Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13258 | drupal/rest_api_authentication | Drupal REST & JSON API Authentication module restricts and secures unauthorized access to your Drupal site APIs using di | unknown | 0.0 | 1% |
| CVE-2026-108359 | phpoffice/phpspreadsheet | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) | high | 0.0 | 1% |
| CVE-2022-2435 | anymind-widget (WordPress plugin) | The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to mis | high | 8.8 | 1% |
| CVE-2023-0693 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in ve | medium | 6.5 | 1% |
| CVE-2023-0694 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, a | medium | 6.5 | 1% |
| CVE-2022-4617 | microweber/microweber | Microweber vulnerable to Reflected Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2021-24246 | workscout (WordPress plugin), workscout-core (WordPress plugin) | The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send | medium | 5.4 | 1% |
| CVE-2021-24334 | instant-images---one-click-unsplash-uploads (WordPress plugin) | The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download | medium | 5.4 | 1% |
| CVE-2021-24386 | wp-svg-images (WordPress plugin) | The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ | medium | 5.4 | 1% |
| CVE-2016-15015 | barzahlen/barzahlen-php | Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy | medium | 5.3 | 1% |
| CVE-2020-13980 | opencart/opencart | OpenCart Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2024-0844 | popup-more (WordPress plugin) | The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via th | medium | 4.7 | 1% |
| CVE-2020-5225 | simplesamlphp/simplesamlphp | Log injection in SimpleSAMLphp | medium | 4.4 | 1% |
| CVE-2022-27859 | nd-travel (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark d.o.o. Travel Manageme | medium | 4.1 | 1% |
| CVE-2025-1909 | buddyboss-platform (WordPress plugin) | The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due | critical | 9.8 | 1% |
| CVE-2024-7628 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to | high | 8.1 | 1% |
| CVE-2022-4550 | user-activity (WordPress plugin) | The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which | high | 7.5 | 1% |
| CVE-2024-7389 | forminator (WordPress plugin) | The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-f | high | 7.5 | 1% |
| CVE-2022-38067 | calendar-event (WordPress plugin) | Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress. | medium | 6.5 | 1% |
| CVE-2024-1668 | avada (WordPress theme) | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up t | medium | 6.5 | 1% |
| CVE-2020-5223 | privatebin/privatebin | Persistent XSS vulnerability in filename of attached file in PrivateBin | medium | 6.1 | 1% |
| CVE-2022-1932 | rezgo-online-booking (WordPress plugin) | The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, l | medium | 6.1 | 1% |
| CVE-2026-52774 | yeswiki/yeswiki | YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes | medium | 6.1 | 1% |
| CVE-2017-18601 | ibps-online-exam (WordPress plugin) | The examapp plugin 1.0 for WordPress has XSS via exam input text fields. | medium | 5.4 | 1% |
| CVE-2021-24129 | portfolio-post (WordPress plugin) | Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Si | medium | 5.4 | 1% |
| CVE-2021-24208 | wp-page-builder (WordPress plugin) | The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScrip | medium | 5.4 | 1% |
| CVE-2022-4346 | all-in-one-security (WordPress plugin) | The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address. | medium | 5.3 | 1% |
| CVE-2023-5177 | vrm360 (WordPress plugin) | The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a paramete | medium | 5.3 | 1% |
| CVE-2021-4371 | wp-quick-front-end-editor (WordPress plugin) | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lack | medium | 4.3 | 1% |
| CVE-2024-3813 | tagdiv-composer (WordPress plugin) | The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_t | high | 8.8 | 1% |
| CVE-2019-25145 | contact-form (WordPress plugin) | The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.p | high | 7.2 | 1% |
| CVE-2023-39524 | prestashop/prestashop | PrestaShop boolean SQL injection | medium | 6.7 | 1% |
| CVE-2021-34648 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Rout | medium | 6.4 | 1% |
| CVE-2023-5163 | weather-atlas (WordPress plugin) | The Weather Atlas Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortcode-weather-atlas' shortcode in versio | medium | 6.4 | 1% |
| CVE-2018-17138 | jibu-pro (WordPress plugin) | The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name | medium | 5.4 | 1% |
| CVE-2018-17140 | quizlord (WordPress plugin) | The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php. | medium | 5.4 | 1% |
| CVE-2022-38145 | silverstripe/versioned-admin | Stored XSS in Compare Mode | medium | 5.4 | 1% |
| CVE-2015-10112 | wooframework-branding (WordPress plugin) | A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress. Affected is the function | medium | 4.3 | 1% |
| CVE-2015-1786 | zendframework/zendframework, zendframework/zend-validator | Zend Framework CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2026-40909 | wwbn/avideo | WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) | high | 8.7 | 1% |
| CVE-2022-43690 | concrete5/concrete5 | Concrete CMS vulnerable to Improper Authentication | medium | 6.3 | 1% |
| CVE-2023-3132 | mainwp-child (WordPress plugin) | The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insuf | medium | 5.9 | 1% |
| CVE-2021-24445 | my-site-audit (WordPress plugin) | The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high priv | medium | 5.5 | 1% |
| CVE-2021-24128 | team-members (WordPress plugin) | Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vuln | medium | 5.4 | 1% |
| CVE-2021-4018 | snipe/snipe-it | snipe-it is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-37248 | craftcms/cms | Craft CMS Cross site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-43556 | concrete5/concrete5 | Concrete CMS vulnerable to cross-site scripting in the text input field | medium | 4.2 | 1% |
| CVE-2023-3819 | pimcore/pimcore | Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | high | 7.6 | 1% |
| CVE-2021-4348 | ultimate-gdpr-\&-ccpa-compliance-toolkit (WordPress plugin) | The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_s | high | 7.5 | 1% |
| CVE-2026-84997 | react/http | react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU | high | 7.5 | 1% |