Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-7144 | jetelements (WordPress plugin) | The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up | medium | 6.4 | 0% |
| CVE-2024-8325 | blockspare (WordPress plugin) | The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & | medium | 6.4 | 0% |
| CVE-2024-8543 | slider-comparison-image-before-and-after (WordPress plugin) | The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [sciba] shor | medium | 6.4 | 0% |
| CVE-2024-8804 | simple-embed-code (WordPress plugin) | The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functionality in all versions | medium | 6.4 | 0% |
| CVE-2024-9066 | marketing-and-seo-booster (WordPress plugin) | The Marketing and SEO Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-9074 | advanced-blocks-pro (WordPress plugin) | The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and in | medium | 6.4 | 0% |
| CVE-2024-9368 | aggregator-advanced-settings (WordPress plugin) | The Aggregator Advanced Settings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up t | medium | 6.4 | 0% |
| CVE-2024-9372 | wp-blocks-hub (WordPress plugin) | The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includin | medium | 6.4 | 0% |
| CVE-2024-9696 | rescue-shortcodes (WordPress plugin) | The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rescue_tab' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-9704 | dvk-social-sharing (WordPress plugin) | The Social Sharing (by Danny) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvk_social_sharing' shortc | medium | 6.4 | 0% |
| CVE-2025-7498 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all version | medium | 6.4 | 0% |
| CVE-2026-77606 | mediawiki/semantic-media-wiki | Semantic MediaWiki has reflected XSS in Special:Ask plain table headers | medium | 6.1 | 0% |
| CVE-2024-37239 | branda (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress P | medium | 5.9 | 0% |
| CVE-2026-27131 | putyourlightson/craft-sprig | Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground | medium | 5.5 | 0% |
| CVE-2026-27016 | librenms/librenms | LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags() | medium | 5.4 | 0% |
| CVE-2026-54720 | silverstripe/framework | Silverstripe Framework: Possible XSS attack through media embed | medium | 5.4 | 0% |
| CVE-2024-10040 | infinite-scroll (WordPress plugin) | The Infinite-Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is du | medium | 5.3 | 0% |
| CVE-2024-0677 | pz-linkcard (WordPress plugin) | The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could a | medium | 5.1 | 0% |
| CVE-2023-6495 | yet-another-related-posts-plugin (WordPress plugin) | The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ver | medium | 4.4 | 0% |
| CVE-2024-4942 | custom-dash (WordPress plugin) | The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1 | medium | 4.4 | 0% |
| CVE-2024-47055 | mautic/core | Mautic segment cloning doesn't have a proper permission check | medium | 4.3 | 0% |
| CVE-2025-5526 | buddypress-docs (WordPress plugin) | The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belong | medium | 4.3 | 0% |
| CVE-2024-25637 | october/system | October System module has a Reflected XSS via X-October-Request-Handler Header | low | 3.1 | 0% |
| CVE-2024-13308 | drupal/browser_back_button | This module provides a block that renders a link providing the functionality of a browser's back button. The module doe | unknown | 0.0 | 0% |
| CVE-2024-13309 | drupal/login_disable | This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to | unknown | 0.0 | 0% |
| CVE-2025-8996 | drupal/layout_builder_perms | The Layout Builder Advanced Permissions module enables you to have fine grained control over who can do what in editing | unknown | 0.0 | 0% |
| CVE-2026-100869 | sylius/sylius | CVE-2026-100869: Shop API accepts arbitrary PaymentRequest actions, allowing a customer-triggered refund | unknown | 0.0 | 0% |
| CVE-2026-45270 | ci4-cms-erp/ci4ms | CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule | high | 8.7 | 0% |
| CVE-2024-13753 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. | high | 8.1 | 0% |
| CVE-2026-44692 | code16/sharp | Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint | high | 7.7 | 0% |
| CVE-2025-31679 | drupal/ignition | This module enables you to render error pages using the Ignition package. The module disables certain Drupal core code | medium | 6.1 | 0% |
| CVE-2025-31687 | drupal/spamspan | This module enables your site to obfuscate Email addresses and prevent spambots to collect them. The module doesn't san | medium | 6.1 | 0% |
| CVE-2025-31695 | drupal/link_field_display_mode_formatter | This module adds a formatter for link fields that displays the current entity with another view mode inside the link. D | medium | 6.1 | 0% |
| CVE-2025-31696 | drupal/rapidoc_elements_field_formatter | This module can be used to render Open API Documentation using the RapiDoc library. The module provides a custom formatt | medium | 6.1 | 0% |
| CVE-2025-31697 | drupal/formatter_suite | Formatter Suite provides a suite of field formatters to help present numbers, dates, times, text, links, entity referenc | medium | 6.1 | 0% |
| CVE-2025-3201 | kali-forms (WordPress plugin) | The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, wh | medium | 5.9 | 0% |
| CVE-2025-1454 | ninja-pages (WordPress plugin) | The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 5.4 | 0% |
| CVE-2026-107842 | contao/core-bundle | Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled | medium | 5.3 | 0% |
| CVE-2024-6225 | ameliabooking (WordPress plugin) | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settin | medium | 4.4 | 0% |
| CVE-2022-4148 | oauth-server (WordPress plugin) | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, w | medium | 4.3 | 0% |
| CVE-2023-0495 | ht-slider-for-elementor (WordPress plugin) | The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2023-0496 | ht-event (WordPress plugin) | The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in a | medium | 4.3 | 0% |
| CVE-2024-13687 | team-display (WordPress plugin) | The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o | medium | 4.3 | 0% |
| CVE-2026-107312 | drupal/examples | The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drup | unknown | 0.0 | 0% |
| CVE-2026-118517 | symfony/html-sanitizer, symfony/symfony | CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE- | unknown | 0.0 | 0% |
| CVE-2026-33488 | wwbn/avideo | AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin | high | 7.4 | 0% |
| CVE-2025-0804 | clickwhale (WordPress plugin) | The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Store | medium | 6.4 | 0% |
| CVE-2025-4783 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of the Countdow | medium | 6.4 | 0% |
| CVE-2025-59712 | snipe/snipe-it | Snipe-IT allows XSS | medium | 6.4 | 0% |
| CVE-2025-6252 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, | medium | 6.4 | 0% |