Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-31046 | typo3/cms, typo3/cms-core | Information Disclosure via Export Module | medium | 4.3 | 1% |
| CVE-2006-10001 | subscribe-to-comments (WordPress plugin) | A vulnerability, which was classified as problematic, was found in Subscribe to Comments Plugin up to 2.0.7 on WordPress. This affects an un | low | 3.5 | 1% |
| CVE-2023-28819 | concrete5/concrete5 | Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names | low | 3.5 | 1% |
| CVE-2026-8237 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR | medium | 0.0 | 1% |
| CVE-2021-24487 | st-daily-tip (WordPress plugin) | The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' set | high | 8.8 | 1% |
| CVE-2017-8099 | whizz (WordPress plugin) | There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's statu | high | 8.1 | 1% |
| CVE-2022-0179 | snipe/snipe-it | Incorrect Default Permissions and Improper Access Control in snipe-it | medium | 5.4 | 1% |
| CVE-2023-0901 | pixelfed/pixelfed | Pixelfed allows user enumeration via reset password functionality | medium | 5.3 | 1% |
| CVE-2023-2299 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via th | medium | 5.3 | 1% |
| CVE-2022-2215 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2020-36668 | backup (WordPress plugin) | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and i | medium | 4.3 | 1% |
| CVE-2021-34645 | wp-easycart (WordPress plugin) | The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function fou | high | 8.8 | 1% |
| CVE-2025-0822 | bit-assist (WordPress plugin) | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This m | medium | 6.5 | 1% |
| CVE-2024-4551 | yotuwp-easy-youtube-embed (WordPress plugin) | The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions u | medium | 6.4 | 1% |
| CVE-2020-36663 | artesaos/seotools | Artesãos SEOTools Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2020-36664 | artesaos/seotools | Artesãos SEOTools Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2024-11370 | subaccounts-for-woocommerce (WordPress plugin) | The Subaccounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without | medium | 6.1 | 1% |
| CVE-2022-34297 | yiisoft/yii2-gii | Yii2 Gii Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-4939 | salesmanago (WordPress plugin) | The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a wea | medium | 5.3 | 1% |
| CVE-2023-5533 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding | medium | 5.3 | 1% |
| CVE-2021-24516 | planso-forms (WordPress plugin) | The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high priv | medium | 4.8 | 1% |
| CVE-2026-40476 | webonyx/graphql-php | graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation | high | 7.5 | 1% |
| CVE-2023-36806 | contao/core-bundle | Cross site scripting via input unit widget | medium | 6.6 | 1% |
| CVE-2023-0609 | wallabag/wallabag | wallabag contains Improper Authorization via export feature | medium | 6.5 | 1% |
| CVE-2017-7390 | movingbytes/social-network | SocialNetwork Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2024-3469 | generatepress (WordPress plugin) | The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and inc | medium | 6.1 | 1% |
| CVE-2021-25048 | kingcomposer (WordPress plugin) | The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing | medium | 5.4 | 1% |
| CVE-2023-4297 | mmm-simple-file-list (WordPress plugin) | The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated us | medium | 4.3 | 1% |
| CVE-2017-20177 | wangguard (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in WangGuard Plugin 1.8.0 on WordPress. Affected by this issue is the f | low | 3.5 | 1% |
| CVE-2025-48490 | lomkit/laravel-rest-api | Laravel Rest Api has a Search Validation Bypass | medium | 0.0 | 1% |
| CVE-2026-86200 | pocketmine/pocketmine-mp | PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket | medium | 0.0 | 1% |
| CVE-2026-33648 | wwbn/avideo | AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path | high | 8.8 | 1% |
| CVE-2024-47049 | czim/file-handling | czim/file-handling vulnerable to SSRF and directory traversal | high | 8.2 | 1% |
| CVE-2026-45260 | pimcore/pimcore | Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling | high | 8.1 | 1% |
| CVE-2021-4451 | ninjafirewall (WordPress plugin) | The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This all | medium | 6.6 | 1% |
| CVE-2022-3930 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of | medium | 6.5 | 1% |
| CVE-2021-24292 | happy-addons-for-elementor (WordPress plugin) | The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number o | medium | 5.4 | 1% |
| CVE-2023-1971 | yuan1994/tpadmin | yuan1994 tpAdmin vulnerable to Server-Side Request Forgery | medium | 4.9 | 1% |
| CVE-2023-7247 | login-as-user-or-customer-\(user-switching\) (WordPress plugin) | The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site. | medium | 4.9 | 1% |
| CVE-2022-3139 | we\'re-open (WordPress plugin) | The We’re Open! WordPress plugin before 1.42 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-2443 | freemind-wp-browser (WordPress plugin) | The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due t | high | 8.8 | 1% |
| CVE-2024-2505 | gamipress (WordPress plugin) | The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Author | high | 8.1 | 1% |
| CVE-2026-25524 | openmage/magento-lts | OpenMage LTS: Phar Deserialization leads to Remote Code Execution | high | 8.1 | 1% |
| CVE-2026-63222 | codeigniter4/framework | CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames | high | 7.5 | 1% |
| CVE-2023-41336 | symfony/ux-autocomplete | Prevent injection of invalid entity ids for "autocomplete" fields | medium | 6.5 | 1% |
| CVE-2023-5706 | vk-blocks (WordPress plugin) | The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all | medium | 6.4 | 1% |
| CVE-2022-0539 | ptrofimov/beanstalk_console | Cross-site Scripting in Beanstalk console | medium | 6.3 | 1% |
| CVE-2022-27463 | wwbn/avideo | Open redirect in wwbn/avideo | medium | 6.1 | 1% |
| CVE-2021-24635 | visual-link-preview (WordPress plugin) | The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displaye | medium | 5.4 | 1% |
| CVE-2023-0061 | product-reviews-for-woocommerce (WordPress plugin) | The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes be | medium | 5.4 | 1% |