Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4703 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action | medium | 4.3 | 1% |
| CVE-2024-34461 | tribalsystems/zenario | Zenario uses Twig filters insecurely in the Twig Snippet plugin | critical | 9.8 | 1% |
| CVE-2025-65346 | alexusmai/laravel-file-manager | alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality | critical | 9.1 | 1% |
| CVE-2017-15863 | wp-noexternallinks (WordPress plugin) | Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/ | medium | 6.1 | 1% |
| CVE-2018-5653 | pinterest-feeds (WordPress plugin) | An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizar_pffr | medium | 6.1 | 1% |
| CVE-2018-5654 | pinterest-feeds (WordPress plugin) | An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREE_Access | medium | 6.1 | 1% |
| CVE-2023-29292 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 4.9 | 1% |
| CVE-2022-0174 | dolibarr/dolibarr | Logic error in dolibarr | medium | 4.3 | 1% |
| CVE-2024-7781 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to i | high | 8.1 | 1% |
| CVE-2011-4627 | typo3/cms | Typo3 Information Disclosure | medium | 6.5 | 1% |
| CVE-2011-4900 | typo3/cms | Typo3 Information Disclosure | medium | 6.5 | 1% |
| CVE-2021-39345 | hal (WordPress plugin) | The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several para | medium | 5.5 | 1% |
| CVE-2022-30852 | idno/known | Known v1.3.1 contains Insecure Direct Object Reference | medium | 4.3 | 1% |
| CVE-2023-0556 | contentstudio (WordPress plugin) | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versi | critical | 9.8 | 1% |
| CVE-2014-3843 | search-everything (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2010-3672 | typo3/cms-fluid | TYPO3 vulnerable to Cross-Site Scripting in the textarea view helper | medium | 6.1 | 1% |
| CVE-2016-10705 | jetpack (WordPress plugin) | The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. | medium | 6.1 | 1% |
| CVE-2018-16206 | spam-byebye (WordPress plugin) | Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script | medium | 6.1 | 1% |
| CVE-2023-2256 | product-addons-\&-fields-for-woocommerce (WordPress plugin) | The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Refl | medium | 6.1 | 1% |
| CVE-2021-3902 | dompdf/dompdf | Improper Restriction of XML External Entity Reference in dompdf/dompdf | critical | 9.8 | 1% |
| CVE-2022-3525 | librenms/librenms | Deserialization of Untrusted Data in librenms/librenms | high | 8.8 | 1% |
| CVE-2023-37260 | league/oauth2-server | league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase | high | 8.2 | 1% |
| CVE-2015-9302 | simple-fields (WordPress plugin) | The simple-fields plugin before 1.4.11 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10870 | google-language-translator (WordPress plugin) | The google-language-translator plugin before 5.0.06 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10880 | google-document-embedder (WordPress plugin) | The google-document-embedder plugin before 2.6.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10881 | google-document-embedder (WordPress plugin) | The google-document-embedder plugin before 2.6.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-17780 | booking-calendar-sms (WordPress plugin), clockwork-sms-notfications (WordPress plugin), contact-form-7-sms (WordPress plugin) +5 more | The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/ | medium | 6.1 | 1% |
| CVE-2019-6117 | ape-gallery (WordPress plugin) | The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function. | medium | 6.1 | 1% |
| CVE-2024-0624 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.3 | 1% |
| CVE-2019-7888 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Information Disclosure | medium | 6.5 | 1% |
| CVE-2015-9359 | jetpack (WordPress plugin) | The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9360 | updraftplus (WordPress plugin) | The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9363 | exchange (WordPress plugin) | iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9364 | ithemes-2checkout (WordPress plugin) | 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9365 | authorize.net (WordPress plugin) | Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9366 | custom-url-tracking (WordPress plugin) | Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9367 | easy-canadian-sales-taxes (WordPress plugin) | Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9368 | easy-eu-value-added-\(vat\)-taxes (WordPress plugin) | Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9369 | easy-us-sales-taxes (WordPress plugin) | Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9370 | invoices (WordPress plugin) | Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9371 | manual-purchases (WordPress plugin) | Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9372 | membership (WordPress plugin) | Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9373 | ithemes-paypal-pro (WordPress plugin) | PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9374 | stripe (WordPress plugin) | Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9375 | table-rate-shipping (WordPress plugin) | Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9376 | mobile (WordPress plugin) | iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9377 | builder-theme-depot (WordPress theme) | iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9378 | builder-theme-market (WordPress theme) | iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9379 | builder-style-manager (WordPress plugin) | iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2019-15838 | custom-404-pro (WordPress plugin) | The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789. | medium | 6.1 | 1% |