Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0958 | backup-migration (WordPress plugin), clone (WordPress plugin), duplicate-post (WordPress plugin) +8 more | Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the hand | medium | 4.3 | 1% |
| CVE-2023-5761 | burst-statistics (WordPress plugin) | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter | critical | 9.8 | 1% |
| CVE-2021-24711 | software-license-manager (WordPress plugin) | The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vu | high | 8.8 | 1% |
| CVE-2022-2439 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted i | high | 7.2 | 1% |
| CVE-2023-22730 | shopware/core, shopware/platform | Shopware vulnerable to Improper Input Validation of Clearance sale in cart | medium | 6.3 | 1% |
| CVE-2019-16904 | nilsteampassnet/teampass | TeamPass Cross-site Scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2023-4979 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-4980 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2021-34626 | wp-upload-restriction (WordPress plugin) | A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delet | medium | 4.3 | 1% |
| CVE-2023-46733 | symfony/security-http, symfony/symfony | Symfony possible session fixation vulnerability | medium | 6.5 | 1% |
| CVE-2020-15128 | october/rain | Reliance on Cookies without validation in OctoberCMS | medium | 6.1 | 1% |
| CVE-2023-37302 | wikibase/wikibase | MediaWiki Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-4698 | wp-user-avatar (WordPress plugin) | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, | medium | 5.5 | 1% |
| CVE-2021-24911 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJA | medium | 5.4 | 1% |
| CVE-2021-24207 | wp-page-builder (WordPress plugin) | By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pa | medium | 4.3 | 1% |
| CVE-2024-5852 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.24.7 via the 'up | medium | 4.3 | 1% |
| CVE-2026-27591 | winter/wn-backend-module | Winter vulnerable to privilege escalation by authenticated backend users | critical | 9.9 | 1% |
| CVE-2024-5756 | email-subscribers (WordPress plugin) | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln | critical | 9.8 | 1% |
| CVE-2023-6271 | backup-migration (WordPress plugin) | The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which | high | 7.5 | 1% |
| CVE-2024-2311 | avada (WordPress plugin) | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, | medium | 6.4 | 1% |
| CVE-2023-4151 | store-locator (WordPress plugin) | The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response | medium | 6.1 | 1% |
| CVE-2023-46734 | symfony/symfony, symfony/twig-bridge | Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters | medium | 6.1 | 1% |
| CVE-2026-3452 | concrete5/concrete5 | Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection | high | 0.0 | 1% |
| CVE-2026-46633 | twig/twig | Twig: PHP code injection via `{% use %}` template name | critical | 0.0 | 1% |
| CVE-2016-10918 | gallery-by-supsystic (WordPress plugin) | The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18504 | twitter-cards-meta (WordPress plugin) | The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2020-12076 | data-tables-generator (WordPress plugin) | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this | high | 8.8 | 1% |
| CVE-2023-4703 | all-in-one-b2b-for-woocommerce (WordPress plugin) | The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing | high | 7.5 | 1% |
| CVE-2022-0374 | remdex/livehelperchat | Cross-site Scripting in livehelperchat | medium | 6.5 | 1% |
| CVE-2023-2304 | favorites (WordPress plugin) | The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_favorites' shortcode in versions up to, and in | medium | 6.4 | 1% |
| CVE-2023-0325 | uvdesk/community-skeleton | Uvdesk vulnerable to stored cross-site scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-0894 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2022-1997 | francoisjacquet/rosariosis | Cross-site Scripting in RosarioSIS | medium | 5.4 | 1% |
| CVE-2022-2016 | facturascripts/facturascripts | Cross-site Scripting in FacturaScripts | medium | 5.4 | 1% |
| CVE-2022-2065 | facturascripts/facturascripts | Cross-site Scripting in FacturaScripts | medium | 5.4 | 1% |
| CVE-2021-24482 | related-posts (WordPress plugin) | The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (adm | medium | 4.8 | 1% |
| CVE-2023-3126 | b2bking (WordPress plugin) | The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadprice | medium | 4.3 | 1% |
| CVE-2025-5304 | project-notebooks (WordPress plugin) | The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_a | critical | 9.8 | 1% |
| CVE-2020-13155 | nukeviet/nukeviet | NukeViet Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2017-9068 | modx/revolution | MODX Revolution Reflected XSS | medium | 6.1 | 1% |
| CVE-2018-15563 | intelliants/subrion | Subrion CMS Stored Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-4216 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and | medium | 5.5 | 1% |
| CVE-2022-4217 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and includ | medium | 5.5 | 1% |
| CVE-2018-17782 | mantisbt/mantisbt | MantisBT allows XSS via the Manage Filter page | medium | 5.4 | 1% |
| CVE-2018-17783 | mantisbt/mantisbt | MantisBT allows XSS via Edit Filter page | medium | 5.4 | 1% |
| CVE-2021-27131 | moodle/moodle | Moodle vulnerable to stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-0085 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. T | medium | 5.3 | 1% |
| CVE-2024-1310 | woocommerce (WordPress plugin) | The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't h | medium | 4.9 | 1% |
| CVE-2021-24900 | ninja-tables (WordPress plugin) | The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-1512 | scrollrevealjs-effects (WordPress plugin) | The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users t | medium | 4.8 | 1% |