Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24626 | chameleon-css (WordPress plugin) | The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticate | high | 8.8 | 1% |
| CVE-2020-36712 | kali-forms (WordPress plugin) | The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This i | high | 8.6 | 1% |
| CVE-2025-43960 | vrana/adminer | Adminer PHP Object Injection issue leads to Denial of Service | high | 8.6 | 1% |
| CVE-2023-3958 | wp-remote-users-sync (WordPress plugin) | The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in ver | high | 8.5 | 1% |
| CVE-2026-49286 | pontedilana/php-weasyprint | PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass) | high | 8.1 | 1% |
| CVE-2023-5454 | templately (WordPress plugin) | The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticate | high | 7.5 | 1% |
| CVE-2021-32713 | shopware/shopware | Cross-site scripting | medium | 4.8 | 1% |
| CVE-2025-3604 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2. | critical | 9.8 | 1% |
| CVE-2024-1206 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up to, and including, 9. | high | 8.8 | 1% |
| CVE-2026-54540 | pheditor/pheditor | Pheditor has an authenticated terminal command whitelist bypass | high | 8.8 | 1% |
| CVE-2024-24570 | statamic/cms | Statmic CMS vulnerable to account takeover via XSS and password reset link | high | 8.2 | 1% |
| CVE-2021-36395 | moodle/moodle | Moodle vulnerable to Uncontrolled Resource Consumption | high | 7.5 | 1% |
| CVE-2023-26015 | mappress (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Chris Richardson MapPress Maps for Wor | high | 7.1 | 1% |
| CVE-2023-3125 | b2bking (WordPress plugin) | The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'b2bking_save_p | medium | 6.5 | 1% |
| CVE-2023-3139 | protect-wp-admin (WordPress plugin) | The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the prot | medium | 6.1 | 1% |
| CVE-2017-1000467 | lavalite/cms | Stored XSS in LavaLite 5.2.4 | medium | 5.4 | 1% |
| CVE-2023-0581 | privatecontent (WordPress plugin) | The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up | medium | 5.3 | 1% |
| CVE-2024-8791 | charitable (WordPress plugin) | The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege esc | critical | 9.8 | 1% |
| CVE-2023-2229 | rduplicator (WordPress plugin) | The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 2.0 due | high | 8.8 | 1% |
| CVE-2026-54721 | silverstripe/userforms | silverstripe/userforms vulnerable to remote code execution via userforms email subject | high | 8.8 | 1% |
| CVE-2024-11036 | gamipress (WordPress plugin) | The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerabl | high | 7.3 | 1% |
| CVE-2011-1762 | WordPress core | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This | medium | 6.5 | 1% |
| CVE-2021-32470 | craftcms/cms | Craft CMS Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2018-14835 | intelliants/subrion | Subrion CMS XSS | medium | 5.4 | 1% |
| CVE-2019-20789 | croogo/croogo | Croos-site scripting in Croogo | medium | 4.8 | 1% |
| CVE-2016-10944 | multisite-post-duplicator (WordPress plugin) | The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF. | high | 8.8 | 1% |
| CVE-2016-10974 | fluid-responsive-slideshow (WordPress plugin) | The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS. | high | 8.8 | 1% |
| CVE-2016-10982 | kento-post-view-counter (WordPress plugin) | The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF. | high | 8.8 | 1% |
| CVE-2023-36508 | contact-form-to-db (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by Best | high | 7.6 | 1% |
| CVE-2023-44769 | tribalsystems/zenario | Zenario CMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-4033 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, | medium | 5.3 | 1% |
| CVE-2023-0441 | simply-gallery-blocks-with-lightbox (WordPress plugin) | The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as | high | 8.1 | 1% |
| CVE-2022-2565 | simple-payment-donations-\&-subscriptions (WordPress plugin) | The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which | high | 7.2 | 1% |
| CVE-2022-23500 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Denial of Service in Page Error Handling | medium | 5.9 | 1% |
| CVE-2021-20681 | baserproject/basercms | Cross-site Scripting (XSS) in baserCMS | medium | 5.4 | 1% |
| CVE-2021-20683 | baserproject/basercms | Cross-site Scripting (XSS) in baserCMS | medium | 5.4 | 1% |
| CVE-2021-4117 | yetiforce/yetiforce-crm | YetiForceCRM is vulnerable to Business Logic Errors in the weight of a product | medium | 4.3 | 1% |
| CVE-2021-4194 | ssddanbrown/bookstack | bookstack is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2022-1209 | ultimate-member (WordPress plugin) | The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social | medium | 4.3 | 1% |
| CVE-2023-32121 | zero-spam-for-wordpress (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Highfivery LLC Zero Spam for WordPress | high | 7.6 | 1% |
| CVE-2021-4345 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole:: | medium | 6.5 | 1% |
| CVE-2021-44565 | francoisjacquet/rosariosis | Cross site scripting in francoisjacquet/rosariosis | medium | 5.4 | 1% |
| CVE-2025-49559 | magento/community-edition, magento/project-community-edition | Magento vulnerable to path traversal | medium | 5.3 | 1% |
| CVE-2019-7925 | magento/community-edition, magento/product-community-edition | Magento Insecure Direct Object Reference (IDOR) vulnerability | medium | 4.9 | 1% |
| CVE-2018-18943 | baserproject/basercms | XSS in baserCMS before 4.1.4 | medium | 4.8 | 1% |
| CVE-2021-4388 | opal-estate (WordPress plugin) | The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due | medium | 4.3 | 1% |
| CVE-2023-3063 | sp-client-document-manager (WordPress plugin) | The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, | high | 8.8 | 1% |
| CVE-2023-35911 | contact-form-generator (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creative Solutions Contact Form Genera | high | 8.5 | 1% |
| CVE-2023-0688 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions | medium | 6.5 | 1% |
| CVE-2020-11512 | idx-broker-platinum (WordPress plugin) | Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permis | medium | 5.4 | 1% |