Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-45069 | crowdsignal-dashboard (WordPress plugin) | Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress. | medium | 6.3 | 1% |
| CVE-2024-6536 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privileg | medium | 5.4 | 1% |
| CVE-2025-31692 | drupal/ai | The AI Automators module (a submodule of AI) enables you to create different automated tasks that fills out field data u | medium | 0.0 | 1% |
| CVE-2025-46001 | simogeo/filemanager | simogeo/filemanager arbitrary file upload vulnerability | critical | 9.8 | 1% |
| CVE-2021-25051 | modal-window (WordPress plugin) | The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension | high | 8.8 | 1% |
| CVE-2023-5663 | news-announcement-scroll (WordPress plugin) | The News Announcement Scroll plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including | high | 8.8 | 1% |
| CVE-2024-1893 | easy-property-listings (WordPress plugin) | The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in a | high | 8.8 | 1% |
| CVE-2024-29904 | codeigniter4/framework | CodeIgniter4 DoS Vulnerability | high | 7.5 | 1% |
| CVE-2022-31048 | typo3/cms, typo3/cms-core | Cross-Site Scripting in TYPO3's Form Framework | medium | 5.4 | 1% |
| CVE-2022-31049 | typo3/cms, typo3/cms-core | Cross-Site Scripting in TYPO3's Frontend Login Mailer | medium | 5.4 | 1% |
| CVE-2023-2178 | aajoda-testimonials (WordPress plugin) | The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 1% |
| CVE-2021-32472 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2024-0685 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection | medium | 5.9 | 1% |
| CVE-2022-40687 | creative-mail (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. | medium | 5.4 | 1% |
| CVE-2023-2159 | cmp-coming-soon-maintenance (WordPress plugin) | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A | medium | 5.3 | 1% |
| CVE-2018-16704 | gleez/cms | Gleez CMS Vulnerability Allows Forced Browsing to Profile Page of Other Users | medium | 4.3 | 1% |
| CVE-2024-6027 | themify-wc-product-filter (WordPress plugin) | The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in al | critical | 9.8 | 1% |
| CVE-2024-13418 | april (WordPress plugin), auteur (WordPress plugin), benaa (WordPress plugin) +1 more | Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFon | high | 8.8 | 1% |
| CVE-2021-24151 | wp-editor (WordPress plugin) | The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL i | high | 7.2 | 1% |
| CVE-2023-47109 | prestashop/blockreassurance | PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block | medium | 5.5 | 1% |
| CVE-2017-1000507 | austintoddj/canvas | Canvs Canvas XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2020-36699 | quick-page\/post-redirect (WordPress plugin) | The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_qu | medium | 4.3 | 1% |
| CVE-2024-4258 | yotuwp-easy-youtube-embed (WordPress plugin) | The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions u | critical | 9.8 | 1% |
| CVE-2024-0780 | enjoy-social-feed (WordPress plugin) | The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation when resetting its database, a | high | 8.8 | 1% |
| CVE-2021-24905 | advanced-cf7-db (WordPress plugin) | The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete | high | 8.0 | 1% |
| CVE-2023-0038 | survey-maker (WordPress plugin) | The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in ve | high | 7.2 | 1% |
| CVE-2017-16652 | symfony/security, symfony/security-http, symfony/symfony | Symfony Open Redirect | medium | 6.1 | 1% |
| CVE-2021-24617 | gamepress (WordPress plugin) | The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pa | medium | 6.1 | 1% |
| CVE-2021-44116 | anchorcms/anchor-cms | Cross-site Scripting in Anchor CMS | medium | 6.1 | 1% |
| CVE-2021-36875 | ulisting (WordPress plugin) | Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects | medium | 5.9 | 1% |
| CVE-2022-40044 | centreon/centreon | Centreon contains cross-site scripting vulnerability via esc_name parameter | medium | 5.4 | 1% |
| CVE-2020-25026 | derhansen/sf_event_mgt | Information Disclosure in TYPO3 extension sf_event_mgt | medium | 4.3 | 1% |
| CVE-2022-37721 | pyrocms/pyrocms | PyroCMS vulnerable to stored Cross Site Scripting | critical | 9.0 | 1% |
| CVE-2024-1685 | social-media-builder (WordPress plugin) | The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via de | high | 8.8 | 1% |
| CVE-2024-3018 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 v | high | 8.8 | 1% |
| CVE-2023-3525 | getnet-argentina-para-woocommerce (WordPress plugin) | The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' | high | 7.5 | 1% |
| CVE-2022-1323 | discy (WordPress plugin) | The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing | medium | 6.5 | 1% |
| CVE-2022-25270 | drupal/core | The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the " | medium | 6.5 | 1% |
| CVE-2023-0814 | profile-builder (WordPress plugin) | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the | medium | 6.5 | 1% |
| CVE-2024-3214 | relevanssi (WordPress plugin) | The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This make | medium | 5.8 | 1% |
| CVE-2022-2340 | w-dalil (WordPress plugin) | The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2022-2341 | simple-page-transition (WordPress plugin) | The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 1% |
| CVE-2022-3132 | goolytics (WordPress plugin) | The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to per | medium | 4.8 | 1% |
| CVE-2025-48204 | nitsan/ns-backup | The Backup Plus extension for TYPO3 (ns_backup) allows command injections | medium | 0.0 | 1% |
| CVE-2024-11103 | contest-gallery (WordPress plugin) | The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24 | critical | 9.8 | 1% |
| CVE-2024-12857 | adforest (WordPress plugin) | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plug | critical | 9.8 | 1% |
| CVE-2018-5673 | booking-calendar (WordPress plugin) | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php. | high | 8.8 | 1% |
| CVE-2024-6411 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, an | high | 8.8 | 1% |
| CVE-2022-22293 | dolibarr/dolibarr | Cross site scripting in dolibarr | medium | 5.4 | 1% |
| CVE-2025-6057 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() f | high | 8.8 | 1% |