Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4208 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' pa | medium | 6.1 | 1% |
| CVE-2022-4209 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' | medium | 6.1 | 1% |
| CVE-2022-4210 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page | medium | 6.1 | 1% |
| CVE-2022-4211 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' p | medium | 6.1 | 1% |
| CVE-2022-4212 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page | medium | 6.1 | 1% |
| CVE-2023-0334 | shortpixel-adaptive-images (WordPress plugin) | The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 1% |
| CVE-2021-32720 | sylius/sylius | List of order ids, number, items total and token value exposed for unauthorized uses via new API | medium | 5.3 | 1% |
| CVE-2024-1382 | nd-restaurant-reservations (WordPress plugin) | The Restaurant Reservations plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the nd_ | high | 8.8 | 1% |
| CVE-2024-24574 | phpmyfaq/phpmyfaq | phpMyFAQ vulnerable to stored XSS on attachments filename | medium | 6.5 | 1% |
| CVE-2022-24563 | genix/cms | Cross-site Scripting in GeniXCMS | medium | 5.4 | 1% |
| CVE-2019-19712 | contao/contao, contao/core-bundle | Information disclosure in the Contao backend | medium | 5.3 | 1% |
| CVE-2019-7864 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition IDOR Vulnerability | medium | 5.3 | 1% |
| CVE-2024-13742 | worpit-admin-dashboard-plugin (WordPress plugin) | The iControlWP – Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inclu | critical | 9.8 | 1% |
| CVE-2023-4386 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization | high | 8.1 | 1% |
| CVE-2024-8704 | file-manager-advanced (WordPress plugin) | The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 | high | 7.2 | 1% |
| CVE-2023-29289 | magento/community-edition, magento/project-community-edition | Magento Open Source allows XML Injection | medium | 6.5 | 1% |
| CVE-2016-4879 | baserproject/basercms | CSRF in baserCMS 3.0.10 and earlier | high | 8.8 | 1% |
| CVE-2023-37649 | cockpit-hq/cockpit | Cockpit CMS vulnerable to incorrect access control | high | 7.5 | 1% |
| CVE-2021-4050 | remdex/livehelperchat | Cross site scripting in remdex/livehelperchat | medium | 6.1 | 1% |
| CVE-2022-31475 | give (WordPress plugin) | Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. | medium | 5.5 | 1% |
| CVE-2023-50251 | phenx/php-svg-lib | Denial of service caused by infinite recursion when parsing SVG document | medium | 5.3 | 1% |
| CVE-2023-24774 | funadmin/funadmin | Funadmin vulnerable to SQL injection | critical | 9.8 | 1% |
| CVE-2023-0558 | contentstudio (WordPress plugin) | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type jugg | high | 8.2 | 1% |
| CVE-2021-4359 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18 | medium | 6.5 | 1% |
| CVE-2019-8126 | magento/community-edition, magento/product-community-edition | Information disclosure through processing of external XML entities | medium | 4.9 | 1% |
| CVE-2022-0873 | gmedia-gallery (WordPress plugin) | The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts wi | medium | 4.8 | 1% |
| CVE-2021-32710 | shopware/platform | Potential Session Hijacking | low | 0.0 | 1% |
| CVE-2023-1762 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable privilege escalation from improper privilege management | high | 8.8 | 1% |
| CVE-2024-2018 | wp-activity-log (WordPress plugin) | The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and in | high | 8.8 | 1% |
| CVE-2023-5957 | ni-purchase-order\(po\)-for-woocommerce (WordPress plugin) | The Ni Purchase Order(PO) For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the se | high | 7.2 | 1% |
| CVE-2021-24648 | registrationmagic (WordPress plugin) | The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in a | medium | 6.1 | 1% |
| CVE-2021-25043 | woocommerce-currency-switcher (WordPress plugin) | The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response | medium | 6.1 | 1% |
| CVE-2021-25077 | store-toolkit-for-woocommerce (WordPress plugin) | The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in | medium | 6.1 | 1% |
| CVE-2022-0161 | ari-fancy-lightbox (WordPress plugin) | The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin pa | medium | 6.1 | 1% |
| CVE-2022-0176 | powerpack-for-beaver-builder (WordPress plugin) | The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it ba | medium | 6.1 | 1% |
| CVE-2022-0193 | complianz (WordPress plugin) | The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, lead | medium | 6.1 | 1% |
| CVE-2022-0399 | advanced-product-labels-for-woocommerce (WordPress plugin) | The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter be | medium | 6.1 | 1% |
| CVE-2022-0431 | insights-from-google-pagespeed (WordPress plugin) | The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back | medium | 6.1 | 1% |
| CVE-2022-0471 | favicon-by-realfavicongenerator (WordPress plugin) | The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter befor | medium | 6.1 | 1% |
| CVE-2022-0601 | countdown\,-coming-soon\,-maintenance---countdown-\&-clock (WordPress plugin) | The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it b | medium | 6.1 | 1% |
| CVE-2022-1282 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back | medium | 6.1 | 1% |
| CVE-2024-22723 | fisharebest/webtrees | Webtrees Path Traversal vulnerability | medium | 4.9 | 1% |
| CVE-2023-1886 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to authentication bypass | high | 7.3 | 1% |
| CVE-2019-15489 | jsdecena/laracom | laracom Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2017-12870 | simplesamlphp/simplesamlphp | SimpleSAMLphp Unauthenticated encryption in CBC mode | medium | 5.9 | 1% |
| CVE-2021-37823 | opencart/opencart | OpenCart SQL injection vulnerability | medium | 4.9 | 1% |
| CVE-2024-20716 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Uncontrolled Resource Consumption | medium | 4.9 | 1% |
| CVE-2023-44382 | october/system | October CMS safe mode bypass using Twig sandbox escape | critical | 9.1 | 1% |
| CVE-2023-0765 | gallery (WordPress plugin) | The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Inject | high | 8.8 | 1% |
| CVE-2023-5798 | assistant (WordPress plugin) | The Assistant WordPress plugin before 1.4.4 does not validate a parameter before making a request to it via wp_remote_get(), which could all | high | 8.8 | 1% |