Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24558 | project-status (WordPress plugin) | The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape | medium | 5.4 | 1% |
| CVE-2021-24918 | smash-balloon-social-post-feed (WordPress plugin) | The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's s | medium | 5.4 | 1% |
| CVE-2021-25061 | wp-booking-system (WordPress plugin) | The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page. | medium | 5.4 | 1% |
| CVE-2022-2040 | brizy (WordPress plugin) | The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a role as low as Contrib | medium | 5.4 | 1% |
| CVE-2022-2041 | brizy (WordPress plugin) | The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Con | medium | 5.4 | 1% |
| CVE-2023-43792 | baserproject/basercms | baserCMS Code Injection Vulnerability in Mail Form Feature | medium | 5.3 | 1% |
| CVE-2021-24698 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads | medium | 4.3 | 1% |
| CVE-2021-24816 | phoenix-media-rename (WordPress plugin) | The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could | medium | 4.3 | 1% |
| CVE-2022-0775 | woocommerce (WordPress plugin) | The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenti | medium | 4.3 | 1% |
| CVE-2026-8236 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR combined with a missing authentication gate | medium | 0.0 | 1% |
| CVE-2013-7476 | simple-fields (WordPress plugin) | The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface. | high | 8.8 | 1% |
| CVE-2015-9322 | erident-custom-login-and-dashboard (WordPress plugin) | The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18523 | eelv-newsletter (WordPress plugin) | The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book. | high | 8.8 | 1% |
| CVE-2017-18569 | my-wp-translate (WordPress plugin) | The my-wp-translate plugin before 1.0.4 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-21006 | bbp-move-topics (WordPress plugin) | The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15113 | companion-sitemap-generator (WordPress plugin) | The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15114 | formcraft-form-builder (WordPress plugin) | The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15115 | peters-login-redirect (WordPress plugin) | The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-20846 | push-notifications-for-wp (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker | high | 8.8 | 1% |
| CVE-2025-0859 | post-and-page-builder (WordPress plugin) | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up | medium | 6.5 | 1% |
| CVE-2022-23800 | joomla/filter | Cross-site Scripting (XSS) within joomla/filter class | medium | 6.1 | 1% |
| CVE-2021-24960 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role | medium | 5.4 | 1% |
| CVE-2021-24961 | wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin) | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of i | medium | 5.4 | 1% |
| CVE-2024-0377 | lifterlms (WordPress plugin) | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 1% |
| CVE-2024-1862 | woocommerce-add-to-cart-custom-redirect (WordPress plugin) | The WooCommerce Add to Cart Custom Redirect plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to | high | 8.1 | 1% |
| CVE-2015-9387 | mtouch-quiz (WordPress plugin) | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF. | medium | 6.5 | 1% |
| CVE-2015-9388 | mtouch-quiz (WordPress plugin) | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS. | medium | 6.5 | 1% |
| CVE-2015-9417 | testimonial-slider (WordPress plugin) | The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS. | medium | 6.5 | 1% |
| CVE-2023-6970 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and | medium | 6.1 | 1% |
| CVE-2023-41100 | waldhacker/hcaptcha | hCaptcha for EXT:form Broken Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2015-10090 | landing-pages (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in Landing Pages Plugin up to 1.8.7 on WordPress. Affected by this issu | low | 3.5 | 1% |
| CVE-2023-0307 | thorsten/phpmyfaq | phpMyFAQ has Weak Password Requirements | medium | 0.0 | 1% |
| CVE-2021-24178 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forge | high | 8.8 | 1% |
| CVE-2021-24179 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forge | high | 8.8 | 1% |
| CVE-2022-0323 | mustache/mustache | Mustache remote code injection vulnerability | high | 8.8 | 1% |
| CVE-2024-32003 | winter/wn-dusk-plugin | Dusk plugin may allow unfettered user authentication in misconfigured installs | high | 8.8 | 1% |
| CVE-2021-4350 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This | high | 7.2 | 1% |
| CVE-2025-0428 | aipower (WordPress plugin) | The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via des | high | 7.2 | 1% |
| CVE-2025-0429 | aipower (WordPress plugin) | The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via des | high | 7.2 | 1% |
| CVE-2022-3440 | rock-convert (WordPress plugin) | The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specifi | medium | 6.1 | 1% |
| CVE-2022-37250 | craftcms/cms | Craft CMS Stored Cross-site Scripting in User Addresses Title | medium | 5.4 | 1% |
| CVE-2025-1785 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_ne | medium | 5.4 | 1% |
| CVE-2025-1771 | traveler (WordPress theme) | The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load | critical | 9.8 | 1% |
| CVE-2015-9394 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php. | high | 8.8 | 1% |
| CVE-2025-5071 | ai-engine (WordPress plugin) | The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on | high | 8.8 | 1% |
| CVE-2022-3991 | photospace (WordPress plugin) | The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() | medium | 6.4 | 1% |
| CVE-2019-16725 | joomla/joomla-cms | Joomla! XSS in Default Templates | medium | 6.1 | 1% |
| CVE-2021-24561 | wp-sms (WordPress plugin) | The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, le | medium | 5.4 | 1% |
| CVE-2021-24633 | countdown-block (WordPress plugin) | The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authen | medium | 4.3 | 1% |
| CVE-2024-6328 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions u | critical | 9.8 | 1% |