Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-38317 | konnichiwa (WordPress plugin) | The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the plan_id parameter in the ~/views/subscri | medium | 6.1 | 1% |
| CVE-2021-38318 | 3d-cover-carousel (WordPress plugin) | The 3D Cover Carousel WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/cover-carousel.php file | medium | 6.1 | 1% |
| CVE-2021-38319 | more-from-google (WordPress plugin) | The More From Google WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~ | medium | 6.1 | 1% |
| CVE-2021-38321 | custom-sub-menus (WordPress plugin) | The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selected_menu parameter found in the ~/custo | medium | 6.1 | 1% |
| CVE-2021-38322 | twitter-friends-widget (WordPress plugin) | The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmc_TF_user and pmc_TF_password paramete | medium | 6.1 | 1% |
| CVE-2021-38326 | post-title-counter (WordPress plugin) | The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-c | medium | 6.1 | 1% |
| CVE-2021-38328 | notices (WordPress plugin) | The Notices WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/notices. | medium | 6.1 | 1% |
| CVE-2021-38329 | dj-email-publish (WordPress plugin) | The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/ | medium | 6.1 | 1% |
| CVE-2021-38331 | wp-t-wap (WordPress plugin) | The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the ~/wap/writer.php file wh | medium | 6.1 | 1% |
| CVE-2021-38332 | ops-robots-txt (WordPress plugin) | The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER[" | medium | 6.1 | 1% |
| CVE-2021-38334 | wp-design-maps-places (WordPress plugin) | The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp | medium | 6.1 | 1% |
| CVE-2021-38335 | wiseagentleadform (WordPress plugin) | The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value | medium | 6.1 | 1% |
| CVE-2021-38336 | edit-comments-xt (WordPress plugin) | The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~ | medium | 6.1 | 1% |
| CVE-2021-38337 | rsvpmaker-excel (WordPress plugin) | The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/ | medium | 6.1 | 1% |
| CVE-2021-38338 | border-loading-bar (WordPress plugin) | The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-f | medium | 6.1 | 1% |
| CVE-2021-38339 | simple-matted-thumbnails (WordPress plugin) | The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value | medium | 6.1 | 1% |
| CVE-2021-38340 | webful-simple-grocery-shop (WordPress plugin) | The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/inclu | medium | 6.1 | 1% |
| CVE-2021-38348 | advance-search (WordPress plugin) | The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views | medium | 6.1 | 1% |
| CVE-2021-38349 | woo-moneybird (WordPress plugin) | The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description para | medium | 6.1 | 1% |
| CVE-2021-38350 | spideranalyse (WordPress plugin) | The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php f | medium | 6.1 | 1% |
| CVE-2021-38351 | osd-subscribe (WordPress plugin) | The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/op | medium | 6.1 | 1% |
| CVE-2021-38352 | push-notification-by-feedify (WordPress plugin) | The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in | medium | 6.1 | 1% |
| CVE-2021-38353 | dropdown-and-scrollable-text (WordPress plugin) | The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/i | medium | 6.1 | 1% |
| CVE-2021-38354 | gnu-mailman-integration (WordPress plugin) | The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/inclu | medium | 6.1 | 1% |
| CVE-2023-2449 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the pl | critical | 9.8 | 1% |
| CVE-2022-27858 | activity-log (WordPress plugin) | CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress. | high | 7.4 | 1% |
| CVE-2019-12239 | wp-booking-system (WordPress plugin) | The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that r | high | 7.2 | 1% |
| CVE-2022-2407 | wp-phpmyadmin (WordPress plugin) | The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin | medium | 4.8 | 1% |
| CVE-2026-25510 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor | critical | 9.9 | 1% |
| CVE-2021-25955 | dolibarr/dolibarr | Dolibarr Cross-site Scripting vulnerability | critical | 9.0 | 1% |
| CVE-2024-0825 | vimeography (WordPress plugin) | The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and | high | 8.8 | 1% |
| CVE-2022-2890 | yetiforce/yetiforce-crm | Cross site scripting in yetiforce/yetiforce-crm | medium | 5.4 | 1% |
| CVE-2021-24681 | duplicate-page (WordPress plugin) | The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which | medium | 4.8 | 1% |
| CVE-2023-4994 | allow-php-in-posts-and-pages (WordPress plugin) | The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the | critical | 9.9 | 1% |
| CVE-2023-6272 | 2fa (WordPress plugin) | The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force a | critical | 9.8 | 1% |
| CVE-2012-10009 | 404like (WordPress plugin) | A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage | high | 7.3 | 1% |
| CVE-2019-11876 | prestashop/prestashop | PrestaShop Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2020-14959 | easy-testimonials (WordPress plugin) | Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script | medium | 5.4 | 1% |
| CVE-2020-14962 | image-photo-gallery-final-tiles-grid (WordPress plugin) | Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web sc | medium | 5.4 | 1% |
| CVE-2024-1991 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privileg | high | 8.8 | 1% |
| CVE-2023-3673 | pimcore/pimcore | Pimcore SQL Injection vulnerability | high | 7.2 | 1% |
| CVE-2025-1913 | product-import-export-for-woo (WordPress plugin) | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in al | high | 7.2 | 1% |
| CVE-2021-3990 | showdoc/showdoc | showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | medium | 6.5 | 1% |
| CVE-2018-16514 | mantisbt/mantisbt | MantisBT cross-site scripting (XSS) vulnerability through crafted PATH_INFO | medium | 6.1 | 1% |
| CVE-2024-0337 | travelpayouts (WordPress plugin) | The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validat | medium | 6.1 | 1% |
| CVE-2024-9458 | reservit-hotel (WordPress plugin) | The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2021-24868 | document-embedder (WordPress plugin) | The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subsc | medium | 4.3 | 1% |
| CVE-2023-0388 | random-text (WordPress plugin) | The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading | high | 8.8 | 1% |
| CVE-2023-2492 | querywall-plug\'n-play-firewall (WordPress plugin) | The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQ | high | 7.2 | 1% |
| CVE-2021-37707 | shopware/core, shopware/platform | Manipulation of product reviews via API | medium | 6.5 | 1% |