Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-34637 | post-index (WordPress plugin) | The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php fil | high | 8.8 | 1% |
| CVE-2024-11104 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plu | high | 8.1 | 1% |
| CVE-2023-48701 | statamic/cms | Cross-site Scripting via uploaded assets | high | 7.5 | 1% |
| CVE-2026-33292 | wwbn/avideo | AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos | high | 7.5 | 1% |
| CVE-2022-0375 | remdex/livehelperchat | Cross-site Scripting in livehelperchat | medium | 6.5 | 1% |
| CVE-2023-47380 | admidio/admidio | Cross-site Scripting in Admidio | medium | 6.1 | 1% |
| CVE-2022-3231 | librenms/librenms | LibreNMS stored Cross-site Scripting via Schedule Maintenance `Title` parameter | medium | 5.4 | 1% |
| CVE-2021-42365 | asgaros-forum (WordPress plugin) | The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found i | medium | 4.8 | 1% |
| CVE-2021-34627 | wp-upload-restriction (WordPress plugin) | A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated user | medium | 4.3 | 1% |
| CVE-2015-9307 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature. | high | 8.8 | 1% |
| CVE-2015-9308 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature. | high | 8.8 | 1% |
| CVE-2015-9309 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature. | high | 8.8 | 1% |
| CVE-2016-10884 | simple-membership (WordPress plugin) | The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues. | high | 8.8 | 1% |
| CVE-2021-24218 | facebook (WordPress plugin) | The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable | high | 8.8 | 1% |
| CVE-2023-1887 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to business logic errors | high | 8.3 | 1% |
| CVE-2021-27910 | mautic/core | Stored XSS vulnerability on Bounce Management Callback | high | 8.2 | 1% |
| CVE-2024-13744 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate | high | 8.1 | 1% |
| CVE-2024-39400 | magento/community-edition, magento/project-community-edition | Magento DOM-based Cross-Site Scripting (XSS) vulnerability | high | 8.1 | 1% |
| CVE-2024-8699 | z-downloads (WordPress plugin) | The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upl | high | 7.2 | 1% |
| CVE-2020-28650 | page-builder (WordPress plugin) | The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protect | medium | 6.4 | 1% |
| CVE-2021-45895 | netgen/tagsbundle | Cross-site Scripting in Netgen Tags Bundle | medium | 6.1 | 1% |
| CVE-2024-2112 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Expos | medium | 5.9 | 1% |
| CVE-2021-25026 | patreon-wordpress (WordPress plugin) | The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privileg | medium | 5.5 | 1% |
| CVE-2023-0375 | easy-affiliate-links (WordPress plugin) | The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back in | medium | 5.4 | 1% |
| CVE-2023-3404 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0 | medium | 4.9 | 1% |
| CVE-2015-20106 | clickbank-affiliate-ads (WordPress plugin) | The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site | medium | 4.8 | 1% |
| CVE-2021-24888 | imageboss (WordPress plugin) | The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting, which could allow high privilege users to | medium | 4.8 | 1% |
| CVE-2021-4364 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add | medium | 4.3 | 1% |
| CVE-2026-69127 | getkirby/cms | Kirby: System path exposure from error messages in the REST API | medium | 0.0 | 1% |
| CVE-2024-11024 | apppresser (WordPress plugin) | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, | critical | 9.8 | 1% |
| CVE-2022-3427 | corner-ad (WordPress plugin) | The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to miss | high | 8.8 | 1% |
| CVE-2024-12721 | wb-custom-product-tabs-for-woocommerce (WordPress plugin) | The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2 | high | 7.2 | 1% |
| CVE-2015-1785 | nextgen-gallery (WordPress plugin) | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we | medium | 6.5 | 1% |
| CVE-2023-4549 | dologin-security (WordPress plugin) | The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can b | medium | 6.1 | 1% |
| CVE-2020-11823 | dolibarr/dolibarr | Dolibarr stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2020-13239 | dolibarr/dolibarr | Dolibarr Stored Cross-site Scripting via file upload | medium | 5.4 | 1% |
| CVE-2021-24313 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress websi | medium | 5.4 | 1% |
| CVE-2022-3002 | yetiforce/yetiforce-crm | YetiForce CRM vulnerable to stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-2415 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due | medium | 5.4 | 1% |
| CVE-2022-1581 | wp-polls (WordPress plugin) | The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes | medium | 5.3 | 1% |
| CVE-2024-34080 | mantisbt/mantisbt | MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.3 | 1% |
| CVE-2022-2628 | dsgvo-all-in-one-for-wp (WordPress plugin) | The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-3128 | donation-thermometer (WordPress plugin) | The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 1% |
| CVE-2021-34629 | sendgrid (WordPress plugin) | The SendGrid WordPress plugin is vulnerable to authorization bypass via the get_ajax_statistics function found in the ~/lib/class-sendgrid-s | medium | 4.3 | 1% |
| CVE-2024-5871 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via de | critical | 9.8 | 1% |
| CVE-2020-19825 | kimai/kimai | Cross-site Scripting in kimai/kimai | critical | 9.6 | 1% |
| CVE-2020-36715 | easy-login-woocommerce (WordPress plugin) | The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in v | high | 7.4 | 1% |
| CVE-2018-1000556 | wp-statistics (WordPress plugin) | WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can res | medium | 6.1 | 1% |
| CVE-2022-31057 | shopware/shopware | Authenticated Stored Cross-site Scripting in Shopware | medium | 5.4 | 1% |
| CVE-2022-36101 | shopware/shopware | Shopware contains sensitive data in backend customer module | medium | 5.4 | 1% |