Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-48367 | ezsystems/ezpublish-kernel | Object state limitation has no effect | critical | 9.8 | 1% |
| CVE-2021-39353 | easy-registration-forms (WordPress plugin) | The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_fo | high | 8.8 | 1% |
| CVE-2023-5645 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading | high | 8.8 | 1% |
| CVE-2022-41781 | permalink-manager-lite (WordPress plugin) | Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress. | medium | 6.5 | 1% |
| CVE-2021-3785 | yourls/yourls | Cross-site Scripting in yourls | medium | 5.4 | 1% |
| CVE-2021-4072 | elgg/elgg | elgg is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-4089 | snipe/snipe-it | snipe-it is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2018-11352 | wallabag/wallabag | Wallabag cross-site scripting (XSS) vulnerability | medium | 4.0 | 1% |
| CVE-2026-47767 | symfony/runtime, symfony/symfony | SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch | medium | 0.0 | 1% |
| CVE-2021-36913 | wpcf7-redirect (WordPress plugin) | Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress a | high | 7.5 | 1% |
| CVE-2023-6064 | payhere-payment-gateway (WordPress plugin) | The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive informat | high | 7.5 | 1% |
| CVE-2024-9664 | wp-all-import (WordPress plugin) | The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserializa | high | 7.2 | 1% |
| CVE-2020-14320 | moodle/moodle | Moodle reflected XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2012-10016 | simple-download-button-shortcode (WordPress plugin) | A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an | medium | 4.3 | 1% |
| CVE-2021-24355 | simple-301-redirects (WordPress plugin) | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the | medium | 4.3 | 1% |
| CVE-2024-4825 | cockpit-hq/cockpit | Cockpit CMS contains an arbitrary file upload vulenrability | critical | 9.8 | 1% |
| CVE-2021-24565 | contact-form-7-captcha (WordPress plugin) | The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker t | high | 8.8 | 1% |
| CVE-2021-34619 | woocommerce-stock-manager (WordPress plugin) | The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up t | high | 8.8 | 1% |
| CVE-2022-47410 | fixpunkt/fp-newsletter | "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data | high | 7.5 | 1% |
| CVE-2022-47411 | fixpunkt/fp-newsletter | "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data | high | 7.5 | 1% |
| CVE-2022-0602 | tastyigniter/tastyigniter | Cross-site Scripting in TastyIgniter | high | 7.4 | 1% |
| CVE-2024-21519 | opencart/opencart | Arbitrary File Creation in opencart | medium | 6.6 | 1% |
| CVE-2022-30875 | dolibarr/dolibarr | Cross-site Scripting in Dolibarr | medium | 6.1 | 1% |
| CVE-2023-4281 | activity-log (WordPress plugin) | This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to ma | medium | 5.3 | 1% |
| CVE-2024-11350 | adforest (WordPress plugin) | The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. Thi | critical | 9.8 | 1% |
| CVE-2024-1514 | wp-e-commerce (WordPress plugin) | The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter in all versions up t | critical | 9.8 | 1% |
| CVE-2015-9498 | wps-hide-login (WordPress plugin) | The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value. | high | 8.8 | 1% |
| CVE-2024-1934 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | high | 7.5 | 1% |
| CVE-2025-6851 | broken-link-notifier (WordPress plugin) | The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via t | high | 7.2 | 1% |
| CVE-2022-41791 | profilegrid (WordPress plugin) | Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress. | medium | 6.8 | 1% |
| CVE-2023-2548 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. Thi | medium | 6.6 | 1% |
| CVE-2026-41062 | wwbn/avideo | WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters | medium | 6.5 | 1% |
| CVE-2023-1893 | login-configurator (WordPress plugin) | The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a | medium | 6.1 | 1% |
| CVE-2024-55228 | dolibarr/dolibarr | Dolibarr Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2013-10024 | exit-strategy (WordPress plugin) | A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an | low | 3.5 | 1% |
| CVE-2017-7204 | imdbphp/imdbphp | imdbphp Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2023-2333 | ninja-forms-google-sheet-connector (WordPress plugin) | The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does no | medium | 6.1 | 1% |
| CVE-2019-19541 | listingpro (WordPress theme) | The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page. | medium | 5.4 | 1% |
| CVE-2019-19542 | listingpro (WordPress theme) | The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page. | medium | 5.4 | 1% |
| CVE-2020-25375 | wp-smart-crm-\&-invoices (WordPress plugin) | Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code fiel | medium | 5.4 | 1% |
| CVE-2020-26672 | testimonial-rotator (WordPress plugin) | Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request a | medium | 5.4 | 1% |
| CVE-2022-43689 | concrete5/concrete5 | Concrete CMS vulnerable to XML External Entity | medium | 5.3 | 1% |
| CVE-2024-9874 | poll-maker (WordPress plugin) | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ | medium | 4.9 | 1% |
| CVE-2019-20181 | awesome-support (WordPress plugin) | The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter. | medium | 4.8 | 1% |
| CVE-2019-20182 | foogallery (WordPress plugin) | The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. | medium | 4.8 | 1% |
| CVE-2018-13067 | opencart/opencart | OpenCart Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2023-50256 | froxlor/froxlor | Froxlor username/surname AND company field Bypass | high | 7.5 | 1% |
| CVE-2022-40313 | moodle/moodle | Moodle Stored Cross-site Scripting and page denial of service | high | 7.1 | 1% |
| CVE-2021-24652 | postx---gutenberg-blocks-for-post-grid (WordPress plugin) | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to pe | medium | 6.5 | 1% |
| CVE-2022-4555 | wp-shamsi (WordPress plugin) | The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hook | medium | 6.5 | 1% |