Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1938 | awin-data-feed (WordPress plugin) | The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, all | medium | 5.4 | 1% |
| CVE-2025-47110 | magento/community-edition | Magneto contains stored XSS vulnerability | critical | 9.1 | 1% |
| CVE-2024-48917 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet's XLSX reader | high | 7.5 | 1% |
| CVE-2020-35943 | nextgen-gallery (WordPress plugin) | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to by | medium | 6.5 | 1% |
| CVE-2021-24282 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJA | medium | 6.3 | 1% |
| CVE-2017-15812 | easy-appointments (WordPress plugin) | The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel. | medium | 6.1 | 1% |
| CVE-2020-36722 | visual-composer-website-builder (WordPress plugin) | The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 due to insufficient in | medium | 5.5 | 1% |
| CVE-2022-0278 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2021-24794 | connections-business-directory (WordPress plugin) | The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could a | medium | 4.8 | 1% |
| CVE-2022-4746 | fluentauth (WordPress plugin) | The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, wh | high | 7.5 | 1% |
| CVE-2023-28788 | advanced-page-visit-counter (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit | high | 7.1 | 1% |
| CVE-2024-5481 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and i | medium | 6.8 | 1% |
| CVE-2024-45132 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 6.5 | 1% |
| CVE-2021-32768 | typo3/cms, typo3/cms-core | Cross-Site Scripting via Rich-Text Content | medium | 6.1 | 1% |
| CVE-2022-29711 | librenms/librenms | Cross site scripting in librenms | medium | 6.1 | 1% |
| CVE-2025-4602 | store-manager-connector (WordPress plugin) | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, | medium | 5.9 | 1% |
| CVE-2023-28821 | concrete5/concrete5 | Missing rate limit for password resets | medium | 5.3 | 1% |
| CVE-2021-20184 | moodle/moodle | Moodle Grade information disclosure in grade's external fetch functions | medium | 4.3 | 1% |
| CVE-2026-84372 | predis/predis | Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections | critical | 9.8 | 1% |
| CVE-2024-7982 | registrations-for-the-events-calendar (WordPress plugin) | The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event | critical | 9.6 | 1% |
| CVE-2018-5285 | imageinject (WordPress plugin) | The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2021-24809 | bp-better-messages (WordPress plugin) | The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_ch | high | 8.8 | 1% |
| CVE-2024-22027 | quiz-maker (WordPress plugin) | Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a | medium | 6.5 | 1% |
| CVE-2021-24474 | awesome-weather-widget (WordPress plugin) | The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesome_weather_refresh AJAX action, lea | medium | 6.1 | 1% |
| CVE-2021-24560 | software-license-manager (WordPress plugin) | The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back i | medium | 6.1 | 1% |
| CVE-2019-8118 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Weak Cryptography | medium | 5.3 | 1% |
| CVE-2022-1613 | restricted-site-access (WordPress plugin) | The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR | medium | 5.3 | 1% |
| CVE-2014-125051 | himiklab/yii2-jqgrid-widget | himiklab yii2-jqgrid-widget vulnerable to SQL Injection | critical | 9.8 | 1% |
| CVE-2017-20157 | arc/web | Ariadne Component Library vulnerable to Server-Side Request Forgery | critical | 9.8 | 1% |
| CVE-2024-1170 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | high | 8.2 | 1% |
| CVE-2025-3419 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versio | high | 7.5 | 1% |
| CVE-2019-14272 | silverstripe/framework | SilverStripe asset-admin Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2023-30848 | pimcore/pimcore | SQL Injection in Admin Search Find API | high | 8.8 | 1% |
| CVE-2020-26227 | typo3/cms, typo3/cms-core | Cross-Site Scripting in Fluid view helpers | medium | 6.1 | 1% |
| CVE-2023-1753 | thorsten/phpmyfaq | phpMyFAQ has weak password requirements | medium | 5.5 | 1% |
| CVE-2018-0578 | pixelyoursite (WordPress plugin) | Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary | medium | 5.4 | 1% |
| CVE-2022-1563 | wpgraphql (WordPress plugin) | The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes a | medium | 5.3 | 1% |
| CVE-2022-2267 | mailchimp-for-woocommerce (WordPress plugin) | The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perfo | medium | 4.3 | 1% |
| CVE-2015-8371 | composer/composer | Composer allows cache poisoning from other projects built on the same host | high | 8.8 | 1% |
| CVE-2022-4935 | wc-multivendor-marketplace (WordPress plugin) | The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3. | high | 8.8 | 1% |
| CVE-2013-10023 | editorial-calendar (WordPress plugin) | A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerabil | medium | 6.3 | 1% |
| CVE-2014-125099 | i-recommend-this (WordPress plugin) | A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerabilit | medium | 6.3 | 1% |
| CVE-2018-21014 | buddymoss-media (WordPress plugin) | The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS. | medium | 5.4 | 1% |
| CVE-2020-25380 | recall-products (WordPress plugin) | Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in | medium | 5.4 | 1% |
| CVE-2021-36906 | quiz-master-next (WordPress plugin) | Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress. | low | 2.7 | 1% |
| CVE-2024-11205 | wpforms-lite (WordPress plugin) | The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_adm | high | 8.5 | 1% |
| CVE-2023-2835 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and | medium | 6.1 | 1% |
| CVE-2017-14239 | dolibarr/dolibarr | Dolibarr cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2017-14241 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2021-24842 | bulk-datetime-change (WordPress plugin) | The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) lis | medium | 5.4 | 1% |