Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13455 | igumbi-online-booking (WordPress plugin) | The igumbi Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'igumbi_calendar' shortcode in | medium | 6.4 | 0% |
| CVE-2024-13456 | n-media-wp-simple-quiz (WordPress plugin) | The Easy Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wqt-question' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2024-13573 | zigaform (WordPress plugin) | The Zigaform – Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_rfvar' shortcode i | medium | 6.4 | 0% |
| CVE-2024-13577 | cats-job-listings (WordPress plugin) | The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-13578 | wp-bibtex (WordPress plugin) | The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, | medium | 6.4 | 0% |
| CVE-2024-13579 | wp-asambleas (WordPress plugin) | The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'polls_popup' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2024-13581 | simple-charts (WordPress plugin) | The Simple Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simple_chart' shortcode in all version | medium | 6.4 | 0% |
| CVE-2024-13582 | simple-pricing-tables-vc-extension (WordPress plugin) | The Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Script | medium | 6.4 | 0% |
| CVE-2024-13587 | zigaform-calculator-cost-estimation-form-builder-lite (WordPress plugin) | The Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th | medium | 6.4 | 0% |
| CVE-2024-13588 | simplebooklet (WordPress plugin) | The Simplebooklet PDF Viewer and Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplebooklet' | medium | 6.4 | 0% |
| CVE-2024-13644 | dethemekit-for-elementor (WordPress plugin) | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's De Gallery widget in all ver | medium | 6.4 | 0% |
| CVE-2024-13701 | stklcode-liveticker (WordPress plugin) | The Liveticker (by stklcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode in al | medium | 6.4 | 0% |
| CVE-2024-13751 | 3d-photo-gallery (WordPress plugin) | The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des[]' parameter in all versions up to, and | medium | 6.4 | 0% |
| CVE-2025-4584 | irm-newsroom (WordPress plugin) | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions | medium | 6.4 | 0% |
| CVE-2025-4585 | irm-newsroom (WordPress plugin) | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmflat' shortcode in all versions up t | medium | 6.4 | 0% |
| CVE-2025-4586 | irm-newsroom (WordPress plugin) | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versi | medium | 6.4 | 0% |
| CVE-2025-5123 | contact-us-page-contact-people (WordPress plugin) | The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all vers | medium | 6.4 | 0% |
| CVE-2025-5398 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use | medium | 6.4 | 0% |
| CVE-2025-5540 | wp-easy-events (WordPress plugin) | The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb | medium | 6.4 | 0% |
| CVE-2025-5929 | the-countdown (WordPress plugin) | The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and | medium | 6.4 | 0% |
| CVE-2025-6462 | elisqlreports (WordPress plugin) | The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPO | medium | 6.4 | 0% |
| CVE-2025-6686 | magic-buttons-for-elementor (WordPress plugin) | The Magic Buttons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's magic-button shortcode in | medium | 6.4 | 0% |
| CVE-2024-13851 | modal-portfolio (WordPress plugin) | The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.4.2 due to i | medium | 5.5 | 0% |
| CVE-2023-37992 | smarty-for-wordpress (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions. | medium | 5.4 | 0% |
| CVE-2024-11913 | bp-activity-plus-reloaded (WordPress plugin) | The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and | medium | 5.4 | 0% |
| CVE-2024-13360 | aipower (WordPress plugin) | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.9 | medium | 5.4 | 0% |
| CVE-2024-13667 | uncode (WordPress theme) | The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and i | medium | 5.4 | 0% |
| CVE-2025-62398 | moodle/moodle | Moodle does not properly enforce MFA | medium | 5.3 | 0% |
| CVE-2026-26067 | october/system | October CMS has Safe Mode Bypass via CSS Preprocessor Compilers | medium | 4.9 | 0% |
| CVE-2024-13517 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 4.4 | 0% |
| CVE-2024-4419 | fetch-jft (WordPress plugin) | The Fetch JFT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8 | medium | 4.4 | 0% |
| CVE-2023-6520 | wp-2fa (WordPress plugin) | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, | medium | 4.3 | 0% |
| CVE-2024-0796 | profit-products-tables-for-woocommerce (WordPress plugin) | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Cross-S | medium | 4.3 | 0% |
| CVE-2024-1334 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi | medium | 4.3 | 0% |
| CVE-2024-13715 | zstore-manager-basic (WordPress plugin) | The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstore_cle | medium | 4.3 | 0% |
| CVE-2022-47163 | wp-csv-to-database (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress p | low | 3.1 | 0% |
| CVE-2026-33674 | prestashop/prestashop | PrestaShop: Improper Use of Validation Framework | low | 2.0 | 0% |
| CVE-2025-3901 | drupal/bootstrap_site_alert | This module enables you to put a site wide bootstrap themed alert message on the top of every page. The module doesn't | unknown | 0.0 | 0% |
| CVE-2025-3902 | drupal/block_class | Block Class enables you to add custom attributes to blocks. The module did not sufficiently sanitize custom attribute i | unknown | 0.0 | 0% |
| CVE-2026-27126 | craftcms/cms | Craft CMS has Stored XSS in Table Field via "HTML" Column Type | medium | 0.0 | 0% |
| CVE-2026-84917 | drupal/jsonapi_role_access | This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficie | unknown | 0.0 | 0% |
| CVE-2026-87943 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2024-38277 | moodle/moodle | Moodle uses the same key for QR login and auto-login | medium | 6.5 | 0% |
| CVE-2025-6200 | geodirectory (WordPress plugin) | The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.9 | 0% |
| CVE-2026-33684 | wwbn/avideo | AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions | medium | 5.3 | 0% |
| CVE-2025-62393 | moodle/moodle | Moodle course access permissions are not properly checked in course_output_fragment_course_overview | medium | 4.3 | 0% |
| CVE-2026-0945 | drupal/role_delegation | This module allows site administrators to grant specific roles the authority to assign selected roles to users, without | unknown | 0.0 | 0% |
| CVE-2026-30838 | league/commonmark | CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names | medium | 0.0 | 0% |
| CVE-2026-87955 | drupal/ultimate_table_field | The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, us | unknown | 0.0 | 0% |
| CVE-2024-13707 | wp-image-uploader (WordPress plugin) | The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is | high | 8.8 | 0% |