-11503 | wp-tabs (WordPress plugin) | The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 6.1 | 0% |
| CVE-2024-12682 | smart-maintenance-mode (WordPress plugin) | The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege | medium | 6.1 | 0% |
| CVE-2024-3814 | tagdiv-composer (WordPress plugin) | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to | medium | 5.5 | 0% |
| CVE-2024-3815 | newspaper (WordPress theme) | The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page in all versions up to | medium | 5.5 | 0% |
| CVE-2024-9169 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin debug settings in all versions up to, and i | medium | 5.5 | 0% |
| CVE-2024-8628 | mailoptin (WordPress plugin) | The Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin plugin for WordPress is vulnerable to Stored Cross-Site | medium | 5.4 | 0% |