Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-12246 | silverstripe/framework | SilverStripe Denial of Service on flush and development URL tools | medium | 4.3 | 1% |
| CVE-2020-5273 | prestashop/ps_linklist | Stored XSS with custom URLs in PrestaShop module ps_linklist | medium | 4.1 | 1% |
| CVE-2024-4157 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object I | high | 7.5 | 1% |
| CVE-2021-3783 | yourls/yourls | Cross-site Scripting in yourls | medium | 6.6 | 1% |
| CVE-2018-12290 | ptheofan/yii2-statemachine | Yii2-StateMachine extension for Yii2 XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2017-18600 | formcraft (WordPress plugin) | The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field. | medium | 5.4 | 1% |
| CVE-2020-13892 | sportspress (WordPress plugin) | The SportsPress plugin before 2.7.2 for WordPress allows XSS. | medium | 5.4 | 1% |
| CVE-2015-10115 | sidebar-manager-to-woosidebars-converter (WordPress plugin) | A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. Th | medium | 4.3 | 1% |
| CVE-2020-13663 | drupal/core, drupal/drupal | The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other v | high | 8.8 | 1% |
| CVE-2024-0786 | enhanced-e-commerce-for-woocommerce-store (WordPress plugin) | The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to ti | high | 8.8 | 1% |
| CVE-2021-41236 | oro/platform | XSS vulnerability on email template preview page | medium | 6.9 | 1% |
| CVE-2010-10002 | simplesamlphp/simplesamlphp-module-openid | SimpleSAMLphp simplesamlphp-module-openid | medium | 6.1 | 1% |
| CVE-2022-4459 | wp-show-posts (WordPress plugin) | The WP Show Posts WordPress plugin before 1.1.4 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2023-0148 | gallery-factory-lite (WordPress plugin) | The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 1% |
| CVE-2023-0149 | wordprezi (WordPress plugin) | The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a pag | medium | 5.4 | 1% |
| CVE-2023-0154 | gamipress (WordPress plugin) | The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 1% |
| CVE-2021-24518 | notification-bar (WordPress plugin) | The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege | medium | 4.8 | 1% |
| CVE-2023-48294 | librenms/librenms | LibreNMS has Broken Access control on Graphs Feature | medium | 4.3 | 1% |
| CVE-2022-47408 | fixpunkt/fp-newsletter | Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter) | critical | 9.1 | 1% |
| CVE-2023-6991 | jsm-file-get-contents\(\)-shortcode (WordPress plugin) | The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a requ | high | 8.8 | 1% |
| CVE-2022-44589 | google-authenticator (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Fac | high | 8.1 | 1% |
| CVE-2022-2072 | name-directory (WordPress plugin) | The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 1% |
| CVE-2022-2181 | advanced-wordpress-reset (WordPress plugin) | The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes | medium | 6.1 | 1% |
| CVE-2022-3891 | wp-fullcalendar (WordPress plugin) | The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by | medium | 5.3 | 1% |
| CVE-2023-46906 | juzaweb/cms | juzawebCMS Incorrect Access Control vulnerability | medium | 4.9 | 1% |
| CVE-2015-9354 | gigpress (WordPress plugin) | The gigpress plugin before 2.3.11 for WordPress has XSS. | medium | 4.8 | 1% |
| CVE-2023-28106 | pimcore/pimcore | Cross-site Scripting (XSS) in UrlSlug Data type | medium | 4.8 | 1% |
| CVE-2016-10876 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 4.3.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15840 | facebook-for-woocommerce (WordPress plugin) | The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15841 | facebook-for-woocommerce (WordPress plugin) | The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, | high | 8.8 | 1% |
| CVE-2022-2542 | ucontext (WordPress plugin) | The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and i | high | 8.8 | 1% |
| CVE-2024-10962 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0. | high | 8.8 | 1% |
| CVE-2022-4213 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page | medium | 6.1 | 1% |
| CVE-2022-26332 | andreapollastri/cipi | Cross-site Scripting in Cipi | medium | 5.4 | 1% |
| CVE-2022-31148 | shopware/shopware | Shopware vulnerable to persistent cross site scripting (XSS) in customer module | medium | 5.4 | 1% |
| CVE-2024-13097 | wp-finance (WordPress plugin) | The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 5.4 | 1% |
| CVE-2024-13099 | widget4call (WordPress plugin) | The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 5.4 | 1% |
| CVE-2022-2233 | banner-cycler (WordPress plugin) | The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to miss | high | 8.8 | 1% |
| CVE-2024-10709 | yadisk-files (WordPress plugin) | The YaDisk Files WordPress plugin through 1.2.5 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 6.8 | 1% |
| CVE-2022-35174 | getkirby/starterkit | Cross site scripting in getkirby/starterkit | medium | 5.4 | 1% |
| CVE-2022-2374 | simply-schedule-appointments (WordPress plugin) | The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high p | medium | 4.8 | 1% |
| CVE-2019-15329 | import-users-from-csv-with-meta (WordPress plugin) | The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15770 | woo-address-book (WordPress plugin) | The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks. | high | 8.8 | 1% |
| CVE-2019-15779 | insta-gallery (WordPress plugin) | The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete. | high | 8.8 | 1% |
| CVE-2026-40488 | openmage/magento-lts | OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution | high | 8.8 | 1% |
| CVE-2024-10097 | loginizer (WordPress plugin) | The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9 | high | 8.1 | 1% |
| CVE-2024-27300 | phpmyfaq/phpmyfaq | phpMyFAQ stored Cross-site Scripting at user email | medium | 5.5 | 1% |
| CVE-2020-15020 | elementor (WordPress plugin) | An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name | medium | 5.4 | 1% |
| CVE-2021-24225 | advanced-booking-calendar (WordPress plugin) | The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page befor | medium | 5.4 | 1% |
| CVE-2022-2495 | microweber/microweber | Microweber Stored Cross-site Scripting before v1.2.20 | medium | 4.8 | 1% |