Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0075 | amazonjs (WordPress plugin) | The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 1% |
| CVE-2022-1322 | coming-soon (WordPress plugin) | The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow hig | medium | 4.8 | 1% |
| CVE-2022-2361 | wp-social-chat (WordPress plugin) | The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2026-21446 | bagisto/bagisto | Bagisto Missing Authentication on Installer API Endpoints | critical | 9.8 | 1% |
| CVE-2025-0682 | addons (WordPress plugin) | The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_ | high | 8.8 | 1% |
| CVE-2021-34625 | wp-upload-restriction (WordPress plugin) | A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject | medium | 6.4 | 1% |
| CVE-2021-4168 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.3 | 1% |
| CVE-2025-2689 | yiisoft/yii2-dev | yiisoft Yii2 Deserialization of Untrusted Data | medium | 6.3 | 1% |
| CVE-2023-28332 | moodle/moodle | Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional | medium | 6.1 | 1% |
| CVE-2023-45819 | tinymce/tinymce | TinyMCE XSS vulnerability in notificationManager.open API | medium | 6.1 | 1% |
| CVE-2024-11371 | theatre (WordPress plugin) | The Theater for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appro | medium | 6.1 | 1% |
| CVE-2024-29644 | dcat/laravel-admin | dcat-admin Cross Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-0387 | remdex/livehelperchat | Cross-site Scripting in livehelperchat | medium | 5.4 | 1% |
| CVE-2022-0950 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2025-24425 | magento/community-edition, magento/project-community-edition | Magento Business Logic Error vulnerability | medium | 5.3 | 1% |
| CVE-2024-12585 | propertyhive (WordPress plugin) | The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 1% |
| CVE-2021-24421 | jobsearch-wp-job-board (WordPress plugin) | The WP JobSearch WordPress plugin before 1.7.4 did not sanitise or escape multiple of its parameters from the my-resume page before outputti | medium | 5.4 | 1% |
| CVE-2023-2029 | prepost-seo (WordPress plugin) | The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perf | medium | 4.8 | 1% |
| CVE-2015-10078 | resend-welcome-email (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress. This issue | low | 3.5 | 1% |
| CVE-2016-15027 | post-duplicator (WordPress plugin) | A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the | low | 3.5 | 1% |
| CVE-2021-24620 | simple-e-commerce-shopping-cart (WordPress plugin) | The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downl | high | 8.8 | 1% |
| CVE-2021-24804 | simple-jwt-login (WordPress plugin) | The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged | high | 8.8 | 1% |
| CVE-2024-9946 | super-socializer (WordPress plugin) | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in | high | 8.1 | 1% |
| CVE-2025-24427 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 6.5 | 1% |
| CVE-2021-4366 | pwa-for-wp-\&-amp (WordPress plugin) | The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_fe | medium | 6.3 | 1% |
| CVE-2017-9336 | wp-editor.md (WordPress plugin) | The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post. | medium | 6.1 | 1% |
| CVE-2022-34857 | sp-client-document-manager (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPress | medium | 6.1 | 1% |
| CVE-2023-0428 | watu-quiz (WordPress plugin) | The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 6.1 | 1% |
| CVE-2019-17203 | nilsteampassnet/teampass | TeamPass Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2019-17204 | nilsteampassnet/teampass | TeamPass Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-24180 | related-posts (WordPress plugin) | Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scri | medium | 5.4 | 1% |
| CVE-2021-24187 | seo-redirection (WordPress plugin) | The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scri | medium | 5.4 | 1% |
| CVE-2025-55745 | unopim/unopim | UnoPim has CSV Injection on Quick Export feature | low | 0.0 | 1% |
| CVE-2026-33942 | saloonphp/saloon | Saloon has insecure deserialization in AccessTokenAuthenticator | high | 0.0 | 1% |
| CVE-2024-10687 | contest-gallery (WordPress plugin) | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plug | critical | 9.8 | 1% |
| CVE-2024-10008 | learning-management-system (WordPress plugin) | The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modifi | high | 8.8 | 1% |
| CVE-2026-72695 | getgrav/grav | Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion | high | 8.1 | 1% |
| CVE-2024-4887 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the ' | high | 7.5 | 1% |
| CVE-2025-2025 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing cap | medium | 6.5 | 1% |
| CVE-2024-2101 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appoin | medium | 5.7 | 1% |
| CVE-2017-1000495 | quickapps/cms | QuickApps CMS Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-0506 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2017-14740 | genix/cms | GeniXCMS Cross-site scripting (XSS) vulnerability | medium | 4.8 | 1% |
| CVE-2022-23981 | perfect-woocommerce-brands (WordPress plugin) | The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4). | medium | 4.3 | 1% |
| CVE-2022-29417 | shortpixel-adaptive-images (WordPress plugin) | Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low u | medium | 4.3 | 1% |
| CVE-2023-22734 | shopware/core, shopware/platform | Shopware has Improper Input Validation issue in newsletter subscription | medium | 4.3 | 1% |
| CVE-2023-51419 | bertha-ai (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue a | critical | 10.0 | 1% |
| CVE-2019-19979 | wp-maintenance (WordPress plugin) | A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject mal | high | 8.8 | 1% |
| CVE-2021-24696 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks | high | 8.8 | 1% |
| CVE-2024-3562 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop cus | high | 8.8 | 1% |