Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6077 | slider-factory-pro (WordPress plugin) | The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the u | medium | 6.5 | 1% |
| CVE-2021-3862 | icecoder/icecoder | icecoder is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2024-13791 | bit-assist (WordPress plugin) | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() f | medium | 4.9 | 1% |
| CVE-2021-32737 | sulu/sulu | XSS Injection in Media Collection Title was possible | medium | 4.8 | 1% |
| CVE-2021-25059 | download-plugin (WordPress plugin) | The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce i | medium | 4.3 | 1% |
| CVE-2023-2117 | image-optimizer (WordPress plugin) | The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, a | low | 2.7 | 1% |
| CVE-2023-4216 | orders-tracking-for-woocommerce (WordPress plugin) | The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowin | low | 2.7 | 1% |
| CVE-2024-5432 | lifeline-donation (WordPress plugin) | The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to in | critical | 9.8 | 1% |
| CVE-2023-5133 | user-activity-log (WordPress plugin) | This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attac | high | 7.5 | 1% |
| CVE-2024-10174 | wedevs-project-manager (WordPress plugin) | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerabl | high | 7.3 | 1% |
| CVE-2023-5660 | sendpress (WordPress plugin) | The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | 1% |
| CVE-2022-43692 | concrete5/concrete5 | Concrete CMS vulnerable to Reflected Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-43694 | concrete5/concrete5 | Concrete CMS vulnerable to Reflected Cross-site Scripting via image manipulation library | medium | 6.1 | 1% |
| CVE-2022-43967 | concrete5/concrete5 | Concrete CMS vulnerable to Cross-site Scripting via multilingual report | medium | 6.1 | 1% |
| CVE-2022-43968 | concrete5/concrete5 | Concrete CMS vulnerable to Reflected Cross-Site Scripting via dashboard icons | medium | 6.1 | 1% |
| CVE-2022-0260 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 5.4 | 1% |
| CVE-2022-2871 | notrinos/notrinos-erp | NotrinosERP Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-38975 | ec-cube/ec-cube | EC-CUBE DOM-based cross-site scripting vulnerability | medium | 5.4 | 1% |
| CVE-2021-24315 | givewp (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field o | medium | 4.8 | 1% |
| CVE-2024-12213 | superio (WordPress plugin) | The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allo | critical | 9.8 | 1% |
| CVE-2020-5679 | ec-cube/ec-cube | EC-CUBE Improper Restriction of Rendered UI Layers or Frames | medium | 6.1 | 1% |
| CVE-2021-24260 | addons-for-elementor (WordPress plugin) | The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2021-24261 | ht-mega (WordPress plugin) | The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored C | medium | 5.4 | 1% |
| CVE-2021-24263 | powerpack-addons-for-elementor (WordPress plugin) | The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable | medium | 5.4 | 1% |
| CVE-2021-24267 | all-in-one-addons-for-elementor (WordPress plugin) | The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Sit | medium | 5.4 | 1% |
| CVE-2021-24281 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_acti | medium | 4.3 | 1% |
| CVE-2023-2434 | wp-nested-pages (WordPress plugin) | The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function i | low | 3.8 | 1% |
| CVE-2022-4070 | librenms/librenms | Insufficient Session Expiration in librenms/librenms | critical | 9.8 | 1% |
| CVE-2022-41706 | spatie/browsershot | Browsershot does not validate URL protocols passed to Browsershot URL method | high | 8.2 | 1% |
| CVE-2025-49556 | magento/community-edition, magento/project-community-edition | Magento has incorrect authorization issue that leads to arbitrary file system read | high | 7.5 | 1% |
| CVE-2020-13688 | drupal/core | Drupal 8 and 9 have a reflected cross-site scripting (XSS) vulnerability under certain circumstances. An attacker could | medium | 6.1 | 1% |
| CVE-2020-35571 | mantisbt/mantisbt | MantisBT XSS in manage_custom_field_update.php | medium | 6.1 | 1% |
| CVE-2023-28331 | moodle/moodle | Moodle vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2023-4602 | namaste\!-lms (WordPress plugin) | The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id' parameter in versions up to, and | medium | 6.1 | 1% |
| CVE-2023-4603 | star-cloudprnt-for-woocommerce (WordPress plugin) | The Star CloudPRNT for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'printersettings' parameter | medium | 6.1 | 1% |
| CVE-2023-4981 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-4982 | librenms/librenms | LibreNMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-43695 | concrete5/concrete5 | Concrete CMS Cross-site Scripting vulnerability | medium | 4.8 | 1% |
| CVE-2026-28695 | craftcms/cms | Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget | medium | 0.0 | 1% |
| CVE-2024-5080 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files suc | high | 8.8 | 1% |
| CVE-2021-24126 | envira-gallery (WordPress plugin) | Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitis | medium | 5.4 | 1% |
| CVE-2022-0706 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could a | medium | 4.8 | 1% |
| CVE-2022-2574 | meks-easy-social-share (WordPress plugin) | The Meks Easy Social Share WordPress plugin before 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2023-47126 | typo3/cms-install | Information Disclosure in typo3/cms-install tool | low | 3.7 | 1% |
| CVE-2023-5355 | awesome-support (WordPress plugin) | The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket s | high | 8.1 | 1% |
| CVE-2023-5127 | wp-font-awesome (WordPress plugin) | The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 | medium | 6.4 | 1% |
| CVE-2022-4905 | wpcloud/wp-stateless, stateless-media-plugin (WordPress plugin) | Cross-site Scripting in UDX Stateless Media Plugin | medium | 6.1 | 1% |
| CVE-2023-0087 | swifty-page-manager (WordPress plugin) | The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ p | medium | 5.5 | 1% |
| CVE-2022-3282 | drag-and-drop-multiple-file-upload---contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, takin | medium | 4.3 | 1% |
| CVE-2022-40316 | moodle/moodle | Moodle No groups filtering in H5P activity attempts report | medium | 4.3 | 1% |