Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6242 | eventon (WordPress plugin), eventon-lite (WordPress plugin) | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 6.5 | 0% |
| CVE-2023-6745 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-10148 | wp-awesome-buttons (WordPress plugin) | The Awesome buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn2 shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-10538 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the before_label parameter in the Image | medium | 6.4 | 0% |
| CVE-2024-1134 | wp-seopress (WordPress plugin) | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and description parameters as | medium | 6.4 | 0% |
| CVE-2024-11384 | arena.im (WordPress plugin) | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenab | medium | 6.4 | 0% |
| CVE-2024-12073 | meteor-slides (WordPress plugin) | The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_url_value' parameter in all versions up t | medium | 6.4 | 0% |
| CVE-2024-12588 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff w | medium | 6.4 | 0% |
| CVE-2024-12624 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget | medium | 6.4 | 0% |
| CVE-2024-1332 | custom-fonts (WordPress plugin) | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all vers | medium | 6.4 | 0% |
| CVE-2024-1768 | clever-fox (WordPress plugin) | The Clever Fox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's info box block in all versions up to, and | medium | 6.4 | 0% |
| CVE-2024-1814 | ultimate-addons-for-gutenberg (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial bloc | medium | 6.4 | 0% |
| CVE-2024-2772 | contact-form (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 6.4 | 0% |
| CVE-2024-3066 | elegant-addons-for-elementor (WordPress plugin) | The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions | medium | 6.4 | 0% |
| CVE-2024-3134 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C | medium | 6.4 | 0% |
| CVE-2024-3648 | sharethis-share-buttons (WordPress plugin) | The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' sho | medium | 6.4 | 0% |
| CVE-2024-3997 | prime-slider (WordPress plugin) | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-5141 | rotatingtweets (WordPress plugin) | The Rotating Tweets (Twitter widget and shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's' 'rota | medium | 6.4 | 0% |
| CVE-2024-5342 | simple-image-popup-shortcode (WordPress plugin) | The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sips_popup' shortcode i | medium | 6.4 | 0% |
| CVE-2024-5346 | flatsome (WordPress theme) | The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Video, UX Slider, UX Si | medium | 6.4 | 0% |
| CVE-2024-5536 | gamipress-link (WordPress plugin) | The GamiPress – Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gamipress_link shortcode in all vers | medium | 6.4 | 0% |
| CVE-2024-5965 | mosaic (WordPress theme) | The Mosaic theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in | medium | 6.4 | 0% |
| CVE-2024-5966 | grey-opaque (WordPress theme) | The Grey Opaque theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Download-Button | medium | 6.4 | 0% |
| CVE-2024-6752 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_name’ parameter in the 'wpw_auto_poster | medium | 6.4 | 0% |
| CVE-2024-9585 | image-map-pro (WordPress plugin) | The Image Map Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'save_project' function with an arbitrary shortc | medium | 6.4 | 0% |
| CVE-2024-7775 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | medium | 5.5 | 0% |
| CVE-2024-3190 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 5.4 | 0% |
| CVE-2024-9872 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due | medium | 5.4 | 0% |
| CVE-2026-1195 | mineadmin/mineadmin | MineAdmin improperly refreshes tokens | medium | 5.0 | 0% |
| CVE-2025-1485 | wordpress-real-cookie-banner (WordPress plugin) | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 d | medium | 4.8 | 0% |
| CVE-2025-3584 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2025-4567 | post-slider-and-post-carousel (WordPress plugin) | The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of i | medium | 4.8 | 0% |
| CVE-2025-57758 | contao/contao, contao/core-bundle | Contao applies improper access control in the back end voters | medium | 4.3 | 0% |
| CVE-2025-57759 | contao/contao, contao/core-bundle | Contao does not properly manage privileges for page and article fields | medium | 4.3 | 0% |
| CVE-2025-7221 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 0% |
| CVE-2025-67852 | moodle/moodle | Moodle Open Redirect vulnerability | low | 3.5 | 0% |
| CVE-2026-5343 | drupal/miniorange_saml | This module enables you to perform SAML-protocol-based single-sign-on (SSO) on a Drupal site. The module doesn't suffic | unknown | 0.0 | 0% |
| CVE-2025-22644 | vayu-blocks (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Bloc | medium | 6.5 | 0% |
| CVE-2026-55593 | froxlor/froxlor | Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection | medium | 6.5 | 0% |
| CVE-2024-11420 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Info Block link parameter in all versions up to | medium | 6.4 | 0% |
| CVE-2024-13695 | enfold (WordPress theme) | The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_ | medium | 6.4 | 0% |
| CVE-2025-5530 | woo-smart-compare (WordPress plugin) | The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' sho | medium | 6.4 | 0% |
| CVE-2024-13739 | newsletters-lite (WordPress plugin) | The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and inclu | medium | 6.1 | 0% |
| CVE-2025-1773 | traveler (WordPress theme) | The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and includin | medium | 6.1 | 0% |
| CVE-2022-4058 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS c | medium | 5.4 | 0% |
| CVE-2022-41805 | booster-for-woocommerce (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress. | medium | 5.4 | 0% |
| CVE-2025-5209 | ivory-search (WordPress plugin) | The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2022-45823 | video-contest-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in GalleryPlugins Video Contest WordPress plugin <= 3.2 versions. | medium | 4.3 | 0% |
| CVE-2022-47174 | performance-lab (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions. | medium | 4.3 | 0% |
| CVE-2023-22672 | vslider (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions. | medium | 4.3 | 0% |