Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-21418 | prestashop/ps_emailsubscription | Potential XSS injection in the newsletter conditions field | medium | 4.6 | 1% |
| CVE-2026-72781 | craftcms/cms | Craft CMS: Authenticated RCE through Twig sandbox escape | high | 0.0 | 1% |
| CVE-2022-38140 | seo-plugin-by-squirrly-seo (WordPress plugin) | Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress. | high | 7.6 | 1% |
| CVE-2023-0279 | media-library-assistant (WordPress plugin) | The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statemen | high | 7.2 | 1% |
| CVE-2022-0926 | microweber/microweber | Cross-site Scripting in microweber | medium | 4.8 | 1% |
| CVE-2024-8242 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing f | medium | 4.3 | 1% |
| CVE-2024-56521 | tecnickcom/tcpdf | TCPDF missing certificate validation | high | 0.0 | 1% |
| CVE-2026-49289 | simplesamlphp/saml2, simplesamlphp/saml2-legacy | SimpleSAMLphp has Possible DoS via XPath Transform | high | 7.5 | 1% |
| CVE-2022-2532 | feed-them-social (WordPress plugin) | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 1% |
| CVE-2010-3660 | typo3/cms-backend | TYPO3 is vulnerable to Cross-Site Scripting (XSS) on the backend | medium | 5.4 | 1% |
| CVE-2020-11508 | wp-lead-plus-x (WordPress plugin) | An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or re | medium | 5.4 | 1% |
| CVE-2020-35944 | pagelayer (WordPress plugin) | An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, whic | high | 8.8 | 1% |
| CVE-2025-7327 | business-reviews-wp (WordPress plugin) | The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the | high | 8.8 | 1% |
| CVE-2024-0368 | wordpress-popup (WordPress plugin) | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve | high | 8.6 | 1% |
| CVE-2023-49316 | phpseclib/phpseclib | Phpseclib needs guardrails on large binaryfield integers | high | 7.5 | 1% |
| CVE-2022-1951 | core-plugin-for-kitestudio-themes (WordPress plugin) | The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a r | medium | 6.1 | 1% |
| CVE-2015-9389 | mtouch-quiz (WordPress plugin) | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name. | medium | 5.4 | 1% |
| CVE-2016-11012 | sola-support-tickets (WordPress plugin) | The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS. | medium | 5.4 | 1% |
| CVE-2023-1427 | photo-gallery (WordPress plugin) | - The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing | medium | 4.9 | 1% |
| CVE-2021-24733 | wp-post-page-clone (WordPress plugin) | The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and p | medium | 4.3 | 1% |
| CVE-2022-2556 | mailchimp-for-woocommerce (WordPress plugin) | The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on | low | 2.7 | 1% |
| CVE-2023-6113 | wp-staging (WordPress plugin) | The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from lea | high | 7.5 | 1% |
| CVE-2022-1988 | facturascripts/facturascripts | Cross-site Scripting in FacturaScripts | medium | 6.5 | 1% |
| CVE-2020-11055 | ssddanbrown/bookstack | Cross-Site Scripting in BookStack | medium | 6.3 | 1% |
| CVE-2018-20101 | import-users-from-csv-with-meta (WordPress plugin) | The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell. | medium | 6.1 | 1% |
| CVE-2021-24873 | tutor (WordPress plugin) | The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Reg | medium | 6.1 | 1% |
| CVE-2021-24908 | check-\&-log-email (WordPress plugin) | The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a | medium | 6.1 | 1% |
| CVE-2021-24999 | booster-for-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in | medium | 6.1 | 1% |
| CVE-2021-25000 | booster-for-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back | medium | 6.1 | 1% |
| CVE-2021-25001 | booster-for-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before o | medium | 6.1 | 1% |
| CVE-2021-36885 | contact-form-cfdb7 (WordPress plugin) | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versio | medium | 6.1 | 1% |
| CVE-2021-38357 | sms-ovh (WordPress plugin) | The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file | medium | 6.1 | 1% |
| CVE-2021-38358 | moolamojo (WordPress plugin) | The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generat | medium | 6.1 | 1% |
| CVE-2021-38361 | htaccess-redirect (WordPress plugin) | The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redir | medium | 6.1 | 1% |
| CVE-2021-39309 | parsian-bank-gateway-for-woocommerce (WordPress plugin) | The Parsian Bank Gateway for Woocommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via and parameter due to a var_dum | medium | 6.1 | 1% |
| CVE-2021-39310 | real-wysiwyg (WordPress plugin) | The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file | medium | 6.1 | 1% |
| CVE-2021-39311 | link-list-manager (WordPress plugin) | The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the ~/llm.php fil | medium | 6.1 | 1% |
| CVE-2021-39313 | simple-responsive-image-gallery (WordPress plugin) | The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image- | medium | 6.1 | 1% |
| CVE-2021-39314 | woo-enviopack (WordPress plugin) | The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/ | medium | 6.1 | 1% |
| CVE-2021-39315 | magic-post-voice (WordPress plugin) | The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.ph | medium | 6.1 | 1% |
| CVE-2021-39318 | h5p-css-editor (WordPress plugin) | The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-ed | medium | 6.1 | 1% |
| CVE-2019-16685 | dolibarr/dolibarr | Dolibarr stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-0877 | ssddanbrown/bookstack | Cross-site Scripting in BookStack | medium | 5.4 | 1% |
| CVE-2022-35590 | forkcms/forkcms | ForkCMS XSS via `end_date` parameter | medium | 4.8 | 1% |
| CVE-2016-10945 | pagelines (WordPress theme) | The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF. | high | 8.8 | 1% |
| CVE-2016-10946 | wp-d3 (WordPress plugin) | The wp-d3 plugin before 2.4.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2026-54182 | backpack/crud | Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) | high | 8.1 | 1% |
| CVE-2021-39166 | pimcore/pimcore | Improper Neutralization of Text-Values in Object Version Preview | high | 8.0 | 1% |
| CVE-2024-1173 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time- | high | 7.2 | 1% |
| CVE-2022-36340 | mailoptin (WordPress plugin) | Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress. | medium | 6.5 | 1% |