Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-41620 | seosamba (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions. | medium | 5.4 | 0% |
| CVE-2023-44233 | foogallery (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions. | medium | 5.4 | 0% |
| CVE-2023-48754 | delete-post-revisions (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Wap Nepal Delete Post Revisions In WordPress allows Cross Site Request Forgery.This issue | medium | 5.4 | 0% |
| CVE-2024-13834 | responsive-add-ons (WordPress plugin) | The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable t | medium | 5.4 | 0% |
| CVE-2024-5987 | wp-accessibility-helper (WordPress plugin) | The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-6754 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_aut | medium | 5.4 | 0% |
| CVE-2026-41233 | froxlor/froxlor | Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() | medium | 5.4 | 0% |
| CVE-2024-6631 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 5.0 | 0% |
| CVE-2024-4427 | comparison-slider (WordPress plugin) | The Comparison Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several A | medium | 4.3 | 0% |
| CVE-2024-7380 | cf-geoplugin (WordPress plugin) | The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__g | medium | 4.3 | 0% |
| CVE-2025-62520 | mantisbt/mantisbt | MantisBT unauthorized disclosure of private project column configuration | medium | 4.3 | 0% |
| CVE-2026-4175 | aureuserp/aureuserp | Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler | low | 3.5 | 0% |
| CVE-2026-102279 | laravel/framework | Laravel: XSS in Debug Page Information | low | 3.1 | 0% |
| CVE-2025-48918 | drupal/simple_klaro | The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to configure it acco | unknown | 0.0 | 0% |
| CVE-2026-27568 | wwbn/avideo | AVideo has Stored Cross-Site Scripting via Markdown Comment Injection | medium | 0.0 | 0% |
| CVE-2026-48761 | symfony/html-sanitizer, symfony/symfony | Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes | medium | 0.0 | 0% |
| CVE-2026-80197 | kimai/kimai | Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation | low | 0.0 | 0% |
| CVE-2024-0627 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all | medium | 6.4 | 0% |
| CVE-2024-10310 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 6.4 | 0% |
| CVE-2024-1056 | funnel-builder (WordPress plugin) | The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_iframe_tag_in_post' functi | medium | 6.4 | 0% |
| CVE-2024-1815 | ultimate-addons-for-gutenberg (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Gallery bl | medium | 6.4 | 0% |
| CVE-2024-1988 | post-grid (WordPress plugin) | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-2254 | rt-easy-builder-advanced-addons-for-elementor (WordPress plugin) | The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widge | medium | 6.4 | 0% |
| CVE-2024-2784 | the-plus-addons-for-elementor (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Hover Card widget in all version | medium | 6.4 | 0% |
| CVE-2024-3896 | robo-gallery (WordPress plugin) | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the Gallery | medium | 6.4 | 0% |
| CVE-2024-3998 | betheme (WordPress plugin) | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-4001 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in | medium | 6.4 | 0% |
| CVE-2024-4042 | post-grid (WordPress plugin) | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-4208 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | 0% |
| CVE-2024-4281 | link-library (WordPress plugin) | The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-4366 | spectra (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘block_id’ parameter in v | medium | 6.4 | 0% |
| CVE-2024-4400 | post-and-page-builder (WordPress plugin) | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plguin for WordPress is vulnerable to Stored Cross-Site Scripting via an | medium | 6.4 | 0% |
| CVE-2024-4451 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode i | medium | 6.4 | 0% |
| CVE-2024-4452 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and includi | medium | 6.4 | 0% |
| CVE-2024-4637 | slider-revolution (WordPress plugin) | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to | medium | 6.4 | 0% |
| CVE-2024-4703 | one-page-express-companion (WordPress plugin) | The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_f | medium | 6.4 | 0% |
| CVE-2024-4943 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘has_field_link_rel’ parameter in all versions up to, a | medium | 6.4 | 0% |
| CVE-2024-5025 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arglist’ parameter in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-5061 | enfold (WordPress theme) | The Enfold - Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wrapper_class’ and 'cl | medium | 6.4 | 0% |
| CVE-2024-5086 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable t | medium | 6.4 | 0% |
| CVE-2024-5173 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget se | medium | 6.4 | 0% |
| CVE-2024-5263 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all | medium | 6.4 | 0% |
| CVE-2024-5330 | breakdance (WordPress plugin) | The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the breakdance_css_file_paths_cache parameter in all ve | medium | 6.4 | 0% |
| CVE-2024-5332 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all ver | medium | 6.4 | 0% |
| CVE-2024-5583 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 0% |
| CVE-2024-5612 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_lightbox_open_btn_ico | medium | 6.4 | 0% |
| CVE-2024-5708 | wpbakery-page-builder (WordPress plugin) | The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up t | medium | 6.4 | 0% |
| CVE-2024-5818 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazi | medium | 6.4 | 0% |
| CVE-2024-5819 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2024-7064 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and incl | medium | 6.4 | 0% |