Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-38993 | cockpit-hq/cockpit | Cockpit is vulnerable to directory traversal | medium | 6.5 | 1% |
| CVE-2024-9314 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, | high | 7.2 | 1% |
| CVE-2017-8052 | craftcms/cms | Craft CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-26144 | mantisbt/mantisbt | MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php | medium | 6.1 | 1% |
| CVE-2022-29419 | 3xsocializer (WordPress plugin) | SQL Injection (SQLi) vulnerability in Don Crowther's 3xSocializer plugin <= 0.98.22 at WordPress possible for users with a low role like a s | medium | 6.0 | 1% |
| CVE-2022-3144 | wordfence (WordPress plugin) | The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and inc | medium | 4.4 | 1% |
| CVE-2024-2409 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to i | critical | 9.8 | 1% |
| CVE-2026-27206 | zumba/json-serializer | Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize() | high | 8.1 | 1% |
| CVE-2011-4903 | typo3/cms | Typo3 XSS in RemoveXSS function | medium | 6.1 | 1% |
| CVE-2021-25006 | molie-instructure-canvas-linking-tool (WordPress plugin) | The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard, leading to | medium | 6.1 | 1% |
| CVE-2022-3402 | log-http-requests (WordPress plugin) | The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and incl | medium | 6.1 | 1% |
| CVE-2022-38467 | crm-perks-forms (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver. | medium | 6.1 | 1% |
| CVE-2021-26256 | survey-maker (WordPress plugin) | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6). | medium | 4.7 | 1% |
| CVE-2009-4963 | commerceteam/commerce | Commerce extension for TYPO3 vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2026-42605 | azuracast/azuracast | AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload | high | 8.8 | 1% |
| CVE-2015-9440 | monetize (WordPress plugin) | The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new. | medium | 6.5 | 1% |
| CVE-2015-9441 | bookmarkify (WordPress plugin) | The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php. | medium | 6.5 | 1% |
| CVE-2017-11516 | yiisoft/yii2, yiisoft/yii2-dev | Yii Cross-site Scripting Framework vulnerability | medium | 6.1 | 1% |
| CVE-2018-11200 | mautic/core | XSS vulnerability in company name field in Mautic | medium | 6.1 | 1% |
| CVE-2013-0286 | pinboard (WordPress theme) | Pinboard 1.0.6 theme for Wordpress has XSS. | medium | 5.4 | 1% |
| CVE-2020-13828 | dolibarr/dolibarr | Dolibarr stored Cross-Site Scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2022-30874 | nukeviet/nukeviet | Cross-site Scripting in NukeViet CMS | medium | 5.4 | 1% |
| CVE-2024-5657 | born05/craft-twofactorauthentication | Password hash exposed in CraftCMS two factor authentication plugin | low | 3.7 | 1% |
| CVE-2024-57602 | alextselegidis/easyappointments | Easy!Appointments Improper Restriction of Excessive Authentication Attempts | critical | 9.8 | 1% |
| CVE-2023-24814 | typo3/cms, typo3/cms-core | TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering | high | 8.8 | 1% |
| CVE-2023-7061 | file-manager-advanced-shortcode (WordPress plugin) | The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5. | high | 8.8 | 1% |
| CVE-2021-24279 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug A | medium | 6.5 | 1% |
| CVE-2022-4214 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page | medium | 6.1 | 1% |
| CVE-2023-43875 | intelliants/subrion | Subrion CMS vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2023-6069 | froxlor/froxlor | Froxlor Improper Input Validation vulnerability | critical | 9.9 | 1% |
| CVE-2021-3879 | snipe/snipe-it | Cross-site Scripting in snipe-it | medium | 6.8 | 1% |
| CVE-2020-36171 | elementor (WordPress plugin) | The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads. | medium | 6.1 | 1% |
| CVE-2022-2925 | appwrite/server-ce | Appwrite Vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-32767 | typo3/cms, typo3/cms-core | Information Disclosure in User Authentication | medium | 5.3 | 1% |
| CVE-2023-50172 | wwbn/avideo | WWBN AVideo recovery notification bypass vulnerability | medium | 5.3 | 1% |
| CVE-2023-3553 | nilsteampassnet/teampass | TeamPass information exposure vulnerability | high | 7.5 | 1% |
| CVE-2024-2344 | avada (WordPress theme) | The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to i | high | 7.2 | 1% |
| CVE-2021-3135 | newspaper (WordPress theme) | An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php td_block_id para | medium | 6.1 | 1% |
| CVE-2024-23648 | pimcore/admin-ui-classic-bundle | Host header injection in the password reset | high | 8.8 | 1% |
| CVE-2023-38221 | magento/community-edition, magento/project-community-edition | Magento Open Source allows SQL Injection | high | 8.0 | 1% |
| CVE-2023-38249 | magento/community-edition, magento/project-community-edition | Magento Open Source allows SQL Injection | high | 8.0 | 1% |
| CVE-2023-38250 | magento/community-edition, magento/project-community-edition | Magento Open Source allows SQL Injection | high | 8.0 | 1% |
| CVE-2022-25607 | fv-wordpress-flowplayer (WordPress plugin) | Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (ver | medium | 6.6 | 1% |
| CVE-2021-24325 | seo-redirection-plugin (WordPress plugin) | The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scrip | medium | 6.1 | 1% |
| CVE-2021-24362 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a | medium | 6.1 | 1% |
| CVE-2021-24368 | quiz-and-survey-master (WordPress plugin) | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id param | medium | 6.1 | 1% |
| CVE-2021-24372 | wp-hardening (WordPress plugin) | The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before o | medium | 6.1 | 1% |
| CVE-2021-24373 | wp-hardening (WordPress plugin) | The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter befor | medium | 6.1 | 1% |
| CVE-2021-24437 | favicon-by-realfavicongenerator (WordPress plugin) | The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it ba | medium | 6.1 | 1% |
| CVE-2021-24438 | dashboard-for-google-analytics (WordPress plugin) | The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stat | medium | 6.1 | 1% |