Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-1770 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versi | high | 8.8 | 1% |
| CVE-2021-38356 | social-networks-auto-poster (WordPress plugin) | The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['p | medium | 6.1 | 1% |
| CVE-2021-43558 | moodle/moodle | Cross-site Scripting in moodle | medium | 6.1 | 1% |
| CVE-2023-36097 | funadmin/funadmin | fuadmin vulnerable to insecure file upload | critical | 9.8 | 1% |
| CVE-2023-0768 | hotels-online-booking-engine (WordPress plugin) | The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before | high | 8.8 | 1% |
| CVE-2023-26325 | reviewx (WordPress plugin) | The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterVal | high | 8.8 | 1% |
| CVE-2023-2843 | multiparcels-shipping-for-woocommerce (WordPress plugin) | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it | high | 8.8 | 1% |
| CVE-2023-28659 | waiting (WordPress plugin) | The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc | high | 8.8 | 1% |
| CVE-2023-28660 | events-made-easy (WordPress plugin) | The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' pa | high | 8.8 | 1% |
| CVE-2023-28661 | wp-popup-banners (WordPress plugin) | The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' paramete | high | 8.8 | 1% |
| CVE-2024-39406 | magento/community-edition | Magento Open Source Path Traversal vulnerability | medium | 6.8 | 1% |
| CVE-2023-38000 | WordPress core, gutenberg (WordPress plugin) | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 t | medium | 6.5 | 1% |
| CVE-2021-21340 | typo3/cms, typo3/cms-backend, typo3/cms-core | Cross-Site Scripting in Content Preview | medium | 5.4 | 1% |
| CVE-2021-21358 | typo3/cms, typo3/cms-core, typo3/cms-form | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form | medium | 5.4 | 1% |
| CVE-2021-21370 | typo3/cms, typo3/cms-backend, typo3/cms-core | Cross-Site Scripting in Content Preview (CType menu) | medium | 5.4 | 1% |
| CVE-2009-20001 | mantisbt/mantisbt | MantisBT Insufficient Session Expiration cookie string not reset after logout | high | 8.1 | 1% |
| CVE-2021-4097 | phpservermon/phpservermon | phpservermon is vulnerable to CRLF Injection | medium | 6.3 | 1% |
| CVE-2021-20779 | wp-html-mail (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote at | high | 8.8 | 1% |
| CVE-2026-68501 | sylius/mollie-plugin | Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII | medium | 6.5 | 1% |
| CVE-2022-24892 | shopware/shopware | Multiple valid tokens for password reset in Shopware | medium | 6.4 | 1% |
| CVE-2022-0501 | ptrofimov/beanstalk_console | Cross-site Scripting in Beanstalk console | medium | 6.1 | 1% |
| CVE-2022-1571 | facturascripts/facturascripts | Cross-site Scripting in FacturaScripts | medium | 6.1 | 1% |
| CVE-2015-5336 | moodle/moodle | Moodle multiple cross-site scripting (XSS) vulnerabilities | medium | 5.4 | 1% |
| CVE-2025-3623 | uncanny-automator (WordPress plugin) | The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deseriali | critical | 9.1 | 1% |
| CVE-2023-7064 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and incl | high | 7.5 | 1% |
| CVE-2020-16095 | kitodo/presentation | Cross-site Scripting vulnerability in Kitodo.Presentation | medium | 6.1 | 1% |
| CVE-2023-3714 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group | high | 7.5 | 1% |
| CVE-2019-19850 | typo3/cms, typo3/cms-core | TYPO3 SQL Injection in low-level Query Generator | medium | 5.5 | 1% |
| CVE-2017-11422 | statamic/cms | Statamic framework Incorrect Permission Assignment | high | 8.8 | 1% |
| CVE-2023-4153 | ban-users (WordPress plugin) | The BAN Users plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.5.3 due to a missing capability | high | 8.8 | 1% |
| CVE-2015-9421 | olevmedia-shortcodes (WordPress plugin) | The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id | medium | 6.5 | 1% |
| CVE-2015-9428 | wplegalpages (WordPress plugin) | The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-busi | medium | 6.5 | 1% |
| CVE-2015-9429 | yith-maintenance-mode (WordPress plugin) | The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mo | medium | 6.5 | 1% |
| CVE-2015-9431 | qtranslate-x (WordPress plugin) | The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_c | medium | 6.5 | 1% |
| CVE-2015-9432 | alpine-photo-tile-for-instagram (WordPress plugin) | The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?pag | medium | 6.5 | 1% |
| CVE-2015-9434 | kiwi-logo-carousel (WordPress plugin) | The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogo | medium | 6.5 | 1% |
| CVE-2021-24293 | nextgen-gallery (WordPress plugin) | In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ | medium | 6.1 | 1% |
| CVE-2024-1985 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up | medium | 4.7 | 1% |
| CVE-2021-28088 | impresscms/impresscms | Cross-site scripting (XSS) | medium | 0.0 | 1% |
| CVE-2023-27238 | lavalite/cms | LavaLite vulnerable to web cache poisoning | critical | 9.8 | 1% |
| CVE-2021-20780 | currency-switcher (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack th | high | 8.8 | 1% |
| CVE-2023-2180 | kiwiz-invoices-certification-\&-pdf-system (WordPress plugin) | The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which cou | high | 7.5 | 1% |
| CVE-2019-10763 | pimcore/pimcore | Data leakage via SQL Injection in Pimcore | medium | 6.5 | 1% |
| CVE-2021-25100 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms da | medium | 6.1 | 1% |
| CVE-2022-0252 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin d | medium | 6.1 | 1% |
| CVE-2022-0380 | fotobook (WordPress plugin) | The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF | medium | 6.1 | 1% |
| CVE-2022-0628 | ap-mega-menu (WordPress plugin) | The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, | medium | 6.1 | 1% |
| CVE-2022-0640 | pricing-table-builder (WordPress plugin) | The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an ad | medium | 6.1 | 1% |
| CVE-2022-0680 | plezi (WordPress plugin) | The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable op | medium | 6.1 | 1% |
| CVE-2022-0780 | searchiq (WordPress plugin) | The SearchIQ WordPress plugin before 3.9 contains a flag to disable the verification of CSRF nonces, granting unauthenticated attackers acce | medium | 6.1 | 1% |