Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-5651 | dark-mode (WordPress plugin) | An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_start parameter. | medium | 4.8 | 1% |
| CVE-2018-5652 | dark-mode (WordPress plugin) | An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_end parameter. | medium | 4.8 | 1% |
| CVE-2021-24489 | request-a-quote (WordPress plugin) | The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading | medium | 4.8 | 1% |
| CVE-2021-24612 | sociable (WordPress plugin) | The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in the admins dashboar | medium | 4.8 | 1% |
| CVE-2021-24622 | customer-service-software-\&-support-ticket-system (WordPress plugin) | The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputti | medium | 4.8 | 1% |
| CVE-2021-24624 | mp3-audio-player-for-music\,-radio-\&-podcast (WordPress plugin) | The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of | medium | 4.8 | 1% |
| CVE-2021-24715 | wp-sitemap-page (WordPress plugin) | The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 1% |
| CVE-2021-24722 | restaurant-menu (WordPress plugin) | The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, whi | medium | 4.8 | 1% |
| CVE-2021-24736 | shared-files (WordPress plugin) | The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before | medium | 4.8 | 1% |
| CVE-2021-24740 | tutor-lms (WordPress plugin) | The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow hig | medium | 4.8 | 1% |
| CVE-2021-24789 | flat-preloader (WordPress plugin) | The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, whi | medium | 4.8 | 1% |
| CVE-2021-24793 | wpematico-rss-feed-fetcher (WordPress plugin) | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an at | medium | 4.8 | 1% |
| CVE-2026-16639 | drupal/i18n_sso | In a scenario of a multilingual website with different domain names per language, this module enables you to be automati | unknown | 0.0 | 1% |
| CVE-2024-11286 | jobcareer (WordPress plugin) | The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to the plu | critical | 9.8 | 1% |
| CVE-2024-8853 | webo-facto-connector (WordPress plugin) | The Webo-facto plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.40 due to insufficient restric | critical | 9.8 | 1% |
| CVE-2018-5368 | srbtranslatin (WordPress plugin) | The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2018-5658 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php. | high | 8.8 | 1% |
| CVE-2023-5060 | librenms/librenms | Cross site scripting in librenms | high | 8.4 | 1% |
| CVE-2021-27911 | mautic/core | XSS vulnerability on contacts view | high | 8.3 | 1% |
| CVE-2024-12773 | altra-side-menu (WordPress plugin) | The Altra Side Menu WordPress plugin through 2.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin | high | 7.2 | 1% |
| CVE-2026-26045 | moodle/moodle | Moodle has a Remote Code Execution risk via file restore | high | 7.2 | 1% |
| CVE-2023-4422 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | medium | 6.8 | 1% |
| CVE-2024-34081 | mantisbt/mantisbt | Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting | medium | 6.6 | 1% |
| CVE-2022-2430 | visualcomposer (WordPress plugin) | The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versio | medium | 6.4 | 1% |
| CVE-2022-2516 | visualcomposer (WordPress plugin) | The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in ver | medium | 6.4 | 1% |
| CVE-2022-2936 | image-hover-effects-ultimate (WordPress plugin) | The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Video Link values that can be added t | medium | 6.4 | 1% |
| CVE-2023-28475 | concrete5/concrete5 | Reflected cross site scripting | medium | 6.1 | 1% |
| CVE-2023-6565 | iwp-client (WordPress plugin) | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via | medium | 5.9 | 1% |
| CVE-2023-5054 | super-store-finder (WordPress plugin) | The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and inclu | medium | 5.8 | 1% |
| CVE-2020-36709 | page-builder-kingcomposer (WordPress plugin) | The Page Builder: KingComposer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via via shortcode in versions before 2.9.4 | medium | 5.5 | 1% |
| CVE-2021-4172 | showdoc/showdoc | Cross-site Scripting in showdoc | medium | 5.4 | 1% |
| CVE-2022-0256 | pimcore/pimcore | pimcore is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2026-46640 | twig/twig | Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation | high | 0.0 | 1% |
| CVE-2023-4321 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | high | 8.3 | 1% |
| CVE-2024-13777 | zoomsounds (WordPress plugin) | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, | high | 8.1 | 1% |
| CVE-2021-4111 | yetiforce/yetiforce-crm | YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number | high | 7.3 | 1% |
| CVE-2020-1692 | moodle/moodle | Cross-Site Request Forgery in Moodle | medium | 6.5 | 1% |
| CVE-2024-0365 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statemen | medium | 6.5 | 1% |
| CVE-2022-0447 | post-grid (WordPress plugin) | The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response | medium | 6.4 | 1% |
| CVE-2023-38708 | pimcore/pimcore | Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction | medium | 6.3 | 1% |
| CVE-2020-19709 | feehi/feehicms | Cross-site scripting in feehicms | medium | 6.1 | 1% |
| CVE-2020-22330 | intelliants/subrion | Subrion Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2022-0938 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2022-0333 | moodle/moodle | Insufficient user authorization in Moodle | low | 3.8 | 1% |
| CVE-2021-3944 | ssddanbrown/bookstack | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) | low | 3.1 | 1% |
| CVE-2024-22406 | shopware/core, shopware/platform | Blind SQL injection in shopware | critical | 9.3 | 1% |
| CVE-2021-41113 | typo3/cms, typo3/cms-core | Cross-Site-Request-Forgery in Backend | high | 8.8 | 1% |
| CVE-2023-2351 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability ch | medium | 6.5 | 1% |
| CVE-2017-8376 | genix/cms | GeniXCMS Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2022-0395 | remdex/livehelperchat | Cross-site Scripting in LiveHelperChat | medium | 5.4 | 1% |