Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5906 | job-manager-\&-career (WordPress plugin) | The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthoriz | high | 7.5 | 1% |
| CVE-2021-39342 | credova-financial (WordPress plugin) | The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX acti | medium | 5.3 | 1% |
| CVE-2023-4645 | ad-inserter (WordPress plugin) | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax funct | medium | 5.3 | 1% |
| CVE-2022-1514 | facturascripts/facturascripts | Cross site scripting in FacturaScripts | critical | 9.0 | 1% |
| CVE-2022-4290 | cyr3lat (WordPress plugin) | The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, an | high | 8.8 | 1% |
| CVE-2019-25140 | responsive-coming-soon (WordPress plugin) | The WordPress Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logo_width, logo | high | 7.2 | 1% |
| CVE-2025-24424 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 6.5 | 1% |
| CVE-2020-21146 | feehi/cms | Feehi CMS vulnerable to Cross-site Scripting in Username Field | medium | 6.1 | 1% |
| CVE-2020-13644 | accordions (WordPress plugin) | An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action | medium | 5.4 | 1% |
| CVE-2022-0370 | remdex/livehelperchat | Cross-site Scripting in livehelperchat | medium | 5.4 | 1% |
| CVE-2022-0957 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2026-28502 | wwbn/avideo | AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction | critical | 0.0 | 1% |
| CVE-2026-28507 | idno/known | Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal | high | 0.0 | 1% |
| CVE-2023-5132 | soisy-pagamento-rateale (WordPress plugin) | The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parse | high | 7.5 | 1% |
| CVE-2025-5061 | wp-import-export-lite (WordPress plugin) | The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_pars | high | 7.5 | 1% |
| CVE-2022-1772 | google-places-reviews (WordPress plugin) | The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site' | medium | 4.8 | 1% |
| CVE-2022-3391 | retain-live-chat (WordPress plugin) | The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-35726 | yotuwp-easy-youtube-embed (WordPress plugin) | Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress. | medium | 4.3 | 1% |
| CVE-2019-19013 | pagekit/pagekit | Pagekit File Upload vulnerability | high | 8.8 | 1% |
| CVE-2019-12950 | nilsteampassnet/teampass | TeamPass Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2025-14155 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data | medium | 5.3 | 1% |
| CVE-2021-24661 | postx---gutenberg-blocks-for-post-grid (WordPress plugin) | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor | medium | 4.3 | 1% |
| CVE-2023-22732 | shopware/core, shopware/platform | Shopware has Insufficient Session Expiration in Administration | low | 3.7 | 1% |
| CVE-2024-32871 | pimcore/pimcore | Flooding Server with Thumbnail files | high | 7.5 | 1% |
| CVE-2022-41652 | quiz-and-survey-master (WordPress plugin) | Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. | medium | 6.5 | 1% |
| CVE-2017-20058 | elefant/cms | Cross site scripting in Elefant CMS | medium | 6.1 | 1% |
| CVE-2021-20186 | moodle/moodle | Moodle Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2019-8140 | magento/community-edition, magento/product-community-edition | Magento Unrestricted file upload vulnerability | medium | 4.9 | 1% |
| CVE-2023-32075 | pimcore/customer-management-framework-bundle | Pimcore vulnerable to Business Logic Errors via Customer automation rules | medium | 4.3 | 1% |
| CVE-2026-61701 | cesargb/laravel-magiclink | MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution | high | 8.8 | 1% |
| CVE-2024-5882 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticat | high | 7.5 | 1% |
| CVE-2021-40616 | thinkcmf/thinkcmf | Incorrect Authorization in thinkcmf | medium | 6.5 | 1% |
| CVE-2021-24504 | wp-learn-manager (WordPress plugin) | The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing | medium | 6.1 | 1% |
| CVE-2019-13644 | grumpydictator/firefly-iii | Firefly III vulnerable to stored XSS | medium | 5.4 | 1% |
| CVE-2019-13645 | grumpydictator/firefly-iii | Firefly III vulnerable to stored XSS | medium | 5.4 | 1% |
| CVE-2019-13646 | grumpydictator/firefly-iii | Firefly III vulnerable to reflected cross-site scripting | medium | 5.4 | 1% |
| CVE-2019-13647 | grumpydictator/firefly-iii | Firefly III vulnerable to image-based stored XSS | medium | 5.4 | 1% |
| CVE-2022-4512 | better-font-awesome (WordPress plugin) | The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 1% |
| CVE-2023-35909 | ninja-forms (WordPress plugin) | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress le | medium | 5.3 | 1% |
| CVE-2022-4701 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX act | medium | 4.3 | 1% |
| CVE-2024-56527 | tecnickcom/tcpdf | TCPDF missing character escape on error messages | medium | 0.0 | 1% |
| CVE-2026-75594 | getkirby/cms | Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling | high | 0.0 | 1% |
| CVE-2017-8874 | mautic/core | Mautic Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2018-9108 | quickapps/cms | QuickAppsCMS Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2024-3061 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, a | high | 7.2 | 1% |
| CVE-2017-5197 | silverstripe/cms | Silverstripe CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-1411 | yetiforce/yetiforce-crm | Unrestricted Upload of File with Dangerous Type in yetiforce-crm | medium | 6.1 | 1% |
| CVE-2021-41188 | shopware/shopware | Authenticated Stored XSS in shopware/shopware | medium | 5.7 | 1% |
| CVE-2020-13864 | elementor-page-builder (WordPress plugin) | The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that r | medium | 5.4 | 1% |
| CVE-2020-13865 | elementor-page-builder (WordPress plugin) | The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create pos | medium | 5.4 | 1% |