Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2406 | event-registration-calendar-by-vcita (WordPress plugin), online-payments---get-paid-with-paypal\,-square-\&-stripe (WordPress plugin) | The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & St | medium | 6.4 | 1% |
| CVE-2017-1000510 | croogo/croogo | Cross site scripting in Croogo | medium | 5.4 | 1% |
| CVE-2021-36869 | add-search-to-menu (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post. | medium | 4.8 | 1% |
| CVE-2024-4875 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a mi | medium | 4.3 | 1% |
| CVE-2025-3810 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. Th | critical | 9.8 | 1% |
| CVE-2025-3811 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. Th | critical | 9.8 | 1% |
| CVE-2023-38219 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Cross-Site Scripting (XSS) | high | 8.7 | 1% |
| CVE-2025-13646 | modula-best-grid-gallery (WordPress plugin) | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip | high | 7.5 | 1% |
| CVE-2024-9422 | geo-my-wordpress (WordPress plugin), geo-my-wordpress-premium-settings (WordPress plugin) | The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploa | medium | 6.6 | 1% |
| CVE-2023-2623 | kivicare (WordPress plugin) | The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low | medium | 6.5 | 1% |
| CVE-2022-41938 | flarum/core | Cross site scripting vulnerability with discussion titles | critical | 9.0 | 1% |
| CVE-2026-33513 | wwbn/avideo | AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) | high | 8.6 | 1% |
| CVE-2024-7626 | delicious-recipes (WordPress plugin) | The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movemen | high | 8.1 | 1% |
| CVE-2025-1971 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2 | high | 7.2 | 1% |
| CVE-2015-10030 | sukohi/surpass | SUKOHI Surpass Path Traversal vulnerability | medium | 5.3 | 1% |
| CVE-2021-42546 | use-your-drive (WordPress plugin) | Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to | medium | 4.7 | 1% |
| CVE-2021-42547 | out-of-the-box (WordPress plugin) | Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to | medium | 4.7 | 1% |
| CVE-2021-42548 | share-one-drive (WordPress plugin) | Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to | medium | 4.7 | 1% |
| CVE-2021-42549 | lets-box (WordPress plugin) | Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft | medium | 4.7 | 1% |
| CVE-2022-2198 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displ | medium | 4.3 | 1% |
| CVE-2025-22145 | nesbot/carbon | Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale | medium | 0.0 | 1% |
| CVE-2022-1457 | neorazorx/facturascripts | Cross site scripting in facturascripts | critical | 9.0 | 1% |
| CVE-2019-15836 | wp-ultimate-recipe (WordPress plugin) | The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS. | medium | 5.4 | 1% |
| CVE-2022-0942 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2023-4917 | leyka (WordPress plugin) | The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_ | medium | 5.3 | 1% |
| CVE-2023-2111 | hollerbox (WordPress plugin) | The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL query without escaping i | medium | 4.9 | 1% |
| CVE-2021-25102 | all-in-one-wp-security-\&-firewall (WordPress plugin) | The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before | medium | 4.7 | 1% |
| CVE-2021-25103 | translate-wordpress-with-gtranslate (WordPress plugin) | The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtran | medium | 4.7 | 1% |
| CVE-2022-42888 | armember (WordPress plugin) | Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress. | critical | 9.8 | 1% |
| CVE-2023-4213 | simplr-registration-form (WordPress plugin) | The Simplr Registration Form Plus+ plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, | high | 8.8 | 1% |
| CVE-2024-10799 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventer_woo_downlo | medium | 6.5 | 1% |
| CVE-2022-41155 | iq-block-country (WordPress plugin) | Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress. | medium | 5.3 | 1% |
| CVE-2022-2763 | wp-socializer (WordPress plugin) | The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2021-27938 | symbiote/silverstripe-queuedjobs | XSS in CreateQueuedJobTask | medium | 0.0 | 1% |
| CVE-2026-54159 | prestashop/ps_facetedsearch | prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE | critical | 10.0 | 1% |
| CVE-2023-4239 | real-estate-manager (WordPress plugin) | The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.2 due to insufficient | high | 8.8 | 1% |
| CVE-2024-24752 | bref/bref | Bref's Uploaded Files Not Deleted in Event-Driven Functions | medium | 6.5 | 1% |
| CVE-2023-0316 | froxlor/froxlor | Froxlor is vulnerable to path traversal | medium | 5.5 | 1% |
| CVE-2021-24205 | website-builder (WordPress plugin) | In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ p | medium | 5.4 | 1% |
| CVE-2025-48951 | auth0/auth0-php | Auth0-PHP SDK Deserialization of Untrusted Data vulnerability | critical | 0.0 | 1% |
| CVE-2018-11406 | symfony/security, symfony/security-bundle, symfony/security-http +2 more | Symfony CSRF Token Fixation | high | 8.8 | 1% |
| CVE-2019-25147 | pretty-link (WordPress plugin) | The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in v | high | 7.2 | 1% |
| CVE-2022-3511 | awesome-support (WordPress plugin) | The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user mak | medium | 6.5 | 1% |
| CVE-2022-3961 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system | medium | 6.5 | 1% |
| CVE-2013-10030 | wordpress-exit-box-lite (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue | medium | 4.3 | 1% |
| CVE-2019-16768 | sylius/sylius | Internal exception message exposure for login action in Sylius | low | 3.5 | 1% |
| CVE-2025-27515 | laravel/framework | Laravel has a File Validation Bypass | medium | 0.0 | 1% |
| CVE-2023-29432 | houzez (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPr | high | 8.2 | 1% |
| CVE-2020-15263 | orchid/platform | Inline attribute values were not processed. | high | 8.0 | 1% |
| CVE-2021-24147 | modern-events-calendar-lite (WordPress plugin) | Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise | medium | 5.4 | 1% |