Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-68500 | sylius/mollie-plugin | Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook | high | 7.5 | 1% |
| CVE-2024-13624 | wpmovielibrary (WordPress plugin) | The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading | high | 7.1 | 1% |
| CVE-2023-2666 | froxlor/froxlor | Froxlor vulnerable to Allocation of Resources Without Limits or Throttling | medium | 6.5 | 1% |
| CVE-2022-2537 | woocommerce-pdf-invoices\&-packing-slips (WordPress plugin) | The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting th | medium | 6.1 | 1% |
| CVE-2022-2538 | wp-hide-\&-security-enhancer (WordPress plugin) | The WP Hide & Security Enhancer WordPress plugin before 1.8 does not escape a parameter before outputting it back in an attribute of a backe | medium | 6.1 | 1% |
| CVE-2023-33197 | craftcms/cms | Craft CMS stored XSS in indexedVolumes | medium | 5.5 | 1% |
| CVE-2021-24494 | wp-offload-ses-lite (WordPress plugin) | The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as | medium | 5.4 | 1% |
| CVE-2022-0145 | forkcms/forkcms | Cross-site Scripting in Fork CMS | medium | 5.4 | 1% |
| CVE-2023-38970 | uasoft-indonesia/badaso | Badaso vulnerable to cross-site scripting | medium | 5.4 | 1% |
| CVE-2022-0684 | wp-home-page-menu (WordPress plugin) | The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to | medium | 4.8 | 1% |
| CVE-2022-37342 | add-actions-and-filters (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-2912 | craw-data (WordPress plugin) | The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change t | medium | 4.3 | 1% |
| CVE-2024-6809 | simple-video-directory (WordPress plugin) | The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statemen | critical | 9.8 | 1% |
| CVE-2011-5328 | user-access-manager (WordPress plugin) | The user-access-manager plugin before 1.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2014-10381 | user-domain-whitelist (WordPress plugin) | The user-domain-whitelist plugin before 1.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2015-9343 | wp-rollback (WordPress plugin) | The wp-rollback plugin before 1.2.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10885 | wp-editor (WordPress plugin) | The wp-editor plugin before 1.2.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10902 | wp-customer-reviews (WordPress plugin) | The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools. | high | 8.8 | 1% |
| CVE-2016-10903 | godaddy-email-marketing-sign-up-forms (WordPress plugin) | The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10914 | add-from-server (WordPress plugin) | The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file. | high | 8.8 | 1% |
| CVE-2016-10915 | popup-by-supsystic (WordPress plugin) | The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15660 | wp-members (WordPress plugin) | The wp-members plugin before 3.2.8 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-34632 | seo-backlinks (WordPress plugin) | The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the loc_config function found in the ~/seo-backlinks.php | high | 8.8 | 1% |
| CVE-2021-34633 | youtube-feeder (WordPress plugin) | The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feede | high | 8.8 | 1% |
| CVE-2026-35168 | devcode-it/openstamanager | OpenSTAManager: SQL Injection via Aggiornamenti Module | high | 8.8 | 1% |
| CVE-2024-1072 | coming-soon (WordPress plugin) | The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable | high | 8.2 | 1% |
| CVE-2020-13486 | verbb/knock-knock | Knock Knock plugin Open redirection vulnerability | medium | 6.1 | 1% |
| CVE-2023-26044 | react/http | ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits | medium | 5.3 | 1% |
| CVE-2024-0598 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the con | medium | 4.4 | 1% |
| CVE-2026-55220 | pimcore/pimcore | Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) | critical | 0.0 | 1% |
| CVE-2023-36529 | houzez (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPr | critical | 9.9 | 1% |
| CVE-2016-10874 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 4.3.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2016-10978 | fossura-tag-miner (WordPress plugin) | The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2023-45074 | advanced-page-visit-counter (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit | high | 8.5 | 1% |
| CVE-2025-24409 | magento/community-edition, magento/project-community-edition | Adobe Commerce Improper Authorization vulnerability | high | 8.2 | 1% |
| CVE-2022-0505 | microweber/microweber | Cross-Site Request Forgery in microweber | medium | 6.5 | 1% |
| CVE-2023-4774 | wp-piwik (WordPress plugin) | The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versi | medium | 6.4 | 1% |
| CVE-2022-23638 | enshrined/svg-sanitize | Cross-site Scripting in enshrined/svg-sanitize | medium | 6.2 | 1% |
| CVE-2017-1000431 | ezsystems/ezpublish-legacy | eZ Publish Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2019-18656 | pimcore/pimcore | Pimcore XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2020-13633 | forkcms/forkcms | Fork CMS Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2019-14683 | import-users-from-csv-with-meta (WordPress plugin) | The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attac | medium | 5.7 | 1% |
| CVE-2024-40137 | dolibarr/dolibarr | Dolibarr ERP CRM vulnerable to remote code execution (RCE) | medium | 5.5 | 1% |
| CVE-2021-24196 | social-slider-widget (WordPress plugin) | The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ | medium | 5.4 | 1% |
| CVE-2024-0614 | events-manager (WordPress plugin) | The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including | medium | 4.4 | 1% |
| CVE-2022-41655 | phone-orders-for-woocommerce (WordPress plugin) | Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress. | medium | 4.3 | 1% |
| CVE-2024-25108 | pixelfed/pixelfed | Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions | critical | 9.9 | 1% |
| CVE-2024-9130 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ paramet | high | 7.2 | 1% |
| CVE-2019-13376 | phpbb/phpbb | phpBB Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2024-2093 | vk-all-in-one-expansion-unit (WordPress plugin) | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 6.5 | 1% |