Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5254 | chatbot (WordPress plugin) | The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_cha | medium | 5.3 | 1% |
| CVE-2021-25956 | dolibarr/dolibarr | Dolibarr vulnerable to Improper Authentication and Improper Access Control | high | 7.2 | 1% |
| CVE-2023-2756 | pimcore/customer-management-framework-bundle | pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query | high | 7.2 | 1% |
| CVE-2023-2032 | custom-404-pro (WordPress plugin) | The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabiliti | critical | 9.8 | 1% |
| CVE-2018-5960 | tribalsystems/zenario | SQL Injection in Zenario 7.1-7.6 | high | 8.8 | 1% |
| CVE-2015-9494 | indieweb-post-kinds (WordPress plugin) | The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier. | medium | 6.1 | 1% |
| CVE-2015-9504 | weeklynews-theme (WordPress theme) | The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter. | medium | 6.1 | 1% |
| CVE-2019-19111 | wpforo (WordPress plugin) | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. | medium | 6.1 | 1% |
| CVE-2019-19112 | wpforo (WordPress plugin) | The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php. | medium | 6.1 | 1% |
| CVE-2019-19540 | listingpro (WordPress theme) | The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage. | medium | 6.1 | 1% |
| CVE-2020-14010 | xenon (WordPress theme) | The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter. | medium | 6.1 | 1% |
| CVE-2020-16140 | greenmart (WordPress theme) | The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS. | medium | 6.1 | 1% |
| CVE-2020-25378 | wp-floating-menu (WordPress plugin) | Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter. | medium | 6.1 | 1% |
| CVE-2020-25631 | moodle/moodle | Moodle Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2023-2655 | contact-form-maker (WordPress plugin) | The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement | high | 7.2 | 1% |
| CVE-2017-18508 | wp-live-chat-support (WordPress plugin) | The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2022-38080 | exceedone/exment, exceedone/laravel-admin | exceedone/exment and exceedone/laravel-admin Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2020-24141 | wp-downloadmanager (WordPress plugin) | Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end s | medium | 5.3 | 1% |
| CVE-2022-2997 | snipe/snipe-it | Insufficient Session Expiration in snipe/snipe-it | medium | 4.6 | 1% |
| CVE-2024-5179 | cowidgets-elementor-addons (WordPress plugin) | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via | high | 8.8 | 1% |
| CVE-2024-25117 | phenx/php-svg-lib | php-svg-lib lacks path validation on font through SVG inline styles | medium | 6.8 | 1% |
| CVE-2022-4150 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST | medium | 6.5 | 1% |
| CVE-2022-4151 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET p | medium | 6.5 | 1% |
| CVE-2022-4152 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro WordPress plugin before 19.1.5 do not escape the option_id POST para | medium | 6.5 | 1% |
| CVE-2022-4153 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the upload[] POST p | medium | 6.5 | 1% |
| CVE-2022-4159 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_id POST para | medium | 6.5 | 1% |
| CVE-2022-4161 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_start P | medium | 6.5 | 1% |
| CVE-2022-4162 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_row POST par | medium | 6.5 | 1% |
| CVE-2022-4163 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_deactivate a | medium | 6.5 | 1% |
| CVE-2022-4164 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_multiple_fil | medium | 6.5 | 1% |
| CVE-2022-4165 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST p | medium | 6.5 | 1% |
| CVE-2022-4166 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST | medium | 6.5 | 1% |
| CVE-2014-10392 | cforms2 (WordPress plugin) | The cforms2 plugin before 10.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2018-19564 | easy-testimonials (WordPress plugin) | Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_posi | medium | 6.1 | 1% |
| CVE-2019-14884 | moodle/moodle | Moodle reflected Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2019-15082 | 360-product-rotation (WordPress plugin) | The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS. | medium | 6.1 | 1% |
| CVE-2019-15328 | import-users-from-csv-with-meta (WordPress plugin) | The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-15643 | ultimate-faqs (WordPress plugin) | The ultimate-faqs plugin before 1.8.22 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-7413 | parallax-scroll (WordPress plugin) | In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via | medium | 6.1 | 1% |
| CVE-2021-24317 | listeo (WordPress plugin) | The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message | medium | 6.1 | 1% |
| CVE-2021-24365 | admin-columns (WordPress plugin) | The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column ha | medium | 5.4 | 1% |
| CVE-2022-36107 | typo3/cms, typo3/cms-core | TYPO3 CMS Stored Cross-Site Scripting via FileDumpController | medium | 5.4 | 1% |
| CVE-2021-39354 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters fou | medium | 4.8 | 1% |
| CVE-2026-40308 | joedolson/my-calendar | Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar | high | 0.0 | 1% |
| CVE-2024-37906 | admidio/admidio | Admidio has Blind SQL Injection in ecard_send.php | critical | 9.9 | 1% |
| CVE-2026-26279 | froxlor/froxlor | Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection | critical | 9.1 | 1% |
| CVE-2022-3417 | wptouch (WordPress plugin) | The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections | high | 8.8 | 1% |
| CVE-2022-3679 | starter-templates (WordPress plugin) | The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP obj | high | 8.8 | 1% |
| CVE-2024-10626 | woocommerce-support-ticket-system (WordPress plugin) | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation | high | 8.8 | 1% |
| CVE-2020-15151 | openmage/magento-lts | Observable Timing Discrepancy in OpenMage LTS | high | 8.0 | 1% |