Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-4691 | bookly (WordPress plugin) | The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before usi | high | 7.2 | 1% |
| CVE-2019-8143 | magento/community-edition, magento/product-community-edition | Magento Injection vulnerability via email templates | medium | 6.5 | 1% |
| CVE-2023-3936 | blog2social (WordPress plugin) | The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 6.1 | 1% |
| CVE-2021-32244 | moodle/moodle | Moodle Cross Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2022-0723 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2022-0962 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2022-0965 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2022-2036 | francoisjacquet/rosariosis | Cross site scripting in francoisjacquet/rosariosis | medium | 5.4 | 1% |
| CVE-2026-42878 | facturascripts/facturascripts | FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint | medium | 5.3 | 1% |
| CVE-2010-4183 | ezyang/htmlpurifier | HTML Purifier cross-site scripting (XSS) vulnerability | medium | 0.0 | 1% |
| CVE-2024-7145 | jetelements (WordPress plugin) | The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_ty | high | 8.8 | 1% |
| CVE-2021-24788 | batch-cat (WordPress plugin) | The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. | medium | 6.5 | 1% |
| CVE-2017-15375 | wpjobboard (WordPress plugin) | Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The v | medium | 6.1 | 1% |
| CVE-2018-6466 | flickrrss (WordPress plugin) | A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar | medium | 6.1 | 1% |
| CVE-2018-6468 | flickrrss (WordPress plugin) | A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar | medium | 6.1 | 1% |
| CVE-2018-6469 | flickrrss (WordPress plugin) | A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar | medium | 6.1 | 1% |
| CVE-2021-40694 | moodle/moodle | Moodle Improper Encoding or Escaping of Output | medium | 4.9 | 1% |
| CVE-2016-10112 | woocommerce (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to | medium | 4.8 | 1% |
| CVE-2023-4243 | full-customer (WordPress plugin) | The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and in | high | 8.8 | 1% |
| CVE-2023-1274 | pricing-tables-for-wpbakery-page-builder (WordPress plugin) | The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attribu | medium | 6.5 | 1% |
| CVE-2022-0233 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to in | medium | 6.4 | 1% |
| CVE-2022-4320 | wordpress-events-calendar-plugin (WordPress plugin) | The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, | medium | 6.1 | 1% |
| CVE-2026-59942 | dompdf/dompdf | Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps | medium | 0.0 | 1% |
| CVE-2025-55988 | dreamfactory/df-core | DreamFactory has a directory traversal | high | 7.2 | 1% |
| CVE-2017-18049 | silverstripe/framework | SilverStripe CSV Excel Macro Injection | medium | 5.5 | 1% |
| CVE-2015-9390 | admin-management-xtended (WordPress plugin) | The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled. | medium | 4.3 | 1% |
| CVE-2022-4118 | bitcoin-\/-altcoin-payment-gateway-for-woocommerce (WordPress plugin) | The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise a | critical | 9.8 | 1% |
| CVE-2023-22727 | cakephp/cakephp, cakephp/database | CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection | critical | 9.8 | 1% |
| CVE-2023-5877 | affiliate-toolkit (WordPress plugin) | The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/to | critical | 9.8 | 1% |
| CVE-2020-35135 | ultimate-category-excluder (WordPress plugin) | The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF. | high | 8.8 | 1% |
| CVE-2023-0955 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection a | high | 8.8 | 1% |
| CVE-2024-0952 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time- | high | 7.2 | 1% |
| CVE-2021-24177 | file-manager (WordPress plugin) | In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php? | medium | 5.4 | 1% |
| CVE-2019-7872 | magento/community-edition, magento/product-community-edition | Magento Insufficient authorization check when adding users to company accounts | medium | 6.5 | 1% |
| CVE-2018-20977 | all-in-one-schemaorg-rich-snippets (WordPress plugin) | The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page. | medium | 6.1 | 1% |
| CVE-2021-25110 | futurio-extra (WordPress plugin) | The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address. | medium | 4.3 | 1% |
| CVE-2025-52392 | soosyze/soosyze | Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms | medium | 5.4 | 1% |
| CVE-2023-29931 | hhxsv5/laravel-s | laravel-s vulnerable to Local File Inclusion | critical | 9.8 | 1% |
| CVE-2015-4179 | codestyling-localization (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress. | high | 8.8 | 1% |
| CVE-2021-29487 | october/system | October CMS auth bypass and account takeover | high | 7.4 | 1% |
| CVE-2019-8107 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Arbitrary File Deletion | medium | 6.5 | 1% |
| CVE-2019-10133 | moodle/moodle | Moodle Open Redirect Vulnerability | medium | 6.1 | 1% |
| CVE-2021-34649 | simple-behace-portfolio (WordPress plugin) | The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `dark` parameter in the ~/titan-framew | medium | 6.1 | 1% |
| CVE-2021-34651 | scribble-maps (WordPress plugin) | The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file wh | medium | 6.1 | 1% |
| CVE-2021-34654 | custom-post-type-relations (WordPress plugin) | The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptr[name] parameter found in the ~/ | medium | 6.1 | 1% |
| CVE-2021-34656 | webcam-2way-videochat (WordPress plugin) | The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_n | medium | 6.1 | 1% |
| CVE-2021-34658 | simple-popup-newsletter (WordPress plugin) | The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~ | medium | 6.1 | 1% |
| CVE-2021-34659 | plugmatter-pricing-table (WordPress plugin) | The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `email` parameter in the ~/licens | medium | 6.1 | 1% |
| CVE-2021-34663 | jquery-tagline-rotator (WordPress plugin) | The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/ | medium | 6.1 | 1% |
| CVE-2021-34667 | calendar-plugin (WordPress plugin) | The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER['PHP_SELF']` in the ~/calen | medium | 6.1 | 1% |