Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-9867 | element-pack (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 5.4 | 0% |
| CVE-2024-9868 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 5.4 | 0% |
| CVE-2024-9888 | elementinvader-addons-for-elementor (WordPress plugin) | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widg | medium | 5.4 | 0% |
| CVE-2024-1341 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all vers | medium | 4.9 | 0% |
| CVE-2026-34562 | ci4-cms-erp/ci4ms | CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Store | medium | 4.7 | 0% |
| CVE-2025-0554 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 | medium | 4.4 | 0% |
| CVE-2023-5818 | amazonify (WordPress plugin) | The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to m | medium | 4.3 | 0% |
| CVE-2024-13243 | drupal/entity_delete_log | The Entity Delete Log module tracks the deletion of configured entity types, such as node or comments. It does not add | unknown | 0.0 | 0% |
| CVE-2025-68436 | craftcms/cms | Craft CMS vulnerable to potential information disclosure via unchecked asset relocation | medium | 0.0 | 0% |
| CVE-2026-96385 | drupal/rest_api_authentication | This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate auth | unknown | 0.0 | 0% |
| CVE-2026-32299 | opensource-workshop/connect-cms | Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature | high | 7.5 | 0% |
| CVE-2025-11227 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and | medium | 6.5 | 0% |
| CVE-2018-25157 | phraseanet/phraseanet | Phraseanet vulnerable to stored cross-site scripting through crafted file names | medium | 6.4 | 0% |
| CVE-2024-3827 | spectra (WordPress plugin) | The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 | medium | 6.4 | 0% |
| CVE-2025-5678 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-9589 | wp-custom-taxonomy-meta (WordPress plugin) | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in | medium | 5.5 | 0% |
| CVE-2024-9590 | wp-custom-taxonomy-meta (WordPress plugin) | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in th | medium | 5.5 | 0% |
| CVE-2024-9591 | wp-custom-taxonomy-image (WordPress plugin) | The Category and Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_category_image' parameter in ver | medium | 5.5 | 0% |
| CVE-2024-13207 | widget-for-social-page-feeds (WordPress plugin) | The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2024-13610 | simple-social-buttons (WordPress plugin) | The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow hi | medium | 4.8 | 0% |
| CVE-2023-0484 | contact-form-7-widget-for-elementor-page-builder-\&-gutenberg-blocks (WordPress plugin) | The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activati | medium | 4.3 | 0% |
| CVE-2023-0761 | clock-in-portal--staff-\&-attendance-management (WordPress plugin) | The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which | medium | 4.3 | 0% |
| CVE-2023-0762 | clock-in-portal--staff-\&-attendance-management (WordPress plugin) | The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which c | medium | 4.3 | 0% |
| CVE-2023-0763 | clock-in-portal--staff-\&-attendance-management (WordPress plugin) | The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could | medium | 4.3 | 0% |
| CVE-2023-4246 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing | medium | 4.3 | 0% |
| CVE-2025-12782 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2025-13354 | taxopress (WordPress plugin) | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versio | medium | 4.3 | 0% |
| CVE-2026-55186 | silverstripe/mfa | MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow | medium | 4.2 | 0% |
| CVE-2026-44298 | kimai/kimai | Kimai has an arbitrary file read in its invoice PDF renderer (admin) | medium | 4.1 | 0% |
| CVE-2025-47938 | typo3/cms-core, typo3/cms-setup | TYPO3 Unverified Password Change for Backend Users | low | 3.8 | 0% |
| CVE-2025-13083 | drupal/core | The core `system` module handles downloads of private and temporary files. Contrib modules can define additional kinds o | low | 3.7 | 0% |
| CVE-2024-13262 | drupal/view_password | The View Password module enables you to add a help icon button next to the password input field to toggle the password v | unknown | 0.0 | 0% |
| CVE-2026-3214 | drupal/captcha | This module enables you to protect web forms from automated spam by requiring users to pass a challenge. The module doe | unknown | 0.0 | 0% |
| CVE-2026-107845 | contao/comments-bundle | Contao: Cross-site scripting in the comments bundle | critical | 9.3 | 0% |
| CVE-2022-25770 | mautic/core, mautic/core-lib | Mautic has insufficient authentication in upgrade flow | high | 7.8 | 0% |
| CVE-2024-12708 | bulk-me-now\! (WordPress plugin) | The Bulk Me Now! WordPress plugin through 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a | high | 7.1 | 0% |
| CVE-2024-10891 | save-as-pdf-by-pdfcrowd (WordPress plugin) | The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'save_as_pdf_pdfcrowd' | medium | 6.4 | 0% |
| CVE-2025-4099 | list-children (WordPress plugin) | The List Children plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list_children' shortcode in all versio | medium | 6.4 | 0% |
| CVE-2023-32739 | custom-cursors (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions. | medium | 4.3 | 0% |
| CVE-2023-47238 | top-10 (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions. | medium | 4.3 | 0% |
| CVE-2023-5803 | business-directory (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Business Directory Team Business Directory Plugin – Easy Listing Directories for WordPres | medium | 4.3 | 0% |
| CVE-2024-3477 | popup-box (WordPress plugin) | The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in a | medium | 4.3 | 0% |
| CVE-2026-107266 | drupal/views_share | This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently | unknown | 0.0 | 0% |
| CVE-2026-44738 | getgrav/grav | Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() | high | 7.7 | 0% |
| CVE-2022-4745 | wp-customer-area (WordPress plugin) | The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, whi | high | 7.1 | 0% |
| CVE-2024-13876 | meintopf (WordPress plugin) | The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | high | 7.1 | 0% |
| CVE-2024-13877 | passbeemedia-web-push-notification (WordPress plugin) | The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in | high | 7.1 | 0% |
| CVE-2024-13880 | my-quota (WordPress plugin) | The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | high | 7.1 | 0% |
| CVE-2024-13881 | linkmyposts (WordPress plugin) | The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | high | 7.1 | 0% |
| CVE-2024-4532 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | medium | 6.4 | 0% |