Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-54348 | froxlor/froxlor | Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration | high | 7.2 | 1% |
| CVE-2023-5161 | modal-window (WordPress plugin) | The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 du | medium | 6.4 | 1% |
| CVE-2023-36828 | statamic/cms | Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG | medium | 5.5 | 1% |
| CVE-2021-4132 | remdex/livehelperchat | livehelperchat is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-4347 | advanced-shipment-tracking-for-woocommerce (WordPress plugin) | The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vul | critical | 9.9 | 1% |
| CVE-2025-4796 | wp-event-solution (WordPress plugin) | The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. Th | high | 8.8 | 1% |
| CVE-2023-0749 | ocean-extra (WordPress plugin) | The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowin | medium | 6.5 | 1% |
| CVE-2023-0890 | shortcodes-ultimate (WordPress plugin) | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some sho | medium | 6.5 | 1% |
| CVE-2023-0911 | shortcodes-ultimate (WordPress plugin) | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the | medium | 6.5 | 1% |
| CVE-2023-1371 | w4-post-list (WordPress plugin) | The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content | medium | 6.5 | 1% |
| CVE-2024-1043 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check | medium | 6.5 | 1% |
| CVE-2023-47636 | pimcore/admin-ui-classic-bundle | pimcore/admin-ui-classic-bundle Full Path Disclosure via re-export document | medium | 5.3 | 1% |
| CVE-2023-4933 | wp-job-openings (WordPress plugin) | The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job | medium | 5.3 | 1% |
| CVE-2021-24134 | constant-contact-forms (WordPress plugin) | Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored | medium | 4.8 | 1% |
| CVE-2021-24686 | svg-support (WordPress plugin) | The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which | medium | 4.8 | 1% |
| CVE-2021-25049 | mobile-events-manager (WordPress plugin) | The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users | medium | 4.8 | 1% |
| CVE-2022-0884 | profile-builder (WordPress plugin) | The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high pr | medium | 4.8 | 1% |
| CVE-2022-0958 | mark-posts (WordPress plugin) | The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site | medium | 4.8 | 1% |
| CVE-2021-24800 | dw-question-\&-answer (WordPress plugin) | The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, | medium | 4.3 | 1% |
| CVE-2022-0442 | userswp (WordPress plugin) | The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for us | medium | 4.3 | 1% |
| CVE-2022-0762 | microweber/microweber | Exposure of Resource to Wrong Sphere in microweber | medium | 4.3 | 1% |
| CVE-2022-1349 | wpqa-builder (WordPress plugin) | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value p | medium | 4.3 | 1% |
| CVE-2024-0610 | woo-payment-gateway-for-piraeus-bank (WordPress plugin) | The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'MerchantReference | critical | 9.8 | 1% |
| CVE-2023-5239 | security-\&-malware-scan (WordPress plugin) | The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, all | high | 7.5 | 1% |
| CVE-2024-48224 | funadmin/funadmin | SQL injection in funadmin | high | 7.5 | 1% |
| CVE-2024-13628 | wp-pricing-table (WordPress plugin) | The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 1% |
| CVE-2023-5318 | microweber/microweber | Microweber uses hard coded credentials | medium | 5.8 | 1% |
| CVE-2023-33196 | craftcms/cms | Craft CMS stored XSS in review volume | medium | 5.5 | 1% |
| CVE-2018-1999021 | gleez/cms | Gleez Cms Cross-site Scripting in Profile Page | medium | 5.4 | 1% |
| CVE-2021-24127 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was v | medium | 5.4 | 1% |
| CVE-2022-1755 | svg-support (WordPress plugin) | The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as aut | medium | 5.4 | 1% |
| CVE-2024-1479 | wp-show-posts (WordPress plugin) | The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the w | medium | 5.3 | 1% |
| CVE-2024-1118 | podlove-subscribe-button (WordPress plugin) | The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subsc | high | 8.8 | 1% |
| CVE-2025-66299 | getgrav/grav | Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection) | high | 8.8 | 1% |
| CVE-2022-38135 | photospace (WordPress plugin) | Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher | medium | 5.4 | 1% |
| CVE-2018-5667 | read-and-understood (WordPress plugin) | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_va | medium | 4.8 | 1% |
| CVE-2018-5668 | read-and-understood (WordPress plugin) | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_va | medium | 4.8 | 1% |
| CVE-2021-24330 | cartflows (WordPress plugin) | The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixe | medium | 4.8 | 1% |
| CVE-2021-24331 | smooth-scroll-page-up\/down-buttons (WordPress plugin) | The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psb_distance | medium | 4.8 | 1% |
| CVE-2021-24450 | profilepress (WordPress plugin) | The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sani | medium | 4.8 | 1% |
| CVE-2026-33647 | wwbn/avideo | AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload | high | 8.8 | 1% |
| CVE-2022-36284 | affiliate-for-woocommerce (WordPress plugin) | Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change th | medium | 6.4 | 1% |
| CVE-2018-25050 | harvesthq/chosen | Harvest Chosen vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-1530 | remdex/livehelperchat | An attacker can execute malicious javascript in Live Helper Chat | medium | 6.1 | 1% |
| CVE-2023-33195 | craftcms/cms | Craft CMS XSS in RSS widget feed | medium | 6.1 | 1% |
| CVE-2024-0611 | master-slider (WordPress plugin) | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slides callback functi | medium | 4.4 | 1% |
| CVE-2025-52353 | badaso/core | Badaso CMS file upload vulnerability | high | 0.0 | 1% |
| CVE-2026-55634 | pimcore/pimcore | Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name | critical | 9.9 | 1% |
| CVE-2017-18366 | intelliants/subrion | Subrion CMS vulnerable to CSRF in blog/delete | high | 8.8 | 1% |
| CVE-2018-16387 | elefant/cms | Elefant CMS CSRF Vulnerability | high | 8.8 | 1% |