Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-17971 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2017-18603 | postman-smtp (WordPress plugin) | The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter. | medium | 6.1 | 1% |
| CVE-2020-24699 | chamber-dashboard-business-directory (WordPress plugin) | The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS. | medium | 6.1 | 1% |
| CVE-2020-27344 | cm-download-manager (WordPress plugin) | The cm-download-manager plugin before 2.8.0 for WordPress allows XSS. | medium | 6.1 | 1% |
| CVE-2023-2813 | aapna (WordPress plugin), anand (WordPress plugin), anfaust (WordPress plugin) +43 more | All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPr | medium | 6.1 | 1% |
| CVE-2022-4828 | bold-timeline-lite (WordPress plugin) | The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 1% |
| CVE-2011-4298 | moodle/moodle | Moodle vulnerable to Cross-Site Request Forgery | medium | 0.0 | 1% |
| CVE-2021-26028 | joomla/archive | Path Traversal within joomla/archive zip class | medium | 0.0 | 1% |
| CVE-2022-42698 | api2cart-bridge-connector (WordPress plugin) | Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress. | critical | 9.8 | 1% |
| CVE-2024-4098 | shariff (WordPress plugin) | The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_f | critical | 9.8 | 1% |
| CVE-2021-4357 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on t | critical | 9.1 | 1% |
| CVE-2024-4455 | yith-woocommerce-ajax-search (WordPress plugin) | The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up t | high | 7.2 | 1% |
| CVE-2014-9341 | yurl-retwitt (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers t | medium | 6.8 | 1% |
| CVE-2015-3154 | zendframework/zend-http, zendframework/zendframework, zendframework/zendframework1 +1 more | Zenario CMS vulnerable to CRLF injection | medium | 6.1 | 1% |
| CVE-2019-9669 | wordfence (WordPress plugin) | The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerab | medium | 6.1 | 1% |
| CVE-2020-23761 | intelliants/subrion | subrion CMS Cross Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2018-11326 | joomla/joomla-cms | Joomla! XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2022-1396 | donorbox (WordPress plugin) | The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, lead | medium | 4.8 | 1% |
| CVE-2022-1558 | curtain (WordPress plugin) | The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-1559 | clipr (WordPress plugin) | The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to | medium | 4.8 | 1% |
| CVE-2022-1203 | content-mask (WordPress plugin) | The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not va | medium | 4.3 | 1% |
| CVE-2023-3668 | froxlor/froxlor | Froxlor vulnerable to Improper Encoding or Escaping of Output | critical | 9.1 | 1% |
| CVE-2024-8671 | wooevents (WordPress plugin) | The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path vali | critical | 9.1 | 1% |
| CVE-2023-3692 | admidio/admidio | Admidio vulnerable to Unrestricted Upload of File with Dangerous Type | medium | 6.7 | 1% |
| CVE-2021-40926 | james-heinrich/getid3 | Cross-site scripting in demos/demo.mysqli.php in getID3 | medium | 6.1 | 1% |
| CVE-2024-5483 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ | medium | 5.3 | 1% |
| CVE-2015-2089 | crossslide-jquery (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 fo | medium | 6.8 | 1% |
| CVE-2022-2046 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but | medium | 4.9 | 1% |
| CVE-2023-3435 | user-activity-log (WordPress plugin) | The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL state | critical | 9.8 | 1% |
| CVE-2022-0961 | microweber/microweber | Denial of service in microweber | high | 7.1 | 1% |
| CVE-2022-1685 | five-minute-webshop (WordPress plugin) | The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQ | medium | 4.9 | 1% |
| CVE-2022-1691 | realty-workstation (WordPress plugin) | The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL stateme | medium | 4.9 | 1% |
| CVE-2011-4133 | moodle/moodle | Moodle vulnerable to Cross-Site Request Forgery | medium | 0.0 | 1% |
| CVE-2011-4281 | moodle/moodle | Moodle vulnerable to Cross-Site Request Forgery | medium | 0.0 | 1% |
| CVE-2014-0126 | moodle/moodle | Moodle cross-site request forgery (CSRF) vulnerability | medium | 0.0 | 1% |
| CVE-2014-0213 | moodle/moodle | Moodle multiple cross-site request forgery (CSRF) vulnerabilities | medium | 0.0 | 1% |
| CVE-2014-7836 | moodle/moodle | Moodle multiple cross-site request forgery (CSRF) vulnerabilities | medium | 0.0 | 1% |
| CVE-2014-7838 | moodle/moodle | Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module | medium | 0.0 | 1% |
| CVE-2015-0213 | moodle/moodle | Moodle multiple cross-site request forgery (CSRF) vulnerabilities | medium | 0.0 | 1% |
| CVE-2015-0218 | moodle/moodle | Moodle cross-site request forgery (CSRF) vulnerability | medium | 0.0 | 1% |
| CVE-2024-5147 | wpzoom-elementor-addons (WordPress plugin) | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and i | critical | 9.8 | 1% |
| CVE-2022-45820 | learnpress (WordPress plugin) | SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. | critical | 9.1 | 1% |
| CVE-2021-25017 | tutor-lms (WordPress plugin) | The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page | medium | 6.1 | 1% |
| CVE-2022-0384 | video-conferencing-with-zoom (WordPress plugin) | The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing | medium | 4.3 | 1% |
| CVE-2016-9450 | drupal/core, drupal/drupal | Drupal Incorrect cache context on password reset page | high | 7.5 | 1% |
| CVE-2022-4156 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST pa | high | 7.5 | 1% |
| CVE-2023-0335 | wp-shamsi (WordPress plugin) | The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscri | medium | 6.5 | 1% |
| CVE-2023-0336 | ooohboi-steroids-for-elementor (WordPress plugin) | The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with ro | medium | 6.5 | 1% |
| CVE-2017-1000193 | october/october | October CMS XSS | medium | 6.1 | 1% |
| CVE-2016-7111 | mantisbt/mantisbt | MantisBT XSS through weak CSP when using Gravatar plugin | medium | 4.7 | 1% |