Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-36720 | kali-forms (WordPress plugin) | The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to th | high | 7.1 | 1% |
| CVE-2021-24781 | image-source-control (WordPress plugin) | The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields o | medium | 4.3 | 1% |
| CVE-2026-55579 | pheditor/pheditor | Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise | critical | 9.8 | 1% |
| CVE-2019-18210 | moodle/moodle | Moodle Persistent Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2021-24338 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XS | medium | 5.4 | 1% |
| CVE-2022-0472 | jsdecena/laracom | Unrestricted Upload of File with Dangerous Type in jsdecena/laracom | medium | 5.4 | 1% |
| CVE-2023-30849 | pimcore/pimcore | SQL Injection in Translation Export API | high | 8.8 | 1% |
| CVE-2023-30850 | pimcore/pimcore | SQL Injection in Admin Translations API | high | 8.8 | 1% |
| CVE-2024-0869 | instant-images (WordPress plugin) | The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized | high | 8.8 | 1% |
| CVE-2024-34104 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | high | 8.2 | 1% |
| CVE-2021-4383 | wp-quick-front-end-editor (WordPress plugin) | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due | high | 8.1 | 1% |
| CVE-2024-13489 | ltl-freight-quotes-odfl-edition (WordPress plugin) | The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' p | high | 7.5 | 1% |
| CVE-2019-8090 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Arbitrary File Deletion | medium | 6.5 | 1% |
| CVE-2022-24873 | shopware/shopware | Reflected Cross-site Scripting in Shopware storefront | medium | 5.4 | 1% |
| CVE-2023-0292 | quiz-master-next (WordPress plugin) | The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is | medium | 5.4 | 1% |
| CVE-2022-35589 | forkcms/forkcms | ForkCMS XSS via `publish_on_time` parameter | medium | 4.8 | 1% |
| CVE-2024-22362 | drupal/core | Drupal Denial of Service vulnerability | medium | 0.0 | 1% |
| CVE-2022-39315 | getkirby/cms | Kirby CMS vulnerable to user enumeration in the brute force protection | medium | 6.5 | 1% |
| CVE-2021-4108 | snipe/snipe-it | snipe-it is vulnerable to Cross-site Scripting | medium | 6.4 | 1% |
| CVE-2021-4121 | yetiforce/yetiforce-crm | yetiforcecrm is vulnerable to Cross-site Scripting | medium | 6.4 | 1% |
| CVE-2021-3983 | kevinpapst/kimai2 | Cross-site Scripting in kimai2 | medium | 6.3 | 1% |
| CVE-2022-24895 | symfony/security-bundle, symfony/symfony | Symfony vulnerable to Session Fixation of CSRF tokens | medium | 6.3 | 1% |
| CVE-2018-11486 | advance-search-for-woocommerce (WordPress plugin) | An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to | medium | 6.1 | 1% |
| CVE-2021-3863 | snipe/snipe-it | Cross-site Scripting in snipe-it | medium | 5.5 | 1% |
| CVE-2024-4596 | kimai/kimai | Kimai information disclosure vulnerability | low | 3.7 | 1% |
| CVE-2023-1912 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, a | high | 7.2 | 1% |
| CVE-2019-16687 | dolibarr/dolibarr | Dolibarr Cross-site Scripting in a User Profile in a Signature section | medium | 5.4 | 1% |
| CVE-2024-10788 | aryo-activity-log (WordPress plugin) | The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters | high | 7.2 | 1% |
| CVE-2023-4140 | wp-ultimate-csv-importer (WordPress plugin) | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insuf | medium | 6.6 | 1% |
| CVE-2018-16347 | gleez/cms | Gleez CMS Vulnerable to Cross-site Scripting in media/imagecache/resize | medium | 6.1 | 1% |
| CVE-2022-1220 | foxyshop (WordPress plugin) | The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a | medium | 6.1 | 1% |
| CVE-2022-1470 | ultimate-woocommerce-csv-importer (WordPress plugin) | The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back | medium | 6.1 | 1% |
| CVE-2022-1546 | woocommerce---product-importer (WordPress plugin) | The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back i | medium | 6.1 | 1% |
| CVE-2022-1593 | site-offline-or-coming-soon (WordPress plugin) | The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lac | medium | 6.1 | 1% |
| CVE-2022-2090 | discount-rules-for-woocommerce (WordPress plugin) | The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of th | medium | 6.1 | 1% |
| CVE-2022-2173 | advanced-database-cleaner (WordPress plugin) | The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attr | medium | 6.1 | 1% |
| CVE-2022-1600 | yop-poll (WordPress plugin) | The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes | medium | 5.3 | 1% |
| CVE-2014-125091 | polls-cp (WordPress plugin) | A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unkno | medium | 4.7 | 1% |
| CVE-2024-5853 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | critical | 9.9 | 1% |
| CVE-2023-2531 | azuracast/azuracast | AzuraCast missing brute force prevention | critical | 9.8 | 1% |
| CVE-2025-11456 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file typ | critical | 9.8 | 1% |
| CVE-2024-6054 | auto-featured-image (WordPress plugin) | The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_post | high | 8.8 | 1% |
| CVE-2022-4032 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and in | high | 7.2 | 1% |
| CVE-2020-13668 | drupal/core, drupal/drupal | Cross-site Scripting in Drupal Core | medium | 6.1 | 1% |
| CVE-2019-15837 | webp-express (WordPress plugin) | The webp-express plugin before 0.14.8 for WordPress has stored XSS. | medium | 5.4 | 1% |
| CVE-2015-5338 | moodle/moodle | Moodle multiple cross-site request forgery (CSRF) vulnerabilities | high | 8.8 | 1% |
| CVE-2024-6756 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_pos | high | 8.8 | 1% |
| CVE-2025-2105 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserializati | high | 8.1 | 1% |
| CVE-2021-3989 | showdoc/showdoc | showdoc is vulnerable to URL Redirection to Untrusted Site | medium | 6.1 | 1% |
| CVE-2024-11921 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 4.8 | 1% |