Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-46154 | e2pdf (WordPress plugin) | Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To P | medium | 6.6 | 1% |
| CVE-2020-5767 | email-subscribers-\&-newsletters (WordPress plugin) | Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged em | medium | 6.5 | 1% |
| CVE-2016-10936 | wp-polls (WordPress plugin) | The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option. | medium | 6.1 | 1% |
| CVE-2021-24976 | smart-seo-tool (WordPress plugin) | The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute | medium | 6.1 | 1% |
| CVE-2017-15052 | nilsteampassnet/teampass | TeamPass Improper Privilege Management | medium | 4.9 | 1% |
| CVE-2017-15053 | nilsteampassnet/teampass | TeamPass Improper Privilege Management | medium | 4.9 | 1% |
| CVE-2026-21448 | bagisto/bagisto | Bagisto has Normal & Blind SSTI from low-privilege user when ordering product | critical | 9.8 | 1% |
| CVE-2021-46743 | firebase/php-jwt | Firebase PHP-JWT key/algorithm type confusion | critical | 9.1 | 1% |
| CVE-2022-30998 | homepage-product-organizer-for-woocommerce (WordPress plugin) | Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer f | critical | 9.1 | 1% |
| CVE-2022-36793 | wp-shop-original (WordPress plugin) | Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress. | medium | 6.5 | 1% |
| CVE-2017-18499 | simple-membership (WordPress plugin) | The simple-membership plugin before 3.5.7 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18538 | weblibrarian (WordPress plugin) | The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes. | medium | 6.1 | 1% |
| CVE-2017-18540 | weblibrarian (WordPress plugin) | The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes. | medium | 6.1 | 1% |
| CVE-2017-18559 | cforms2 (WordPress plugin) | The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2018-21012 | cf7-invisible-recaptcha (WordPress plugin) | The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2023-6289 | swift-performance (WordPress plugin) | The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include s | medium | 4.3 | 1% |
| CVE-2022-33900 | easy-digital-downloads (WordPress plugin) | PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress. | medium | 4.1 | 1% |
| CVE-2024-7782 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | high | 8.7 | 1% |
| CVE-2022-4355 | letsrecover (WordPress plugin) | The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading | high | 7.2 | 1% |
| CVE-2022-4356 | letsrecover (WordPress plugin) | The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading | high | 7.2 | 1% |
| CVE-2017-18488 | backup (WordPress plugin) | The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2017-18489 | contact-form-7-sms-addon (WordPress plugin) | The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18495 | gravity-forms-sms-notifications (WordPress plugin) | The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18497 | liveforms (WordPress plugin) | The liveforms plugin before 3.4.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18498 | simple-job-board (WordPress plugin) | The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search. | medium | 6.1 | 1% |
| CVE-2017-18507 | wp-live-chat-support (WordPress plugin) | The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18572 | gnucommerce (WordPress plugin) | The gnucommerce plugin before 1.4.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18574 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. | medium | 6.1 | 1% |
| CVE-2017-18575 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues. | medium | 6.1 | 1% |
| CVE-2018-20963 | contact-form-to-email (WordPress plugin) | The contact-form-to-email plugin before 1.2.66 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2018-20982 | media-library-assistant (WordPress plugin) | The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin subme | medium | 6.1 | 1% |
| CVE-2020-9393 | pricing-table-by-supsystic (WordPress plugin) | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS. | medium | 6.1 | 1% |
| CVE-2021-39328 | simple-job-board (WordPress plugin) | The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_po | medium | 5.5 | 1% |
| CVE-2021-39357 | leaky-paywall (WordPress plugin) | The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via th | medium | 5.5 | 1% |
| CVE-2023-4404 | charitable (WordPress plugin) | The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due t | critical | 9.8 | 1% |
| CVE-2025-24411 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | high | 8.1 | 1% |
| CVE-2022-0719 | microweber/microweber | Cross-site Scripting in Microweber | high | 7.6 | 1% |
| CVE-2024-13592 | team-builder-for-wpbakery-page-builder (WordPress plugin) | The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versi | high | 7.5 | 1% |
| CVE-2017-18520 | democracy-poll (WordPress plugin) | The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php. | medium | 6.1 | 1% |
| CVE-2017-18615 | kama-clic-counter (WordPress plugin) | The kama-clic-counter plugin before 3.5.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-20019 | content-text-slider-on-post (WordPress plugin) | The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could | medium | 5.4 | 1% |
| CVE-2022-40194 | customer-reviews-woocommerce (WordPress plugin) | Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress | medium | 5.3 | 1% |
| CVE-2025-2807 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missi | high | 8.8 | 1% |
| CVE-2008-7321 | tubepress (WordPress plugin) | The tubepress plugin before 1.6.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2012-6714 | count-per-day (WordPress plugin) | The count-per-day plugin before 3.2.3 for WordPress has XSS via search words. | medium | 6.1 | 1% |
| CVE-2012-6715 | formbuilder (WordPress plugin) | The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header. | medium | 6.1 | 1% |
| CVE-2012-6716 | events-manager (WordPress plugin) | The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links. | medium | 6.1 | 1% |
| CVE-2013-7477 | events-manager (WordPress plugin) | The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form. | medium | 6.1 | 1% |
| CVE-2013-7478 | events-manager (WordPress plugin) | The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post. | medium | 6.1 | 1% |
| CVE-2013-7479 | events-manager (WordPress plugin) | The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field. | medium | 6.1 | 1% |