Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-18872 | calendar (WordPress plugin) | The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=cale | medium | 5.4 | 1% |
| CVE-2023-3650 | bubble-menu (WordPress plugin) | The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such | medium | 4.8 | 1% |
| CVE-2023-50708 | yiisoft/yii2-authclient | yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation | low | 0.0 | 1% |
| CVE-2026-77138 | lochmueller/html5videoplayer-powermail | TYPO3-EXT-SA-2026-014: Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) | unknown | 0.0 | 1% |
| CVE-2015-9455 | buddypress-activity-plus (WordPress plugin) | The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php b | high | 8.1 | 1% |
| CVE-2022-35238 | awesome-filterable-portfolio (WordPress plugin) | Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress. | medium | 6.5 | 1% |
| CVE-2025-0365 | jupiterx-core (WordPress plugin) | The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7 via the inline SVG | medium | 6.5 | 1% |
| CVE-2023-48219 | tinymce/tinymce | TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes | medium | 6.1 | 1% |
| CVE-2019-25151 | cartflows (WordPress plugin) | The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin funct | medium | 5.4 | 1% |
| CVE-2020-27388 | yourls/yourls | YOURLS Stored Cross Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2020-36729 | 2j-slideshow (WordPress plugin) | The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' | medium | 5.4 | 1% |
| CVE-2023-4631 | dologin-security (WordPress plugin) | The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which c | medium | 5.3 | 1% |
| CVE-2017-12651 | loginizer (WordPress plugin) | Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordP | high | 8.8 | 1% |
| CVE-2023-0790 | thorsten/phpmyfaq | Uncaught Exception in thorsten/phpmyfaq | high | 8.8 | 1% |
| CVE-2023-2545 | feather-login-page (WordPress plugin) | The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOf | high | 8.1 | 1% |
| CVE-2007-10003 | the-hackers-diet (WordPress plugin) | A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects s | medium | 6.3 | 1% |
| CVE-2018-14520 | getkirby/cms | Kirby CMS 2.5.12 Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-44763 | concrete5/concrete5 | ConcreteCMS vulnerable to Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-1255 | import-and-export-users-and-customers (WordPress plugin) | The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allo | medium | 4.8 | 1% |
| CVE-2025-30159 | getkirby/kirby | Kirby vulnerable to path traversal of snippet names in the `snippet()` helper | medium | 0.0 | 1% |
| CVE-2026-28508 | idno/known | Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint | critical | 0.0 | 1% |
| CVE-2021-4308 | webpa/webpa | WebPA SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2021-24491 | fileviewer (WordPress plugin) | The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a | high | 8.8 | 1% |
| CVE-2023-39529 | prestashop/prestashop | PrestaShop file deletion via attachment API | medium | 6.7 | 1% |
| CVE-2022-1599 | admin-management-xtended (WordPress plugin) | The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make | medium | 6.5 | 1% |
| CVE-2022-3400 | bricks (WordPress theme) | The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action i | medium | 6.5 | 1% |
| CVE-2022-29434 | spiffy-calendar (WordPress plugin) | Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or | medium | 6.3 | 1% |
| CVE-2023-0876 | wp-meta-seo (WordPress plugin) | The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certa | medium | 6.1 | 1% |
| CVE-2017-18286 | nzedb/nzedb | nZEDb Cross-site Scripting (XSS) in the 404 error page | medium | 5.4 | 1% |
| CVE-2024-3717 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions | medium | 5.3 | 1% |
| CVE-2024-29203 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes | medium | 4.3 | 1% |
| CVE-2024-29881 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements | medium | 4.3 | 1% |
| CVE-2024-34537 | typo3/cms-backend | Denial of Service in TYPO3 Bookmark Toolbar | low | 2.7 | 1% |
| CVE-2024-43426 | moodle/moodle | Moodle has arbitrary file read risk through pdfTeX | high | 7.5 | 1% |
| CVE-2020-11516 | contact-form-7-datepicker (WordPress plugin) | Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to sa | medium | 5.4 | 1% |
| CVE-2021-44566 | francoisjacquet/rosariosis | Cross site scripting in francoisjacquet/rosariosis | medium | 5.4 | 1% |
| CVE-2022-45151 | moodle/moodle | Moodle stored-XSS vulnerability in some "social" user profile fields | medium | 5.4 | 1% |
| CVE-2024-4444 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4. | medium | 5.3 | 1% |
| CVE-2022-2563 | tutor-lms (WordPress plugin) | The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to | medium | 4.8 | 1% |
| CVE-2022-0334 | moodle/moodle | Insufficient user authorization in Moodle | medium | 4.3 | 1% |
| CVE-2022-33994 | gutenberg (WordPress plugin) | The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" fea | low | 3.0 | 1% |
| CVE-2026-34084 | phpoffice/phpspreadsheet | PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled | critical | 0.0 | 1% |
| CVE-2017-1002017 | gift-certificate-creator (WordPress plugin) | Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS | medium | 6.1 | 1% |
| CVE-2021-40691 | moodle/moodle | Moodle Improper Authentication | medium | 4.3 | 1% |
| CVE-2019-19109 | wpforo (WordPress plugin) | The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. | high | 8.8 | 1% |
| CVE-2023-0721 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This | high | 8.3 | 1% |
| CVE-2023-5922 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and R | high | 7.5 | 1% |
| CVE-2024-1588 | sendpress (WordPress plugin) | The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privi | medium | 6.8 | 1% |
| CVE-2022-2696 | menu-ordering-reservations (WordPress plugin) | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX a | medium | 6.3 | 1% |
| CVE-2021-3663 | grumpydictator/firefly-iii | No Restriction of Excessive Authentication Attempts in Firefly III | medium | 5.3 | 1% |