Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-55416 | pimcore/pimcore | Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration | high | 8.8 | 1% |
| CVE-2026-54176 | backpack/crud | Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check | medium | 6.5 | 1% |
| CVE-2023-5162 | options-for-twenty-seventeen (WordPress plugin) | The Options for Twenty Seventeen plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social-links' shortcode in versions | medium | 6.4 | 1% |
| CVE-2021-24309 | weekly-schedule (WordPress plugin) | The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a u | medium | 5.4 | 1% |
| CVE-2021-24412 | html5-audio-player (WordPress plugin) | The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, all | medium | 5.4 | 1% |
| CVE-2021-24413 | easy-twitter-feed (WordPress plugin) | The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a rol | medium | 5.4 | 1% |
| CVE-2021-24672 | one-user-avatar (WordPress plugin) | The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a rol | medium | 5.4 | 1% |
| CVE-2021-24682 | cool-tag-cloud (WordPress plugin) | The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users | medium | 5.4 | 1% |
| CVE-2021-24716 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjus | medium | 5.4 | 1% |
| CVE-2021-24723 | wp-reactions-lite (WordPress plugin) | The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient | medium | 5.4 | 1% |
| CVE-2021-24732 | dearflip (WordPress plugin) | The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode befor | medium | 5.4 | 1% |
| CVE-2021-24734 | compact-wp-audio-player (WordPress plugin) | The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a | medium | 5.4 | 1% |
| CVE-2021-24760 | pdf-viewer-block-for-gutenberg (WordPress plugin) | The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block, which could allow users with a role as | medium | 5.4 | 1% |
| CVE-2022-3000 | yetiforce/yetiforce-crm | YetiForce CRM vulnerable to stored Cross-site Scripting via LayoutEditor module | medium | 5.4 | 1% |
| CVE-2022-3004 | yetiforce/yetiforce-crm | YetiForce CRM vulnerable to stored Cross-site Scripting via WorkFlow module | medium | 5.4 | 1% |
| CVE-2022-3005 | yetiforce/yetiforce-crm | YetiForce CRM vulnerable to stored Cross-site Scripting via SlaPolicy module | medium | 5.4 | 1% |
| CVE-2023-7014 | molongui-authorship (WordPress plugin) | The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure i | medium | 5.3 | 1% |
| CVE-2021-25084 | advanced-cron-manager (WordPress plugin) | The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisatio | medium | 4.3 | 1% |
| CVE-2017-18510 | custom-sidebars (WordPress plugin) | The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions. | high | 8.8 | 1% |
| CVE-2017-18511 | custom-sidebars (WordPress plugin) | The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18512 | newsletter-by-supsystic (WordPress plugin) | The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18513 | responsive-menu (WordPress plugin) | The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface. | high | 8.8 | 1% |
| CVE-2017-18544 | invite-anyone (WordPress plugin) | The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF. | high | 8.8 | 1% |
| CVE-2017-18546 | jayj-quicktag (WordPress plugin) | The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2017-18547 | nelio-ab-testing (WordPress plugin) | The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms. | high | 8.8 | 1% |
| CVE-2018-20967 | wp-ultimate-csv-importer (WordPress plugin) | The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-20968 | wp-ultimate-exporter (WordPress plugin) | The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-20971 | church-admin (WordPress plugin) | The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan. | high | 8.8 | 1% |
| CVE-2018-20972 | companion-auto-update (WordPress plugin) | The companion-auto-update plugin before 3.2.1 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-20974 | js-jobs (WordPress plugin) | The js-jobs plugin before 1.0.7 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-6357 | acurax-social-media-widget (WordPress plugin) | The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via th | high | 8.8 | 1% |
| CVE-2022-2001 | dx-share-selection (WordPress plugin) | The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to | high | 8.8 | 1% |
| CVE-2022-2039 | livesupporti (WordPress plugin) | The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is | high | 8.8 | 1% |
| CVE-2024-42718 | croogo/croogo | Croogo CMS has a path traversal vulnerability | high | 7.5 | 1% |
| CVE-2024-8481 | special-text-boxes (WordPress plugin) | The The Special Text Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.2.4. | high | 7.3 | 1% |
| CVE-2023-7201 | everest-backup (WordPress plugin) | The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such | medium | 6.5 | 1% |
| CVE-2021-43324 | librenms/librenms | Cross-site Scripting in LibreNMS | medium | 6.1 | 1% |
| CVE-2020-1691 | moodle/moodle | Moodle XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2022-0426 | product-feed-pro-for-woocommerce (WordPress plugin) | The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an a | medium | 5.4 | 1% |
| CVE-2022-4577 | easy-testimonials (WordPress plugin) | The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 1% |
| CVE-2022-4626 | password-protect-wordpress (WordPress plugin) | The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page | medium | 5.4 | 1% |
| CVE-2022-4717 | strong-testimonials (WordPress plugin) | The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 1% |
| CVE-2022-4824 | wp-blog-and-widget (WordPress plugin) | The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 1% |
| CVE-2023-0150 | cloak-front-end-email (WordPress plugin) | The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 1% |
| CVE-2023-0174 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/ | medium | 5.4 | 1% |
| CVE-2023-34099 | shopware/shopware | Shopware improper mail validation vulnerability | medium | 5.3 | 1% |
| CVE-2022-3441 | rock-convert (WordPress plugin) | The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 1% |
| CVE-2017-9071 | modx/revolution | MODX Revolution XSS via HTTP Host header | medium | 4.7 | 1% |
| CVE-2024-42356 | shopware/core, shopware/platform | Shopware vulnerable to Server Side Template Injection in Twig using Context functions | high | 8.3 | 1% |
| CVE-2024-12274 | appointment-booking-calendar (WordPress plugin) | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to | high | 7.5 | 1% |