Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-51017 | pocketmine/pocketmine-mp | Uncapped length of skin data fields submitted by players | high | 7.5 | 1% |
| CVE-2023-54393 | pocketmine/pocketmine-mp | PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency | high | 7.5 | 1% |
| CVE-2026-71488 | league/commonmark | league/commonmark: Quadratic-time denial of service when parsing crafted Markdown | high | 7.5 | 1% |
| CVE-2024-8478 | amazonsimpleadmin (WordPress plugin) | The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, | high | 7.3 | 1% |
| CVE-2024-10152 | simple-certain-time-to-show-content (WordPress plugin) | The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in | high | 7.1 | 1% |
| CVE-2021-36841 | yith-maintenance-mode (WordPress plugin) | Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable para | medium | 6.9 | 1% |
| CVE-2022-43121 | intelliants/subrion | Subrion CMS is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2024-10802 | hash-elements (WordPress plugin) | The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_g | medium | 5.3 | 1% |
| CVE-2023-48708 | codeigniter4/shield | Insertion of Sensitive Information into Log | medium | 5.0 | 1% |
| CVE-2022-4198 | wp-social-sharing (WordPress plugin) | The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2026-45133 | symfony/symfony, symfony/yaml | Symfony hardened the parser when handling untrusted input | low | 0.0 | 1% |
| CVE-2026-45756 | symfony/json-path, symfony/symfony | Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS | low | 0.0 | 1% |
| CVE-2020-23264 | forkcms/forkcms | Cross-Site Request Forgery in forkcms | high | 8.8 | 1% |
| CVE-2024-7432 | unseen-blog (WordPress plugin) | The Unseen Blog theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of | high | 8.8 | 1% |
| CVE-2024-7433 | empowerment (WordPress plugin) | The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of | high | 8.8 | 1% |
| CVE-2023-1843 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing ca | medium | 6.5 | 1% |
| CVE-2024-12311 | email-subscribers-\&-newsletters (WordPress plugin) | The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL s | medium | 6.5 | 1% |
| CVE-2023-5128 | tcd-google-maps (WordPress plugin) | The TCD Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'map' shortcode in versions up to, and including, | medium | 6.4 | 1% |
| CVE-2023-5234 | woo-related-products-refresh-on-reload (WordPress plugin) | The Related Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'woo-related' shortcode in versio | medium | 6.4 | 1% |
| CVE-2021-24424 | wp-reset (WordPress plugin) | The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_data parameter when crea | medium | 5.4 | 1% |
| CVE-2023-44762 | concrete5/concrete5 | ConcreteCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-2567 | form-builder-cp (WordPress plugin) | The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-2710 | scroll-to-top (WordPress plugin) | The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin t | medium | 4.8 | 1% |
| CVE-2022-45810 | icegram-express (WordPress plugin) | Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automa | medium | 4.7 | 1% |
| CVE-2024-45134 | magento/community-edition | Magento Open Source Information Exposure vulnerability | low | 2.7 | 1% |
| CVE-2021-24803 | core-tweaks-wp-setup (WordPress plugin) | The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as c | high | 8.8 | 1% |
| CVE-2022-0499 | sermon-browser (WordPress plugin) | The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate th | high | 8.8 | 1% |
| CVE-2024-0594 | awesome-support (WordPress plugin) | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to union-based SQL Injection via the 'q' parame | high | 8.8 | 1% |
| CVE-2024-13681 | uncode (WordPress theme) | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_admin_get_oembed' fu | high | 7.5 | 1% |
| CVE-2024-47523 | librenms/librenms | LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature | high | 7.5 | 1% |
| CVE-2022-2937 | image-hover-effects-ultimate (WordPress plugin) | The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that c | medium | 6.4 | 1% |
| CVE-2023-5667 | tabs-pro (WordPress plugin) | The Tab Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and in | medium | 6.4 | 1% |
| CVE-2022-28378 | craftcms/cms | Cross-site Scripting in craftcms/cms | medium | 6.1 | 1% |
| CVE-2021-24168 | easy-contact-form-pro (WordPress plugin) | The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, | medium | 5.4 | 1% |
| CVE-2021-24211 | wordpress-related-posts (WordPress plugin) | The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the setti | medium | 5.4 | 1% |
| CVE-2023-28474 | concrete5/concrete5 | Stored cross site scripting on saved presets | medium | 5.4 | 1% |
| CVE-2022-4539 | web-application-firewall (WordPress plugin) | The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due | medium | 5.3 | 1% |
| CVE-2026-62988 | froxlor/froxlor | Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints | critical | 9.0 | 1% |
| CVE-2025-0724 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, an | high | 8.8 | 1% |
| CVE-2024-9861 | miniorange-firebase-sms-otp-verification (WordPress plugin) | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, | high | 8.1 | 1% |
| CVE-2022-4761 | post-views-count (WordPress plugin) | The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 1% |
| CVE-2022-4764 | simple-file-downloader (WordPress plugin) | The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 1% |
| CVE-2022-4793 | blog-designer (WordPress plugin) | The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a | medium | 5.4 | 1% |
| CVE-2023-0378 | greenshift (WordPress plugin) | The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/post | medium | 5.4 | 1% |
| CVE-2023-29290 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 5.3 | 1% |
| CVE-2024-11088 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via t | medium | 5.3 | 1% |
| CVE-2024-39899 | privatebin/privatebin | PrivateBin allows shortening of URLs for other domains | medium | 5.3 | 1% |
| CVE-2020-15245 | sylius/sylius | Ability to switch customer email address on account detail page and stay verified | medium | 4.3 | 1% |
| CVE-2023-3131 | mstore-api (WordPress plugin) | The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a c | medium | 4.3 | 1% |
| CVE-2022-3568 | imagemagick-engine (WordPress plugin) | The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up | high | 8.8 | 1% |