Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-5144 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions u | medium | 6.4 | 0% |
| CVE-2024-37556 | wordpress-notification-bar (WordPress plugin) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd WordPress Notification | medium | 5.9 | 0% |
| CVE-2024-5607 | ninja-gdpr-compliance (WordPress plugin) | The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 5.4 | 0% |
| CVE-2023-48651 | concrete5/concrete5 | Concrete CMS Cross Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2023-48653 | concrete5/concrete5 | Concrete CMS Cross Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2024-10324 | rometheme-for-elementor (WordPress plugin) | The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1. | medium | 4.3 | 0% |
| CVE-2024-13407 | omnipress (WordPress plugin) | The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via the megamenu block | medium | 4.3 | 0% |
| CVE-2025-62412 | librenms/librenms | LibreNMS alert-rules has a Cross-Site Scripting Vulnerability | low | 3.8 | 0% |
| CVE-2026-13242 | drupal/geolocation | Geolocation modules adds a field to store coordinates and provides supporting plumbing for views and other modules. One | unknown | 0.0 | 0% |
| CVE-2026-52777 | yeswiki/yeswiki | YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize | critical | 0.0 | 0% |
| CVE-2026-33673 | prestashop/prestashop | PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables | high | 7.6 | 0% |
| CVE-2024-10847 | storely (WordPress theme) | The Storely theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and includi | medium | 6.4 | 0% |
| CVE-2025-1450 | chaty (WordPress plugin) | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for Wo | medium | 6.4 | 0% |
| CVE-2021-36855 | booking-ultra-pro (WordPress plugin) | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress. | medium | 6.1 | 0% |
| CVE-2023-51506 | wordpress-currency-switcher (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WPCS – WordPress Currency S | medium | 5.5 | 0% |
| CVE-2024-0432 | gestpay-for-woocommerce (WordPress plugin) | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. | medium | 4.3 | 0% |
| CVE-2024-0433 | gestpay-for-woocommerce (WordPress plugin) | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. | medium | 4.3 | 0% |
| CVE-2024-0767 | envo-elementor-for-woocommerce (WordPress plugin) | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, | medium | 4.3 | 0% |
| CVE-2026-26989 | librenms/librenms | LibreNMS has a Stored XSS in Alert Rule | medium | 4.3 | 0% |
| CVE-2026-48012 | shopware/core, shopware/platform | Shopware SSO referer trust leading to an arbitrary redirect target | medium | 4.3 | 0% |
| CVE-2023-3209 | mstore-api (WordPress plugin) | The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a c | low | 3.5 | 0% |
| CVE-2024-13246 | drupal/node_access_rebuild_progressive | This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset | unknown | 0.0 | 0% |
| CVE-2025-3129 | drupal/access_code | This module enables users to log in using a short access code instead of providing a username/password combination. The | unknown | 0.0 | 0% |
| CVE-2026-40099 | getkirby/cms | Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter | medium | 0.0 | 0% |
| CVE-2026-41129 | craftcms/cms | Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations | medium | 0.0 | 0% |
| CVE-2026-34563 | ci4-cms-erp/ci4ms | CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS | critical | 9.9 | 0% |
| CVE-2026-34565 | ci4-cms-erp/ci4ms | CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2026-34566 | ci4-cms-erp/ci4ms | CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2026-34567 | ci4-cms-erp/ci4ms | CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS | critical | 9.1 | 0% |
| CVE-2024-13773 | civi (WordPress plugin) | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver | high | 7.3 | 0% |
| CVE-2024-13884 | limit-bio (WordPress plugin) | The Limit Bio WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | high | 7.1 | 0% |
| CVE-2024-13885 | wp-e-customers-beta (WordPress plugin) | The WP e-Customers Beta WordPress plugin through 0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leadi | high | 7.1 | 0% |
| CVE-2025-1401 | wp-click-info (WordPress plugin) | The WP Click Info WordPress plugin through 2.7.4 does not sanitise and escape a parameter before outputting it back in the page, leading to | high | 7.1 | 0% |
| CVE-2025-1486 | wowpth (WordPress plugin) | The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect | high | 7.1 | 0% |
| CVE-2025-1487 | wowpth (WordPress plugin) | The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect | high | 7.1 | 0% |
| CVE-2024-11180 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_count | medium | 6.4 | 0% |
| CVE-2024-12119 | foogallery (WordPress plugin) | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Si | medium | 6.4 | 0% |
| CVE-2024-13649 | xpro-elementor-addons (WordPress plugin) | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in | medium | 6.4 | 0% |
| CVE-2024-13805 | file-manager-advanced (WordPress plugin) | The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-S | medium | 6.4 | 0% |
| CVE-2024-9582 | accordion-slider (WordPress plugin) | The Accordion Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ attribute of an accordion slider in al | medium | 6.4 | 0% |
| CVE-2025-0169 | dwt-listing (WordPress plugin) | The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, | medium | 6.4 | 0% |
| CVE-2025-1757 | uber-grid (WordPress plugin) | The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfhu | medium | 6.4 | 0% |
| CVE-2025-1783 | gallery-styles (WordPress plugin) | The Gallery Styles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery Block in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2025-2685 | tablepress (WordPress plugin) | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parame | medium | 6.4 | 0% |
| CVE-2025-61674 | october/system | October CMS Vulnerable to Stored XSS via Editor and Branding Styles | medium | 6.1 | 0% |
| CVE-2025-61676 | october/system | October CMS Vulnerable to Stored XSS via Branding Styles | medium | 6.1 | 0% |
| CVE-2026-32593 | winter/wn-backend-module | Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax | medium | 5.9 | 0% |
| CVE-2024-12872 | zalomeni (WordPress plugin) | The Zalomení WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-54775 | dcat/laravel-admin | Dcat-Admin Cross-Site Scripting (XSS) vulnerability | medium | 4.8 | 0% |
| CVE-2024-12879 | wpot (WordPress plugin) | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |