Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2092 | woocommerce-pdf-invoices\&-packing-slips (WordPress plugin) | The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possib | medium | 6.1 | 1% |
| CVE-2022-35585 | forkcms/forkcms | ForkCMS stored XSS via `start_date` parameter | medium | 4.8 | 1% |
| CVE-2024-13789 | ravpage (WordPress plugin) | The ravpage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.31 via deserialization of unt | critical | 9.8 | 1% |
| CVE-2022-0253 | remdex/livehelperchat | livehelperchat is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-5359 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google O | low | 3.7 | 1% |
| CVE-2023-6294 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with th | high | 7.2 | 1% |
| CVE-2024-40400 | automad/automad | Automad arbitrary file upload vulnerability | medium | 6.8 | 1% |
| CVE-2024-51058 | tecnickcom/tcpdf | TCPDF Local File Inclusion vulnerability | medium | 6.2 | 1% |
| CVE-2022-0737 | text-hover (WordPress plugin) | The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform | medium | 4.8 | 1% |
| CVE-2021-28661 | silverstripe/graphql | SilverStripe GraphQL Server permission checker not inherited by query subclass. | medium | 4.3 | 1% |
| CVE-2024-9488 | wpdiscuz (WordPress plugin) | The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is du | critical | 9.8 | 1% |
| CVE-2024-5450 | bug-library (WordPress plugin) | The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user t | critical | 9.1 | 1% |
| CVE-2017-16880 | filp/whoops | filp whoops Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2018-8071 | mautic/core | XSS vulnerability in theme config file in Mautic | medium | 6.1 | 1% |
| CVE-2023-0377 | scriptless-social-sharing (WordPress plugin) | The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them ba | medium | 5.4 | 1% |
| CVE-2019-8123 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Insufficient Logging | medium | 5.3 | 1% |
| CVE-2022-2080 | sensei-lms (WordPress plugin) | The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original send | medium | 4.3 | 1% |
| CVE-2024-41637 | billz/raspap-webgui | RaspAP allows an attacker to escalate privileges | critical | 9.9 | 1% |
| CVE-2018-25105 | wp-file-manager (WordPress plugin) | The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in | critical | 9.8 | 1% |
| CVE-2024-5637 | market-exporter (WordPress plugin) | The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' | high | 7.5 | 1% |
| CVE-2020-14475 | dolibarr/dolibarr | Dolibarr reflected cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2021-24923 | newsletter\,-smtp\,-email-marketing-and-subscribe (WordPress plugin) | The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-da | medium | 6.1 | 1% |
| CVE-2021-25024 | eventcalendar (WordPress plugin) | The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflect | medium | 6.1 | 1% |
| CVE-2024-3213 | relevanssi (WordPress plugin) | The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o | medium | 5.3 | 1% |
| CVE-2021-4222 | wp-paginate (WordPress plugin) | The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin | medium | 4.8 | 1% |
| CVE-2020-13641 | real-time-find-and-replace (WordPress plugin) | An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any no | high | 8.8 | 1% |
| CVE-2020-13642 | siteorigin-panels (WordPress plugin) | An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do a | high | 8.8 | 1% |
| CVE-2020-13643 | siteorigin-panels (WordPress plugin) | An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce ver | high | 8.8 | 1% |
| CVE-2023-4006 | thorsten/phpmyfaq | phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability | high | 8.8 | 1% |
| CVE-2024-10079 | easy-post-types (WordPress plugin) | The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserializatio | high | 8.8 | 1% |
| CVE-2023-38489 | getkirby/cms | Insufficient Session Expiration after a password change | high | 7.3 | 1% |
| CVE-2022-0945 | showdoc/showdoc | Stored Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2021-24819 | page\/post-content-shortcode (WordPress plugin) | The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low | medium | 4.3 | 1% |
| CVE-2021-24859 | user-meta-shortcodes (WordPress plugin) | The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access | medium | 4.3 | 1% |
| CVE-2022-3994 | authenticator (WordPress plugin) | The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other | medium | 4.3 | 1% |
| CVE-2021-33563 | phanan/koel | Improper rate limiting in Koel | high | 0.0 | 1% |
| CVE-2022-3359 | shortcodes-and-extra-features-for-phlox-theme (WordPress plugin) | The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could l | high | 8.8 | 1% |
| CVE-2022-3981 | email-subscribers-\&-newsletters (WordPress plugin) | The Icegram Express WordPress plugin before 5.5.1 does not properly sanitise and escape a parameter before using it in a SQL statement, lead | high | 8.8 | 1% |
| CVE-2026-79774 | winter/wn-system-module | Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149) | high | 8.4 | 1% |
| CVE-2023-27560 | phpseclib/phpseclib | phpseclib Infinite Loop vulnerability | high | 7.5 | 1% |
| CVE-2021-4107 | yetiforce/yetiforce-crm | yetiforcecrm is vulnerable to Cross-site Scripting | medium | 5.3 | 1% |
| CVE-2022-1684 | cube-slider (WordPress plugin) | The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, lea | low | 2.7 | 1% |
| CVE-2022-1686 | five-minute-webshop (WordPress plugin) | The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when | low | 2.7 | 1% |
| CVE-2022-1687 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement v | low | 2.7 | 1% |
| CVE-2022-1688 | note-press (WordPress plugin) | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via th | low | 2.7 | 1% |
| CVE-2022-1689 | note-press (WordPress plugin) | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when upd | low | 2.7 | 1% |
| CVE-2022-1690 | note-press (WordPress plugin) | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL stateme | low | 2.7 | 1% |
| CVE-2021-41258 | getkirby/cms | Cross-site scripting (XSS) from image block content in the site frontend | medium | 5.4 | 1% |
| CVE-2022-4702 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX actio | medium | 5.4 | 1% |
| CVE-2022-4704 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action i | medium | 5.4 | 1% |