Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0402 | social-warfare (WordPress plugin) | The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in v | medium | 5.4 | 1% |
| CVE-2024-5085 | hash-form (WordPress plugin) | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1. | high | 8.1 | 1% |
| CVE-2017-6379 | drupal/core, drupal/drupal | Drupal Cross-Site Request Forgery (CSRF) | high | 7.5 | 1% |
| CVE-2022-3912 | user-registration (WordPress plugin) | The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to bo | high | 7.5 | 1% |
| CVE-2017-12068 | event-list (WordPress plugin) | The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk ac | medium | 6.1 | 1% |
| CVE-2017-12131 | easy-testimonials (WordPress plugin) | The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonial | medium | 6.1 | 1% |
| CVE-2017-17869 | mgl-instagram-gallery (WordPress plugin) | The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter. | medium | 6.1 | 1% |
| CVE-2018-5655 | pinterest-feeds (WordPress plugin) | An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security para | medium | 6.1 | 1% |
| CVE-2018-6001 | soundy-audio-playlist (WordPress plugin) | The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war | medium | 6.1 | 1% |
| CVE-2018-6002 | soundy-background-music (WordPress plugin) | The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php | medium | 6.1 | 1% |
| CVE-2021-4081 | pimcore/pimcore | pimcore is vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2021-3846 | grumpydictator/firefly-iii | Unrestricted File Upload vulnerability in Firefly III | high | 8.8 | 1% |
| CVE-2021-4358 | wp-dsgvo-tools (WordPress plugin) | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and | high | 7.2 | 1% |
| CVE-2016-2562 | phpmyadmin/phpmyadmin | phpMyAdmin Improper Input Validation | medium | 6.8 | 1% |
| CVE-2018-20155 | wp-maintenance-mode (WordPress plugin) | The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restriction | medium | 4.3 | 1% |
| CVE-2026-52762 | yeswiki/yeswiki | YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates | high | 0.0 | 1% |
| CVE-2023-34620 | laktak/hjson | hjson stack exhaustion vulnerability | high | 7.5 | 1% |
| CVE-2022-1788 | change-uploaded-file-permissions (WordPress plugin) | Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to | medium | 6.5 | 1% |
| CVE-2023-0772 | optinmonster (WordPress plugin) | The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actua | medium | 6.5 | 1% |
| CVE-2019-14946 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. | medium | 5.4 | 1% |
| CVE-2020-9334 | envira-gallery-lite (WordPress plugin) | A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerabil | medium | 5.4 | 1% |
| CVE-2021-31274 | librenms/librenms | Cross-site Scripting in LibreNMS | medium | 5.4 | 1% |
| CVE-2020-12698 | directmailteam/direct-mail | Missing Authorization in TYPO3 extension | medium | 4.3 | 1% |
| CVE-2020-12700 | directmailteam/direct-mail | Missing Authorization in TYPO3 extension | medium | 4.3 | 1% |
| CVE-2022-0287 | mycred (WordPress plugin) | The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing an | medium | 4.3 | 1% |
| CVE-2021-24242 | tutor-lms (WordPress plugin) | The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability throu | low | 3.8 | 1% |
| CVE-2023-46240 | codeigniter4/framework | CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment | high | 7.5 | 1% |
| CVE-2023-38873 | gugoan/economizzer | Economizzer vulnerable to Clickjacking | medium | 6.5 | 1% |
| CVE-2022-1445 | snipe/snipe-it | Stored cross-site scripting in Snipe-IT | medium | 5.4 | 1% |
| CVE-2020-36710 | wps-hide-login (WordPress plugin) | The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the logi | medium | 5.3 | 1% |
| CVE-2022-44634 | import-shopify-to-woocommerce (WordPress plugin) | Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress. | medium | 4.9 | 1% |
| CVE-2026-114509 | laravel/framework | Laravel TokenGuard authentication bypass through non-string API credentials | critical | 0.0 | 1% |
| CVE-2023-6203 | the-events-calendar (WordPress plugin) | The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted | high | 7.5 | 1% |
| CVE-2022-0889 | ninja-forms-file-uploads (WordPress plugin) | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the | high | 7.2 | 1% |
| CVE-2020-35589 | limit-login-attempts-reloaded (WordPress plugin) | The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. | medium | 5.4 | 1% |
| CVE-2022-2924 | yetiforce/yetiforce-crm | YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module | medium | 5.4 | 1% |
| CVE-2023-0585 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and inc | medium | 4.4 | 1% |
| CVE-2024-13421 | real-estate-7 (WordPress plugin) | The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is d | critical | 9.8 | 1% |
| CVE-2026-48062 | codeigniter4/framework | CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule | critical | 9.8 | 1% |
| CVE-2024-7258 | wp-product-feed-manager (WordPress plugin) | The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the | high | 8.8 | 1% |
| CVE-2024-58381 | pocketmine/pocketmine-mp | PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time) | high | 7.5 | 1% |
| CVE-2023-2841 | advanced-local-pickup-for-woocommerce (WordPress plugin) | The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up | high | 7.2 | 1% |
| CVE-2017-7723 | easy-wp-smtp (WordPress plugin) | XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body. | medium | 6.1 | 1% |
| CVE-2019-16686 | dolibarr/dolibarr | Dolibarr Cross-site Scripting in a User Note section | medium | 5.4 | 1% |
| CVE-2019-16688 | dolibarr/dolibarr | Dolibarr stored Cross-site Scripting in an Email Template section | medium | 5.4 | 1% |
| CVE-2021-24473 | user-profile-picture (WordPress plugin) | The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by de | medium | 5.4 | 1% |
| CVE-2021-34650 | smart-id (WordPress plugin) | The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which al | medium | 5.4 | 1% |
| CVE-2020-28649 | orbisius-child-theme-creator (WordPress plugin) | The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file. | high | 8.8 | 1% |
| CVE-2024-11816 | wpextended (WordPress plugin) | The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a | high | 8.8 | 1% |
| CVE-2021-37709 | shopware/core, shopware/platform | Insecure direct object reference of log files of the Import/Export feature | medium | 6.5 | 1% |