Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13448 | addons (WordPress plugin) | The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uplo | critical | 9.8 | 1% |
| CVE-2021-24928 | rearrange-woocommerce-products (WordPress plugin) | The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor | medium | 6.5 | 1% |
| CVE-2021-24164 | ninja-forms (WordPress plugin) | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ | medium | 4.3 | 1% |
| CVE-2022-2714 | francoisjacquet/rosariosis | RosarioSIS before 10.1 vulnerable to Improper Handling of Length Parameter Inconsistency | high | 8.1 | 1% |
| CVE-2023-5576 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and includi | high | 8.0 | 1% |
| CVE-2017-18539 | weblibrarian (WordPress plugin) | The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes. | medium | 6.1 | 1% |
| CVE-2021-24724 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low | medium | 5.4 | 1% |
| CVE-2021-25015 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page | medium | 6.1 | 1% |
| CVE-2021-25031 | image-hover-effects-ultimate (WordPress plugin) | The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape t | medium | 6.1 | 1% |
| CVE-2021-25035 | backup-and-staging-by-wp-time-capsule (WordPress plugin) | The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting | medium | 6.1 | 1% |
| CVE-2021-25062 | orders-tracking-for-woocommerce (WordPress plugin) | The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an | medium | 6.1 | 1% |
| CVE-2021-25083 | registrations-for-the-events-calendar (WordPress plugin) | The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an | medium | 6.1 | 1% |
| CVE-2023-28665 | bulk-price-update-for-woocommerce (WordPress plugin) | The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' | medium | 5.4 | 1% |
| CVE-2021-4240 | phpservermon/phpservermon | Insufficient Entropy in PHPServerMon PRNG | medium | 5.3 | 1% |
| CVE-2022-1029 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with a | medium | 4.8 | 1% |
| CVE-2023-0788 | thorsten/phpmyfaq | Code Injection in thorsten/phpmyfaq | critical | 9.8 | 1% |
| CVE-2024-2385 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.4 via se | high | 8.8 | 1% |
| CVE-2020-26225 | prestashop/productcomments | Reflected XSS with parameters in PostComment | high | 8.7 | 1% |
| CVE-2022-29410 | hermit (WordPress plugin) | Authenticated SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers with Subscriber or h | high | 7.4 | 1% |
| CVE-2018-16255 | wp-all-import (WordPress plugin) | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vu | medium | 6.1 | 1% |
| CVE-2018-16258 | wp-all-import (WordPress plugin) | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that th | medium | 6.1 | 1% |
| CVE-2018-16259 | wp-all-import (WordPress plugin) | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states | medium | 6.1 | 1% |
| CVE-2023-0602 | twittee-text-tweet (WordPress plugin) | The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of | medium | 6.1 | 1% |
| CVE-2019-14947 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. | medium | 5.4 | 1% |
| CVE-2024-48112 | topthink/thinkphp | ThinkPHP deserialization vulnerability | critical | 9.8 | 1% |
| CVE-2021-4331 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2. | high | 8.8 | 1% |
| CVE-2025-6755 | game-users-share-buttons (WordPress plugin) | The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the a | high | 8.8 | 1% |
| CVE-2022-3694 | syncee---global-dropshipping (WordPress plugin) | The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account. | high | 7.5 | 1% |
| CVE-2023-1207 | http-headers (WordPress plugin) | This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL I | high | 7.2 | 1% |
| CVE-2022-3247 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does n | medium | 6.5 | 1% |
| CVE-2019-15650 | stops-core-theme-and-plugin-updates (WordPress plugin) | The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling | medium | 4.3 | 1% |
| CVE-2015-5467 | yiisoft/yii2, yiisoft/yii2-dev | Yii2 allows attackers to execute any local .php file via a relative path in the view parameter | critical | 9.8 | 1% |
| CVE-2023-2500 | go-pricing (WordPress plugin) | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and inclu | high | 8.8 | 1% |
| CVE-2021-34653 | wp-fountain (WordPress plugin) | The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/wp-fountain | medium | 6.1 | 1% |
| CVE-2022-0951 | showdoc/showdoc | File Upload Restriction Bypass leading to Cross-site Scripting in ShowDoc | medium | 6.1 | 1% |
| CVE-2022-2939 | wp-cerber (WordPress plugin) | The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes use | medium | 5.3 | 1% |
| CVE-2024-33298 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 0.0 | 1% |
| CVE-2015-10073 | tinymighty/wiki-seo | tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML function | critical | 9.6 | 1% |
| CVE-2023-38218 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | high | 8.8 | 1% |
| CVE-2019-12205 | silverstripe/admin, silverstripe/framework | Silverstripe Flash Clipboard Reflected XSS | medium | 6.1 | 1% |
| CVE-2024-45119 | magento/community-edition | Magento Open Source Server-Side Request Forgery (SSRF) vulnerability | medium | 4.9 | 1% |
| CVE-2019-3851 | moodle/moodle | Moodle Secure layout contained an insecure link in Boost theme | medium | 4.3 | 1% |
| CVE-2025-49555 | magento/community-edition, magento/project-community-edition | Magento Cross-Site Request Forgery (CSRF) vulnerability | high | 8.1 | 1% |
| CVE-2024-13409 | post-grid-carousel-ultimate (WordPress plugin) | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local F | high | 7.5 | 1% |
| CVE-2011-1150 | bbpress/bbpress | bbPress Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2019-14945 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 2.0.54 for WordPress has XSS. | medium | 5.4 | 1% |
| CVE-2021-24720 | geodirectory (WordPress plugin) | The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS). | medium | 5.4 | 1% |
| CVE-2025-45346 | bacula-web/bacula-web | Bacula-web SQL Injection Vulnerability | high | 8.1 | 1% |
| CVE-2015-9424 | multicons (WordPress plugin) | The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.ph | medium | 6.5 | 1% |
| CVE-2015-9437 | dynamic-widgets (WordPress plugin) | The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit | medium | 6.5 | 1% |