Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1773 | wp-athletics (WordPress plugin) | The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to | medium | 6.1 | 1% |
| CVE-2022-22734 | simple-quotation (WordPress plugin) | The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and esca | medium | 6.1 | 1% |
| CVE-2024-11360 | page-parts (WordPress plugin) | The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate e | medium | 6.1 | 1% |
| CVE-2022-0825 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update oth | medium | 5.4 | 1% |
| CVE-2021-4146 | pimcore/pimcore | Business Logic Errors in pimcore | medium | 4.3 | 1% |
| CVE-2019-15769 | handl-utm-grabber (WordPress plugin) | The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option. | high | 8.8 | 1% |
| CVE-2022-21651 | shopware/shopware | Open redirect in shopware | medium | 6.8 | 1% |
| CVE-2018-5284 | imageinject (WordPress plugin) | The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php. | medium | 4.8 | 1% |
| CVE-2022-1425 | wpqa-builder (WordPress plugin) | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message | medium | 4.3 | 1% |
| CVE-2026-52778 | yeswiki/yeswiki | YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service | critical | 9.8 | 1% |
| CVE-2023-0895 | wp-coder (WordPress plugin) | The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in ver | high | 7.2 | 1% |
| CVE-2025-62519 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality | high | 7.2 | 1% |
| CVE-2022-36102 | shopware/shopware | Shopware access control list bypassed via crafted specific URLs | medium | 6.3 | 1% |
| CVE-2021-36901 | age-gate (WordPress plugin) | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress. | medium | 6.1 | 1% |
| CVE-2023-2237 | wp-replicate-post (WordPress plugin) | The WP Replicate Post plugin for WordPress is vulnerable to SQL Injection via the post_id parameter in versions up to, and including, 4.0.2 | high | 8.8 | 1% |
| CVE-2023-29200 | contao/contao, contao/core-bundle | Path traversal vulnerability in the file manager | high | 8.8 | 1% |
| CVE-2023-3677 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and incl | high | 8.8 | 1% |
| CVE-2025-24438 | magento/community-edition, magento/project-community-edition | Magento stored Cross-Site Scripting (XSS) vulnerability | high | 8.7 | 1% |
| CVE-2022-4794 | amazon-affiliate-wordpress-plugin (WordPress plugin) | The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Downl | high | 7.5 | 1% |
| CVE-2024-13479 | ltl-freight-quotes-sefl-edition (WordPress plugin) | The LTL Freight Quotes – SEFL Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameter | high | 7.5 | 1% |
| CVE-2024-13483 | ltl-freight-quotes-saia-edition (WordPress plugin) | The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameter | high | 7.5 | 1% |
| CVE-2019-25146 | delucks-seo (WordPress plugin) | The DELUCKS SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saveSettings() function that had no capability che | high | 7.2 | 1% |
| CVE-2021-4369 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. Th | medium | 5.8 | 1% |
| CVE-2019-14785 | cp-contact-form-with-paypal (WordPress plugin) | The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_con | medium | 5.4 | 1% |
| CVE-2026-1194 | mineadmin/mineadmin | MineAdmin May Expose Sensitive Information to an Unauthorized Actor | medium | 5.3 | 1% |
| CVE-2021-21283 | flarum/sticky | XSS in Flarum Sticky extension | medium | 0.0 | 1% |
| CVE-2021-24162 | responsive-menu (WordPress plugin) | In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importi | high | 8.8 | 1% |
| CVE-2022-2083 | simple-sign-on (WordPress plugin) | The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorize | high | 7.5 | 1% |
| CVE-2024-43436 | moodle/moodle | Moodle vulnerable to site administration SQL injection via XMLDB editor | high | 7.2 | 1% |
| CVE-2021-4332 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2. | medium | 6.5 | 1% |
| CVE-2022-31109 | laminas/laminas-diactoros | Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack | medium | 6.1 | 1% |
| CVE-2019-14681 | deny-all-firewall (WordPress plugin) | The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF. | high | 8.8 | 1% |
| CVE-2019-15828 | one-click-ssl (WordPress plugin) | The one-click-ssl plugin before 1.4.7 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15832 | visitors-traffic-real-time-statistics (WordPress plugin) | The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-4379 | woocommerce-multi-currency (WordPress plugin) | The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_ | medium | 6.5 | 1% |
| CVE-2023-1426 | wp-tiles (WordPress plugin) | The WP Tiles WordPress plugin through 1.1.2 does not ensure that posts to be displayed are not draft/private, allowing any authenticated use | medium | 6.5 | 1% |
| CVE-2023-30855 | pimcore/pimcore | Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php | medium | 6.5 | 1% |
| CVE-2018-11485 | woocommerce-quick-reports (WordPress plugin) | The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject | medium | 6.1 | 1% |
| CVE-2022-0321 | wp-voting-contest (WordPress plugin) | The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the respon | medium | 6.1 | 1% |
| CVE-2022-0327 | master-addons-for-elementor (WordPress plugin) | The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it | medium | 6.1 | 1% |
| CVE-2015-8756 | typo3/cms | TYPO3 CMS indexed search Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2018-18373 | support-board---chat-and-help-desk (WordPress plugin) | In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file uplo | medium | 5.4 | 1% |
| CVE-2023-38871 | gugoan/economizzer | Economizzer user enumeration vulnerability | medium | 5.3 | 1% |
| CVE-2023-6777 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and inc | medium | 5.3 | 1% |
| CVE-2023-2496 | go-pricing (WordPress plugin) | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an imp | high | 7.1 | 1% |
| CVE-2020-27851 | wp-premium/gravityforms | Gravity Forms stored HTML injection vulnerability | medium | 5.4 | 1% |
| CVE-2020-27852 | wp-premium/gravityforms | Gravity Forms stored Cross-Site Scripting (XSS) vulnerability in the survey feature | medium | 5.4 | 1% |
| CVE-2021-24824 | custom-content-shortcode (WordPress plugin) | The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as lo | medium | 4.3 | 1% |
| CVE-2024-8614 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch | critical | 9.9 | 1% |
| CVE-2022-25377 | appwrite/server-ce | Appwrite Directory Traversal vulnerability | high | 7.5 | 1% |