Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-25053 | wp-coder (WordPress plugin) | The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as | high | 8.8 | 1% |
| CVE-2021-4367 | flo-forms (WordPress plugin) | The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using | medium | 6.4 | 1% |
| CVE-2023-4597 | wp-slimstat (WordPress plugin) | The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and | medium | 6.4 | 1% |
| CVE-2020-36607 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-2115 | popup-anything (WordPress plugin) | The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, lead | medium | 6.1 | 1% |
| CVE-2021-45729 | gmap-embed (WordPress plugin) | The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role us | medium | 5.4 | 1% |
| CVE-2023-6327 | woolentor-addons (WordPress plugin) | The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t | medium | 5.3 | 1% |
| CVE-2024-10585 | iwp-client (WordPress plugin) | The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' | medium | 5.3 | 1% |
| CVE-2024-34105 | magento/community-edition | Magento Open Source Cross-Site Scripting (XSS) vulnerability | medium | 4.8 | 1% |
| CVE-2021-39347 | woo-stripe-payment (WordPress plugin) | The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stri | medium | 4.3 | 1% |
| CVE-2022-43492 | wpdiscuz (WordPress plugin) | Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress. | medium | 4.3 | 1% |
| CVE-2024-2908 | call-now-button (WordPress plugin) | The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.3 | 1% |
| CVE-2017-18607 | avada (WordPress theme) | The avada theme before 5.1.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2023-5425 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | high | 8.8 | 1% |
| CVE-2020-36504 | wp-pro-quiz (WordPress plugin) | The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make | medium | 6.5 | 1% |
| CVE-2023-4198 | dolibarr/dolibarr | Dolibarr Improper Input Validation vulnerability | medium | 6.5 | 1% |
| CVE-2024-29186 | bref/bref | Slow String Operations via MultiPart Requests in Event-Driven Functions | medium | 5.3 | 1% |
| CVE-2015-10114 | woosidebars (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue | medium | 4.3 | 1% |
| CVE-2024-0623 | vk-block-patterns (WordPress plugin) | The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This | medium | 4.3 | 1% |
| CVE-2023-49810 | wwbn/avideo | WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability | high | 7.3 | 1% |
| CVE-2020-26623 | gilacms/gila | Gila CMS SQL Injection | medium | 6.5 | 1% |
| CVE-2023-2105 | alextselegidis/easyappointments | alextselegidis/easyappointments Session Fixation vulnerability | medium | 5.4 | 1% |
| CVE-2021-24502 | wp-maps (WordPress plugin) | The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a St | medium | 4.8 | 1% |
| CVE-2021-24856 | shared-files (WordPress plugin) | The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high priv | medium | 4.8 | 1% |
| CVE-2023-5844 | pimcore/admin-ui-classic-bundle | pimcore/admin-ui-classic-bundle Unverified Password Change | medium | 4.3 | 1% |
| CVE-2020-26624 | gilacms/gila | Gila CMS SQL Injection vulnerability | low | 3.8 | 1% |
| CVE-2020-26625 | gilacms/gila | Gila CMS SQL Injection vulnerability | low | 3.8 | 1% |
| CVE-2015-10013 | taxonomy-switcher (WordPress plugin) | A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affecte | low | 3.5 | 1% |
| CVE-2015-10077 | webbuilders-group/silverstripe-kapost-bridge | SQL injection in webbuilders-group silverstripe-kapost-bridge | critical | 9.8 | 1% |
| CVE-2018-10233 | ultimate-member (WordPress plugin) | The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. T | high | 8.8 | 1% |
| CVE-2026-55578 | pheditor/pheditor | Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection | high | 8.8 | 1% |
| CVE-2022-25275 | drupal/core | In some situations, the Image module does not correctly check access to image files not stored in the standard public fi | high | 7.5 | 1% |
| CVE-2023-4978 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-4663 | members-import (WordPress plugin) | The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in v | medium | 5.5 | 1% |
| CVE-2018-0570 | baserproject/basercms | XSS in baserCMS | medium | 5.4 | 1% |
| CVE-2018-16551 | lavalite/cms | Stored XSS in LavaLite 5.5 | medium | 5.4 | 1% |
| CVE-2022-4657 | restaurant-menu---food-ordering-system---table-reservation (WordPress plugin) | The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2023-0572 | froxlor/froxlor | Froxlor contains Unchecked Error Condition | medium | 5.3 | 1% |
| CVE-2022-1010 | login-using-wordpress-users (WordPress plugin) | The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which c | medium | 4.8 | 1% |
| CVE-2022-1990 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2022-2099 | woocommerce (WordPress plugin), woocommerce/woocommerce | The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment g | medium | 4.8 | 1% |
| CVE-2022-3237 | wp-contact-slider (WordPress plugin) | The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin t | medium | 4.8 | 1% |
| CVE-2022-3408 | wp-word-count (WordPress plugin) | The WP Word Count WordPress plugin through 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2026-55207 | pimcore/studio-backend-bundle | Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass | high | 8.8 | 1% |
| CVE-2023-2336 | pimcore/pimcore | Path Traversal in Asset "import from server" option | medium | 6.5 | 1% |
| CVE-2026-45077 | symfony/monolog-bridge, symfony/symfony | Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener | high | 0.0 | 1% |
| CVE-2025-46348 | yeswiki/yeswiki | YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download | critical | 10.0 | 1% |
| CVE-2020-20726 | gilacms/gila | GilaCMS Cross Site Request Forgery vulnerability | high | 8.8 | 1% |
| CVE-2017-14530 | crony (WordPress plugin) | WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create ope | high | 8.0 | 1% |
| CVE-2024-2761 | genesis-blocks (WordPress plugin) | The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at | medium | 6.8 | 1% |