Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-1865 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin set | medium | 6.5 | 1% |
| CVE-2023-5744 | very-simple-google-maps (WordPress plugin) | The Very Simple Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vsgmap' shortcode in all ver | medium | 6.4 | 1% |
| CVE-2024-6517 | contact-form-7-math-captcha (WordPress plugin) | The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the pag | medium | 6.1 | 1% |
| CVE-2018-20368 | master-slider (WordPress plugin) | The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings valu | medium | 5.4 | 1% |
| CVE-2019-25143 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_c | medium | 5.4 | 1% |
| CVE-2022-0251 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2021-4353 | woocommerce-dynamic-pricing-\&-discounts (WordPress plugin) | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and i | medium | 5.3 | 1% |
| CVE-2022-0598 | login-with-phone-number (WordPress plugin) | The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2019-15835 | wp-better-permalinks (WordPress plugin) | The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15865 | breadcrumbs-by-menu (WordPress plugin) | The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15868 | affiliates-manager (WordPress plugin) | The affiliates-manager plugin before 2.6.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2025-24410 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24412 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24413 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24414 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24415 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24416 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2025-24417 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | 1% |
| CVE-2022-43983 | spatie/browsershot | Browsershot vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2023-6799 | wp-reset (WordPress plugin) | The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to | medium | 5.9 | 1% |
| CVE-2022-4417 | wp-cerber-security\,-anti-spam-\&-malware-scan (WordPress plugin) | The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint | medium | 5.3 | 1% |
| CVE-2021-24813 | events-made-easy (WordPress plugin) | The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perfor | medium | 4.8 | 1% |
| CVE-2022-3036 | gettext-override-translations (WordPress plugin) | The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high pr | medium | 4.8 | 1% |
| CVE-2016-15020 | liftkit/database | SQL Injection in liftkit/database | critical | 9.8 | 1% |
| CVE-2022-2541 | ucontext-for-amazon (WordPress plugin) | The uContext for Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and incl | high | 8.8 | 1% |
| CVE-2022-4303 | wp-limit-login-attempts (WordPress plugin) | The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_AD | high | 7.5 | 1% |
| CVE-2021-24243 | wpbakery-page-builder-clipboard (WordPress plugin) | An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability che | medium | 5.4 | 1% |
| CVE-2021-24322 | database-backup (WordPress plugin) | The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attri | medium | 5.4 | 1% |
| CVE-2021-4262 | mgallegos/laravel-jqgrid | laravel-jqgrid vulnerable to SQL Injection | critical | 9.8 | 1% |
| CVE-2023-1405 | formidable-forms (WordPress plugin) | The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection | high | 7.5 | 1% |
| CVE-2022-36296 | activedemand (WordPress plugin) | Broken Authentication vulnerability in JumpDEMAND Inc. ActiveDEMAND plugin <= 0.2.27 at WordPress allows unauthenticated post update/create/ | medium | 6.5 | 1% |
| CVE-2024-7354 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cro | medium | 6.1 | 1% |
| CVE-2022-4340 | bookingpress (WordPress plugin) | The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page | medium | 5.3 | 1% |
| CVE-2021-25954 | dolibarr/dolibarr | Improper Access Control in Dolibarr | medium | 4.3 | 1% |
| CVE-2022-22107 | bottelet/flarepoint | Missing Authorization in DayByDay CRM | medium | 4.3 | 1% |
| CVE-2022-22108 | bottelet/flarepoint | Missing Authorization in DayByDay CRM | medium | 4.3 | 1% |
| CVE-2025-49557 | magento/community-edition, magento/project-community-edition | Magento Cross-site Scripting vulnerability | high | 8.7 | 1% |
| CVE-2024-11391 | advanced-file-manager (WordPress plugin) | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fm | high | 7.5 | 1% |
| CVE-2023-3023 | wp-easycart (WordPress plugin) | The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, | high | 7.2 | 1% |
| CVE-2017-6484 | inter-mediator/inter-mediator | INTER-Mediator Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-2655 | classified-listing (WordPress plugin) | The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an ad | medium | 6.1 | 1% |
| CVE-2020-13240 | dolibarr/dolibarr | Dolibarr Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-42461 | google-authenticator (WordPress plugin) | Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress. | medium | 5.4 | 1% |
| CVE-2022-45066 | wooswipe-woocommerce-gallery (WordPress plugin) | Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress. | medium | 5.4 | 1% |
| CVE-2023-44760 | concrete5/concrete5 | Concrete CMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-4711 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX actio | medium | 4.3 | 1% |
| CVE-2024-6397 | instawp-connect (WordPress plugin) | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and | critical | 9.8 | 1% |
| CVE-2020-20693 | gilacms/gila | Cross-Site Request Forgery in GilaCMS | high | 8.8 | 1% |
| CVE-2021-34628 | admin-custom-login (WordPress plugin) | The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Lo | high | 8.8 | 1% |
| CVE-2021-34634 | sola-newsletters (WordPress plugin) | The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-news | high | 8.8 | 1% |