Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-7246 | system-dashboard (WordPress plugin) | The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multis | medium | 5.4 | 1% |
| CVE-2025-1769 | product-import-export-for-woo (WordPress plugin) | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all | medium | 4.9 | 1% |
| CVE-2021-4355 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdeta | high | 7.5 | 1% |
| CVE-2022-34867 | wp-libre-form (WordPress plugin), libreform/libreform | Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and | high | 7.3 | 1% |
| CVE-2020-27850 | wp-premium/gravityforms | Gravity Forms stored Cross-Site Scripting (XSS) vulnerability | medium | 4.8 | 1% |
| CVE-2022-3392 | wp-humans.txt (WordPress plugin) | The WP Humans.txt WordPress plugin through 1.0.6 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2019-7889 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Injection Vulnerability | medium | 6.5 | 1% |
| CVE-2019-7904 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Insufficient Access Controls | medium | 6.5 | 1% |
| CVE-2020-13676 | drupal/core | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclo | medium | 6.5 | 1% |
| CVE-2021-3964 | elgg/elgg | elgg is vulnerable to Authorization Bypass Through User-Controlled Key | medium | 5.9 | 1% |
| CVE-2017-6213 | paypal/invoice-sdk-php | paypal/invoice-sdk-php reflected XSS | medium | 5.4 | 1% |
| CVE-2017-6215 | paypal/permissions-sdk-php | paypal/permissions-sdk-php reflected Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2018-5362 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php. | medium | 4.8 | 1% |
| CVE-2018-5364 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/option | medium | 4.8 | 1% |
| CVE-2018-5367 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php. | medium | 4.8 | 1% |
| CVE-2019-16993 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2022-38148 | silverstripe/framework | Blind SQL Injection via GridFieldSortableHeader | high | 8.8 | 1% |
| CVE-2024-13808 | xpro-addons-for-elementor (WordPress plugin) | The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via | high | 8.8 | 1% |
| CVE-2024-8922 | enquiry-quotation-for-woocommerce (WordPress plugin) | The Product Enquiry for WooCommerce, WooCommerce product catalog plugin for WordPress is vulnerable to PHP Object Injection in all versions | high | 8.8 | 1% |
| CVE-2022-44583 | watchtowerhq (WordPress plugin) | Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress. | high | 7.5 | 1% |
| CVE-2021-24883 | popup-anything (WordPress plugin) | The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with | medium | 5.4 | 1% |
| CVE-2022-1351 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 6.8 | 1% |
| CVE-2021-40693 | moodle/moodle | Moodle type juggling vulnerability | medium | 6.5 | 1% |
| CVE-2022-0893 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2022-0911 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2024-0380 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.0 via the 'icon' att | medium | 5.4 | 1% |
| CVE-2022-23980 | yet-another-stars-rating (WordPress plugin) | Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at p | medium | 4.7 | 1% |
| CVE-2026-72778 | craftcms/cms | Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass | high | 0.0 | 1% |
| CVE-2022-1749 | find-any-think (WordPress plugin) | The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function fou | high | 8.8 | 1% |
| CVE-2023-3713 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_ma | high | 8.8 | 1% |
| CVE-2023-5336 | ipanorama-360-virtual-tour-builder-lite (WordPress plugin) | The iPanorama 360 – WordPress Virtual Tour Builder plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in version | high | 8.8 | 1% |
| CVE-2023-38220 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Authorization | high | 7.5 | 1% |
| CVE-2023-6583 | import-and-export-users-and-customers (WordPress plugin) | The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1. | medium | 6.6 | 1% |
| CVE-2017-8100 | wp-copysafe-web (WordPress plugin) | There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings. | medium | 6.5 | 1% |
| CVE-2023-1430 | fluent-crm (WordPress plugin) | The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up t | medium | 6.5 | 1% |
| CVE-2023-35132 | moodle/moodle | Moodle vulnerable to SQL Injection | medium | 6.3 | 1% |
| CVE-2024-2106 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versio | medium | 5.3 | 1% |
| CVE-2024-0212 | cloudflare (WordPress plugin) | The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower priv | high | 8.1 | 1% |
| CVE-2020-12699 | directmailteam/direct-mail | Open redirect in direct_mail | medium | 6.1 | 1% |
| CVE-2021-43678 | gaoming13/wechat-php-sdk | Wechat-php-sdk is affected by a Cross Site Scripting vulnerability. | medium | 6.1 | 1% |
| CVE-2023-23927 | craftcms/cms | Craft CMS Stored Cross-site Scripting Injection Vulnerability | medium | 6.1 | 1% |
| CVE-2024-3753 | hostel (WordPress plugin) | The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 5.9 | 1% |
| CVE-2018-0577 | wp-google-map-plugin (WordPress plugin) | Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary | medium | 5.4 | 1% |
| CVE-2023-26367 | magento/community-edition, magento/project-community-edition | Magento Open Source has Improper Input Validation Vulnerability | medium | 4.9 | 1% |
| CVE-2023-0328 | wpcode (WordPress plugin) | The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. | medium | 4.3 | 1% |
| CVE-2026-63223 | codeigniter4/framework | CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules | critical | 9.8 | 1% |
| CVE-2021-27916 | mautic/core | Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder | high | 8.1 | 1% |
| CVE-2023-46823 | imagelinks (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum ImageLinks Interactive Image B | high | 7.6 | 1% |
| CVE-2023-3664 | fileorganizer (WordPress plugin) | The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full c | high | 7.2 | 1% |
| CVE-2021-24333 | content-copy-protection-\&-prevent-image-save (WordPress plugin) | The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform | medium | 6.5 | 1% |