Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-40614 | egroupware/egroupware | EGroupware mishandles an ORDER BY clause | medium | 6.5 | 1% |
| CVE-2024-3231 | popup4phone (WordPress plugin) | The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perf | medium | 6.1 | 1% |
| CVE-2021-4351 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. Thi | medium | 5.8 | 1% |
| CVE-2022-4034 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it pos | medium | 5.8 | 1% |
| CVE-2011-4630 | typo3/cms | Typo3 XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2011-4632 | typo3/cms | Typo3 XSS Vulnerabilities | medium | 5.4 | 1% |
| CVE-2024-1294 | sunshine-photo-cart (WordPress plugin) | The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all | medium | 5.3 | 1% |
| CVE-2025-52994 | james-heinrich/phpthumb | phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function | medium | 4.9 | 1% |
| CVE-2023-0467 | wp-dark-mode (WordPress plugin) | The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP te | medium | 4.3 | 1% |
| CVE-2021-4334 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check | high | 8.8 | 1% |
| CVE-2025-5927 | everest-forms (WordPress plugin) | The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete | high | 7.5 | 1% |
| CVE-2024-13899 | mambo-joomla-importer (WordPress plugin) | The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization | high | 7.2 | 1% |
| CVE-2023-0619 | kraken-image-optimizer (WordPress plugin) | The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actio | medium | 6.5 | 1% |
| CVE-2024-13550 | abc-notation (WordPress plugin) | The ABC Notation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.1.3 via the 'file' attribute o | medium | 6.5 | 1% |
| CVE-2020-13672 | drupal/core, drupal/drupal | Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. Not all sites | medium | 6.1 | 1% |
| CVE-2023-35131 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-3739 | wp-best-quiz (WordPress plugin) | The WP Best Quiz WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as Au | medium | 5.4 | 1% |
| CVE-2022-44381 | snipe/snipe-it | Snipe-IT allows attackers to check whether a user account exists | medium | 5.3 | 1% |
| CVE-2022-1334 | wp-youtube-live (WordPress plugin) | The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high pri | medium | 4.8 | 1% |
| CVE-2022-1566 | quotes-llama (WordPress plugin) | The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to | medium | 4.8 | 1% |
| CVE-2022-2351 | post-smtp (WordPress plugin) | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashb | medium | 4.8 | 1% |
| CVE-2022-2737 | wp-staging (WordPress plugin) | The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-2799 | affiliates-manager (WordPress plugin) | The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 1% |
| CVE-2022-2887 | wp-server-health-stats (WordPress plugin) | The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to per | medium | 4.8 | 1% |
| CVE-2022-3135 | seo-smart-links (WordPress plugin) | The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2026-41202 | ci4-cms-erp/ci4ms | CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE | critical | 0.0 | 1% |
| CVE-2022-1663 | stop-spam-comments (WordPress plugin) | The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comme | medium | 6.5 | 1% |
| CVE-2022-43984 | spatie/browsershot | Browsershot version 3.57.3 vulnerable to improper input validation | medium | 6.1 | 1% |
| CVE-2021-24382 | smart-slider (WordPress plugin) | The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, le | medium | 5.4 | 1% |
| CVE-2021-24574 | simple-banner (WordPress plugin) | The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2021-24594 | google-language-translator (WordPress plugin) | The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before | medium | 4.8 | 1% |
| CVE-2021-24598 | testimonial-builder (WordPress plugin) | The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cros | medium | 4.8 | 1% |
| CVE-2021-24608 | formidable-form-builder (WordPress plugin) | The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its F | medium | 4.8 | 1% |
| CVE-2021-24616 | addtoany-share-buttons (WordPress plugin) | The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privileg | medium | 4.8 | 1% |
| CVE-2021-24658 | erident-custom-login-and-dashboard (WordPress plugin) | The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users t | medium | 4.8 | 1% |
| CVE-2021-24710 | print-o-matic (WordPress plugin) | The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow | medium | 4.8 | 1% |
| CVE-2021-24830 | advanced-access-manager (WordPress plugin) | The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege | medium | 4.8 | 1% |
| CVE-2021-24963 | litespeed-cache (WordPress plugin) | The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin | medium | 4.8 | 1% |
| CVE-2022-3350 | contact-bank (WordPress plugin) | The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege us | medium | 4.8 | 1% |
| CVE-2022-29254 | silverstripe/silverstripe-omnipay | Failed payment recorded has completed in Silverstripe Omnipay | low | 3.7 | 1% |
| CVE-2026-56382 | craftcms/cms | Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview | high | 0.0 | 1% |
| CVE-2026-75592 | getkirby/cms | Kirby: Access to image files outside of the site root via path traversal in the media handling | medium | 0.0 | 1% |
| CVE-2025-2798 | woffice (WordPress theme) | The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a mi | critical | 9.8 | 1% |
| CVE-2024-4371 | woolementor (WordPress plugin) | The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PH | critical | 9.0 | 1% |
| CVE-2024-5630 | insert-or-embed-articulate-content (WordPress plugin) | The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to | high | 8.8 | 1% |
| CVE-2019-20390 | intelliants/subrion | Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability | high | 8.1 | 1% |
| CVE-2020-26228 | typo3/cms, typo3/cms-core | Cleartext storage of session identifier | high | 8.1 | 1% |
| CVE-2023-45069 | video-gallery (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Video Gallery by Total-Soft Video Gall | high | 7.6 | 1% |
| CVE-2024-1852 | wp-members (WordPress plugin) | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all ver | high | 7.2 | 1% |
| CVE-2021-24346 | stock-in-\&-out (WordPress plugin) | The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. The srch | medium | 5.4 | 1% |