Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-19785 | athlon1600/php-proxy-app | XSS in PHP-Proxy-App through v3.0 | medium | 6.1 | 1% |
| CVE-2019-17070 | liquid-speech-balloon (WordPress plugin) | The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer. | medium | 6.1 | 1% |
| CVE-2019-17071 | client-dash (WordPress plugin) | The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS. | medium | 6.1 | 1% |
| CVE-2019-17384 | animate-it (WordPress plugin) | The animate-it plugin before 2.3.4 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-17385 | animate-it (WordPress plugin) | The animate-it plugin before 2.3.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2020-29172 | litespeed-cache (WordPress plugin) | A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setti | medium | 6.1 | 1% |
| CVE-2022-3908 | helloprint (WordPress plugin) | The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 1% |
| CVE-2021-21365 | bk2k/bootstrap-package | Cross-Site Scripting in Bootstrap Package | medium | 5.4 | 1% |
| CVE-2023-0579 | yet-another-related-posts-plugin (WordPress plugin) | The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, | high | 8.8 | 1% |
| CVE-2023-1471 | wp-popup-banners (WordPress plugin) | The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parameter in versions up to, and including, 1.2 | high | 8.8 | 1% |
| CVE-2022-37344 | accommodation-system (WordPress plugin) | Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress. | high | 7.6 | 1% |
| CVE-2021-24721 | loco-translate (WordPress plugin) | The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension endi | medium | 6.5 | 1% |
| CVE-2019-14784 | cp-contact-form-with-paypal (WordPress plugin) | The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition. | medium | 6.1 | 1% |
| CVE-2017-5605 | movim/moxl | XMPP Clients User Impersonation Vulnerability in Movim Moxl | medium | 5.9 | 1% |
| CVE-2022-36425 | beaver-builder-lite-version (WordPress plugin) | Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress. | medium | 5.4 | 1% |
| CVE-2025-54082 | manogi/nova-tiptap, marshmallow/nova-tiptap | nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability | critical | 0.0 | 1% |
| CVE-2024-9822 | pedalo-connector (WordPress plugin) | The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to ins | critical | 9.8 | 1% |
| CVE-2024-6318 | imgspider (WordPress plugin) | The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' func | high | 8.8 | 1% |
| CVE-2024-6319 | imgspider (WordPress plugin) | The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in a | high | 8.8 | 1% |
| CVE-2023-37473 | zenstruck/collection | zenstruck/collection passing callable string to EntityRepository::find() and query() | high | 8.5 | 1% |
| CVE-2020-12467 | intelliants/subrion | Session Fixation in Subrion CMS | medium | 6.5 | 1% |
| CVE-2018-10300 | wd-instagram-feed (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to in | medium | 6.1 | 1% |
| CVE-2018-10301 | wd-instagram-feed (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attacke | medium | 6.1 | 1% |
| CVE-2023-3244 | comments-like-dislike (WordPress plugin) | The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the r | medium | 4.3 | 1% |
| CVE-2021-24244 | wpbakery-page-builder-clipboard (WordPress plugin) | An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability che | medium | 6.5 | 1% |
| CVE-2022-2370 | yaysmtp (WordPress plugin) | The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the setting | medium | 6.5 | 1% |
| CVE-2017-17719 | wp-concours (WordPress plugin) | A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary w | medium | 6.1 | 1% |
| CVE-2017-17744 | custom-map (WordPress plugin) | A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary we | medium | 6.1 | 1% |
| CVE-2021-34635 | poll-maker (WordPress plugin) | The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/setti | medium | 6.1 | 1% |
| CVE-2021-34642 | smart-email-alerts (WordPress plugin) | The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the api_key in the ~/views/settings.php file whi | medium | 6.1 | 1% |
| CVE-2021-34644 | multiplayer-plugin (WordPress plugin) | The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/multi | medium | 6.1 | 1% |
| CVE-2021-34664 | moova-for-woocommerce (WordPress plugin) | The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the ~/Checkout/Checkout. | medium | 6.1 | 1% |
| CVE-2021-38315 | sp-client-document-manager (WordPress plugin) | The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to param | medium | 6.1 | 1% |
| CVE-2021-38316 | wp-academic-people (WordPress plugin) | The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category_name parameter in the ~/admin- | medium | 6.1 | 1% |
| CVE-2021-38323 | rentpress (WordPress plugin) | The RentPress WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the ~/src/rentPress/Aja | medium | 6.1 | 1% |
| CVE-2021-38325 | user-activation-email (WordPress plugin) | The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the ~/user-act | medium | 6.1 | 1% |
| CVE-2021-38327 | youtube-video-inserter (WordPress plugin) | The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in | medium | 6.1 | 1% |
| CVE-2021-38330 | yabp (WordPress plugin) | The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] valu | medium | 6.1 | 1% |
| CVE-2021-38333 | wp-scrippets (WordPress plugin) | The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/wp- | medium | 6.1 | 1% |
| CVE-2021-38341 | wc-payment-gateway-per-category (WordPress plugin) | The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["P | medium | 6.1 | 1% |
| CVE-2021-38347 | simple-custom-website-data (WordPress plugin) | The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php | medium | 6.1 | 1% |
| CVE-2021-38355 | bug-library (WordPress plugin) | The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-lib | medium | 6.1 | 1% |
| CVE-2020-25781 | mantisbt/mantisbt | MantisBT unauthorized users able to access private files | medium | 4.3 | 1% |
| CVE-2023-0220 | pinpoint-booking-system (WordPress plugin) | The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it i | high | 8.8 | 1% |
| CVE-2018-16256 | wp-all-import (WordPress plugin) | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that | medium | 6.1 | 1% |
| CVE-2021-24907 | everest-forms (WordPress plugin) | The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it bac | medium | 6.1 | 1% |
| CVE-2023-46308 | plotly/plotly.js | plotly.js prototype pollution vulnerability | critical | 9.8 | 1% |
| CVE-2024-11270 | wp-webinarsystem (WordPress plugin) | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check | high | 8.8 | 1% |
| CVE-2020-15885 | munkireport/comment | MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment | medium | 5.4 | 1% |
| CVE-2024-0757 | insert-or-embed-articulate-content (WordPress plugin) | The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowe | medium | 5.4 | 1% |