Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-10772 | enshrined/svg-sanitize | Sanitizer bypass in svg-sanitizer | medium | 6.1 | 1% |
| CVE-2023-4635 | eventon-lite (WordPress plugin) | The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2 | medium | 6.1 | 1% |
| CVE-2020-8799 | wti-like-post (WordPress plugin) | A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the admin | medium | 4.8 | 1% |
| CVE-2022-0969 | image-optimization-\&-lazy-load-by-optimole (WordPress plugin) | The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images fo | medium | 4.8 | 1% |
| CVE-2022-4109 | wholesale-market-for-woocommerce (WordPress plugin) | The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing hig | low | 2.7 | 1% |
| CVE-2026-42845 | getgrav/grav-plugin-form | Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override | high | 0.0 | 1% |
| CVE-2019-17237 | igniteup (WordPress plugin) | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF. | high | 8.8 | 1% |
| CVE-2023-48764 | guardgiant (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection Word | high | 7.6 | 1% |
| CVE-2022-2440 | theme-editor (WordPress plugin) | The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to | high | 7.2 | 1% |
| CVE-2024-22208 | phpmyfaq/phpmyfaq | phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes | medium | 6.5 | 1% |
| CVE-2021-35210 | contao/contao, contao/core-bundle | Cross site scripting in the system log | medium | 6.1 | 1% |
| CVE-2022-0698 | microweber/microweber | Microweber vulnerable to cross-site scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-45150 | moodle/moodle | Moodle reflected cross-site scripting vulnerability in policy tool | medium | 6.1 | 1% |
| CVE-2020-20626 | lara\'s-google-analytics (WordPress plugin) | lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS. | medium | 5.4 | 1% |
| CVE-2023-29294 | magento/community-edition, magento/project-community-edition | Magento Open Source has Business Logic Errors Vulnerability | medium | 4.3 | 1% |
| CVE-2023-44394 | mantisbt/mantisbt | MantisBT may disclose project names to unauthorized users | medium | 4.3 | 1% |
| CVE-2024-6847 | chatbot-with-chatgpt (WordPress plugin) | The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, | critical | 9.8 | 1% |
| CVE-2017-18521 | democracy-poll (WordPress plugin) | The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n. | high | 8.8 | 1% |
| CVE-2023-5098 | campaign-monitor-optin-cat (WordPress plugin) | The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from ove | high | 8.1 | 1% |
| CVE-2020-11069 | typo3/cms, typo3/cms-core | Backend Same-Site Request Forgery in TYPO3 CMS | high | 8.0 | 1% |
| CVE-2026-8134 | concrete5/concrete5 | Concrete CMS Vulnerable to Relative Path Traversal | high | 7.2 | 1% |
| CVE-2022-3245 | microweber/microweber | Microweber vulnerable to HTML Injection in create tag functionality | medium | 6.1 | 1% |
| CVE-2022-2775 | fastflow (WordPress plugin) | The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege user | medium | 5.5 | 1% |
| CVE-2023-24410 | contact-form (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Conta | medium | 5.5 | 1% |
| CVE-2023-3083 | nilsteampassnet/teampass | TeamPass vulnerable to stored Cross-site Scripting | high | 8.7 | 1% |
| CVE-2024-47053 | mautic/core | Mautic allows Improper Authorization in Reporting API | high | 7.7 | 1% |
| CVE-2019-7858 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Cryptographic Flaw | high | 7.5 | 1% |
| CVE-2023-1809 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to downl | high | 7.5 | 1% |
| CVE-2024-13593 | bmlt-meeting-map (WordPress plugin) | The BMLT Meeting Map plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.0 via the 'bmlt_me | high | 7.5 | 1% |
| CVE-2023-5566 | smpl-shortcodes (WordPress plugin) | The Simple Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.0 | medium | 6.4 | 1% |
| CVE-2022-4697 | wp-user-avatar (WordPress plugin) | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in ve | medium | 5.5 | 1% |
| CVE-2022-23807 | phpmyadmin/phpmyadmin | Improper Authentication in phpmyadmin | medium | 4.3 | 1% |
| CVE-2023-4374 | wp-remote-users-sync (WordPress plugin) | The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability | medium | 4.3 | 1% |
| CVE-2019-15831 | visitors-traffic-real-time-statistics (WordPress plugin) | The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. | high | 8.8 | 1% |
| CVE-2024-44313 | tastyigniter/tastyigniter | TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function | high | 8.1 | 1% |
| CVE-2024-8271 | woocommerce-currency-switcher (WordPress plugin) | The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all vers | high | 7.3 | 1% |
| CVE-2024-7620 | customizer-export-import (WordPress plugin) | The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_impor | medium | 6.6 | 1% |
| CVE-2023-1524 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a | medium | 6.5 | 1% |
| CVE-2022-2190 | envira-gallery (WordPress plugin) | The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an | medium | 6.1 | 1% |
| CVE-2021-32477 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2022-2369 | yaysmtp (WordPress plugin) | The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber | medium | 4.3 | 1% |
| CVE-2023-22733 | shopware/core, shopware/platform | Shopware's log module vulnerable to Improper Output Neutralization | low | 2.7 | 1% |
| CVE-2020-5220 | sylius/resource-bundle, sylius/sylius | CVE-2020-5220: Ability to define unintended serialisation groups via HTTP header which might lead to data exposure | unknown | 0.0 | 1% |
| CVE-2021-37710 | shopware/core, shopware/platform | Cross-Site Scripting via SVG media files | high | 8.0 | 1% |
| CVE-2019-15869 | jobcareer (WordPress theme) | The JobCareer theme before 2.5.1 for WordPress has stored XSS. | medium | 5.4 | 1% |
| CVE-2019-15870 | carspot (WordPress theme) | The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field. | medium | 5.4 | 1% |
| CVE-2022-0956 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2022-42883 | quiz-and-survey-master (WordPress plugin) | Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress. | medium | 5.3 | 1% |
| CVE-2017-20206 | appointments (WordPress plugin) | The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of u | critical | 9.8 | 1% |
| CVE-2017-20207 | flickr-gallery (WordPress plugin) | The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of | critical | 9.8 | 1% |