Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12274 | appointment-booking-calendar (WordPress plugin) | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to | high | 7.5 | 1% |
| CVE-2024-8746 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation v | high | 7.5 | 1% |
| CVE-2024-8623 | wp-meta-data-filter-and-taxonomy-filter (WordPress plugin) | The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an | high | 7.3 | 1% |
| CVE-2023-3081 | wp-mail-logging (WordPress plugin) | The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1 | high | 7.2 | 1% |
| CVE-2020-36711 | avada (WordPress theme) | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, | medium | 6.4 | 1% |
| CVE-2021-34641 | wp-seopress (WordPress plugin) | The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleD | medium | 6.4 | 1% |
| CVE-2021-44277 | librenms/librenms | Cross-site Scripting in LibreNMS | medium | 6.1 | 1% |
| CVE-2021-44279 | librenms/librenms | Cross-site Scripting in LibreNMS | medium | 6.1 | 1% |
| CVE-2022-4310 | slimstat-analytics (WordPress plugin) | The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthent | medium | 6.1 | 1% |
| CVE-2022-36347 | alpine-photo-tile-for-pinterest (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at Wor | medium | 4.8 | 1% |
| CVE-2023-29288 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2023-29295 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2023-29296 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2023-4686 | wp-customer-reviews (WordPress plugin) | The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the | medium | 4.3 | 1% |
| CVE-2024-56517 | tltneon/lgsl | LGSL has a reflected XSS at /lgsl_files/lgsl_list.php | medium | 0.0 | 1% |
| CVE-2024-8855 | wordpress-auction (WordPress plugin) | The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allow | critical | 9.8 | 1% |
| CVE-2023-6383 | debug-log-manager (WordPress plugin) | The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download | high | 7.5 | 1% |
| CVE-2024-43440 | moodle/moodle | Moodle LFI vulnerability when restoring malformed block backups | high | 7.5 | 1% |
| CVE-2021-24920 | statcounter (WordPress plugin) | The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high p | medium | 4.8 | 1% |
| CVE-2022-2239 | request-a-quote (WordPress plugin) | The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as a | medium | 4.8 | 1% |
| CVE-2024-36676 | ssddanbrown/bookstack | BookStack Incorrect Access Control vulnerability | high | 8.2 | 1% |
| CVE-2021-24500 | workreap (WordPress plugin) | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct obj | high | 8.1 | 1% |
| CVE-2026-59978 | adminneo-org/adminneo | AdminNeo: version-cache array injection causes persistent denial of service | high | 7.5 | 1% |
| CVE-2021-24982 | child-theme-generator (WordPress plugin) | The Child Theme Generator WordPress plugin through 2.2.7 does not sanitise escape the parade parameter before outputting it back, leading to | medium | 6.4 | 1% |
| CVE-2023-2305 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_ | medium | 6.4 | 1% |
| CVE-2021-32050 | mongodb/mongodb | MongoDB Driver may publish events containing authentication-related data | medium | 4.2 | 1% |
| CVE-2026-40911 | wwbn/avideo | WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks | critical | 10.0 | 1% |
| CVE-2022-0134 | anycomment (WordPress plugin) | The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers | high | 8.8 | 1% |
| CVE-2023-0550 | quick-restaurant-menu (WordPress plugin) | The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. Th | high | 8.1 | 1% |
| CVE-2024-5807 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP file | high | 7.2 | 1% |
| CVE-2022-0914 | export-all-urls (WordPress plugin) | The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logge | medium | 6.5 | 1% |
| CVE-2021-24250 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in | medium | 5.4 | 1% |
| CVE-2021-24763 | perfect-survey (WordPress plugin) | The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, | high | 8.8 | 1% |
| CVE-2023-7204 | wp-staging (WordPress plugin) | The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides | high | 7.5 | 1% |
| CVE-2024-29200 | kimai/kimai | Kimai API returns timesheet entries a user should not be authorized to view | medium | 6.8 | 1% |
| CVE-2022-2116 | contact-form-db---elementor (WordPress plugin) | The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, le | medium | 6.1 | 1% |
| CVE-2022-2241 | featured-image-from-url (WordPress plugin) | The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could a | medium | 6.1 | 1% |
| CVE-2022-2378 | easy-student-results (WordPress plugin) | The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2022-2386 | crowdsignal-dashboard (WordPress plugin) | The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2022-23655 | october/system | Missing server signature validation in OctoberCMS | medium | 4.8 | 1% |
| CVE-2022-2448 | resmush.it-image-optimizer (WordPress plugin) | The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-2629 | top-bar (WordPress plugin) | The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which | medium | 4.8 | 1% |
| CVE-2022-2635 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2020-26229 | typo3/cms, typo3/cms-core | XML External Entity in Dashboard Widget | low | 3.7 | 1% |
| CVE-2026-59941 | dompdf/dompdf | Dompdf: Uncontrolled resource consumption based on declared BMP dimensions | medium | 0.0 | 1% |
| CVE-2025-46349 | yeswiki/yeswiki | YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting | high | 7.6 | 1% |
| CVE-2023-0298 | grumpydictator/firefly-iii | Improper Authorization in grumpydictator/firefly-iii | medium | 6.5 | 1% |
| CVE-2024-45118 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 6.5 | 1% |
| CVE-2022-4937 | wc-frontend-manager (WordPress plugin) | The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and includin | medium | 6.3 | 1% |
| CVE-2015-8759 | typo3/cms | TYPO3 Cross-site Scripting vulnerability | medium | 5.4 | 1% |