Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24496 | community-events (WordPress plugin) | The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET para | medium | 6.1 | 1% |
| CVE-2021-24578 | sportspress (WordPress plugin) | The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events back | medium | 6.1 | 1% |
| CVE-2021-24588 | sms-alert-order-notifications (WordPress plugin) | The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerability in the plugin's se | medium | 6.1 | 1% |
| CVE-2021-24632 | recipe-card-blocks-for-gutenberg-\&-elementor (WordPress plugin) | The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin | medium | 6.1 | 1% |
| CVE-2021-24676 | better-find-and-replace (WordPress plugin) | The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Ru | medium | 6.1 | 1% |
| CVE-2021-24679 | bitcoin-\/-altcoin-payment-gateway-for-woocommerce (WordPress plugin) | The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting | medium | 6.1 | 1% |
| CVE-2021-24697 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sd | medium | 6.1 | 1% |
| CVE-2021-24798 | wp-header-images (WordPress plugin) | The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's se | medium | 6.1 | 1% |
| CVE-2021-24924 | email-log (WordPress plugin) | The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leadi | medium | 6.1 | 1% |
| CVE-2021-24932 | auto-featured-image (WordPress plugin) | The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before output | medium | 6.1 | 1% |
| CVE-2021-24939 | loginwp (WordPress plugin) | The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_ | medium | 6.1 | 1% |
| CVE-2021-24941 | icegram (WordPress plugin) | The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id paramet | medium | 6.1 | 1% |
| CVE-2021-24980 | gwolle-guestbook (WordPress plugin) | The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back | medium | 6.1 | 1% |
| CVE-2021-24984 | wpfront-user-role-editor (WordPress plugin) | The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting | medium | 6.1 | 1% |
| CVE-2021-25040 | booking-calendar (WordPress plugin) | The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an a | medium | 6.1 | 1% |
| CVE-2022-4700 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX actio | medium | 5.4 | 1% |
| CVE-2024-55637 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2021-24290 | store-locator-plus (WordPress plugin) | There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the abi | medium | 6.1 | 1% |
| CVE-2021-20183 | moodle/moodle | Moodle Vulnerable to Reflected Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-38343 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulk | medium | 4.7 | 1% |
| CVE-2023-35133 | moodle/moodle | Moodle vulnerable to Server Side Request Forgery | high | 7.5 | 1% |
| CVE-2020-36716 | wp-activity-log (WordPress plugin) | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function | high | 7.3 | 1% |
| CVE-2016-10997 | beauty-premium (WordPress theme) | The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php. | medium | 6.5 | 1% |
| CVE-2024-1982 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the | medium | 6.5 | 1% |
| CVE-2021-43808 | illuminate/view, laravel/framework | Laravel Framework XSS in Blade templating engine | medium | 6.1 | 1% |
| CVE-2021-24783 | post-expirator (WordPress plugin) | The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low | medium | 6.5 | 1% |
| CVE-2022-36020 | typo3/cms, typo3/cms-core, typo3/html-sanitizer | TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection | medium | 6.1 | 1% |
| CVE-2017-7298 | moodle/moodle | Moodle Cross-site Scripting in the Course summary filter of the Add a new course | medium | 5.4 | 1% |
| CVE-2021-28567 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability in the customers module | medium | 5.0 | 1% |
| CVE-2023-2009 | pretty-url (WordPress plugin) | Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privileg | medium | 4.8 | 1% |
| CVE-2020-25025 | localizationteam/l10nmgr | Incorrect Authorization in TYPO3 extension | medium | 4.3 | 1% |
| CVE-2023-0940 | profilegrid (WordPress plugin) | The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authoriz | high | 8.8 | 1% |
| CVE-2023-1977 | booking-manager (WordPress plugin) | The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from | high | 8.8 | 1% |
| CVE-2023-4019 | media-from-ftp (WordPress plugin) | The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileg | high | 8.8 | 1% |
| CVE-2023-1070 | nilsteampassnet/teampass | TeamPass External Control of File Name or Path vulnerability | high | 7.1 | 1% |
| CVE-2021-28055 | centreon/centreon | Predictable CSRF tokens in centreon/centreon | medium | 6.5 | 1% |
| CVE-2023-6160 | lifterlms (WordPress plugin) | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and includin | low | 3.3 | 1% |
| CVE-2022-1918 | toolbar-to-share (WordPress plugin) | The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to | high | 8.8 | 1% |
| CVE-2024-5503 | wp-blog-post-layouts (WordPress plugin) | The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes | high | 8.8 | 1% |
| CVE-2024-6753 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poste | high | 7.2 | 1% |
| CVE-2025-4857 | newsletters-lite (WordPress plugin) | The Newsletters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.9.9 via the 'file' para | high | 7.2 | 1% |
| CVE-2022-3255 | pimcore/pimcore | Pimcore vulnerable to cross site scripting | medium | 6.8 | 1% |
| CVE-2012-20001 | prestashop/prestashop | PrestaShop XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2021-24297 | goto (WordPress plugin) | The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an | medium | 6.1 | 1% |
| CVE-2021-24925 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_li | medium | 6.1 | 1% |
| CVE-2021-24938 | woocommerce-currency-switcher (WordPress plugin) | The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (avai | medium | 6.1 | 1% |
| CVE-2021-24136 | testimonials-widget (WordPress plugin) | Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Sit | medium | 5.4 | 1% |
| CVE-2022-24742 | sylius/sylius | Sensitive Information Exposure in Sylius | medium | 5.0 | 1% |
| CVE-2018-18420 | tribalsystems/zenario | Zenario CMS vulnerable to CSRF | high | 8.8 | 1% |
| CVE-2023-6967 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via shortcode in all versions up to, and incl | high | 8.8 | 1% |