Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-31485 | api-platform/core, api-platform/graphql | GraphQL grant on a property might be cached with different objects | high | 7.5 | 1% |
| CVE-2022-1628 | cds-simple-seo (WordPress plugin) | The Simple SEO plugin for WordPress is vulnerable to attribute-based stored Cross-Site Scripting in versions up to, and including 1.7.91, du | medium | 6.4 | 1% |
| CVE-2022-2935 | image-hover-effects-ultimate (WordPress plugin) | The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media Image URL value that can be | medium | 6.4 | 1% |
| CVE-2023-5817 | neon-text (WordPress plugin) | The Neon text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's neontext_box shortcode in all versions up t | medium | 6.4 | 1% |
| CVE-2022-2404 | wp-popup-builder (WordPress plugin) | The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 1% |
| CVE-2024-13727 | memberspace (WordPress plugin) | The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 1% |
| CVE-2021-24258 | elements-kit-elementor-addons (WordPress plugin) | The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site | medium | 5.4 | 1% |
| CVE-2021-45919 | studio-42/elfinder | Studio 42 elFinder allows stored XSS | medium | 5.4 | 1% |
| CVE-2021-32709 | shopware/platform, shopware/core | Creation of order credits was not validated by acl in admin orders | low | 4.9 | 1% |
| CVE-2021-24332 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege | medium | 4.8 | 1% |
| CVE-2021-24418 | smooth-scroll-page-up\/down-buttons (WordPress plugin) | The Smooth Scroll Page Up/Down Buttons WordPress plugin through 1.4 does not properly sanitise and validate its psb_positioning settings, al | medium | 4.8 | 1% |
| CVE-2021-24419 | wp-youtube-lyte (WordPress plugin) | The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outp | medium | 4.8 | 1% |
| CVE-2021-24425 | mystickymenu (WordPress plugin) | The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not | medium | 4.8 | 1% |
| CVE-2021-24426 | backup-wd (WordPress plugin) | The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputt | medium | 4.8 | 1% |
| CVE-2021-40692 | moodle/moodle | Moodle Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2021-34636 | countdown-wpdevart-extended (WordPress plugin) | The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function | high | 8.8 | 1% |
| CVE-2021-42358 | contact-form-with-captcha (WordPress plugin) | The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-for | high | 8.8 | 1% |
| CVE-2021-42364 | stetic (WordPress plugin) | The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in | high | 8.8 | 1% |
| CVE-2023-30750 | cm-popup (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin | high | 8.5 | 1% |
| CVE-2024-45290 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file | high | 7.7 | 1% |
| CVE-2024-52306 | backpack/filemanager | FileManager Deserialization of Untrusted Data vulnerability | high | 7.6 | 1% |
| CVE-2019-15648 | insert-or-embed-articulate-content-into-wordpress (WordPress plugin) | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renam | medium | 6.5 | 1% |
| CVE-2024-11365 | security-force (WordPress plugin) | The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the | medium | 6.1 | 1% |
| CVE-2023-3565 | nilsteampassnet/teampass | TeamPass Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2024-0631 | duitku-social-payment-gateway (WordPress plugin) | The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 5.3 | 1% |
| CVE-2022-41994 | baserproject/basercms | baserCMS vulnerable to stored Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2022-42486 | baserproject/basercms | baserCMS vulnerable to stored Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2024-55227 | dolibarr/dolibarr | Dolibarr Cross-site Scripting vulnerability | low | 0.0 | 1% |
| CVE-2026-108358 | phpoffice/phpspreadsheet | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | high | 0.0 | 1% |
| CVE-2021-43559 | moodle/moodle | Moodle contains CSRF vulnerability | high | 8.8 | 1% |
| CVE-2022-1611 | bulk-page-creator (WordPress plugin) | The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them v | high | 8.8 | 1% |
| CVE-2022-1765 | hot-linked-image-cacher (WordPress plugin) | The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external doma | high | 8.8 | 1% |
| CVE-2024-5724 | photo-video-gallery-master (WordPress plugin) | The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via de | high | 8.8 | 1% |
| CVE-2024-7434 | ultrapress (WordPress plugin) | The UltraPress theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.2 via deserialization of | high | 8.8 | 1% |
| CVE-2026-38529 | krayin/laravel-crm | Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php | high | 8.8 | 1% |
| CVE-2024-37259 | wp-extended (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Too | high | 7.1 | 1% |
| CVE-2024-11722 | acf-frontend-form-element (WordPress plugin) | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and | medium | 5.9 | 1% |
| CVE-2017-18259 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2017-9838 | dolibarr/dolibarr | Dolibarr Cross-Site Scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2021-24301 | hotjar-connecticator (WordPress plugin) | The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. | medium | 5.4 | 1% |
| CVE-2021-24357 | foogallery (WordPress plugin) | In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is no | medium | 5.4 | 1% |
| CVE-2021-24369 | getpaid (WordPress plugin) | In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and | medium | 5.4 | 1% |
| CVE-2021-24408 | prismatic (WordPress plugin) | The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low | medium | 5.4 | 1% |
| CVE-2021-24414 | video-player-for-youtube (WordPress plugin) | The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users wit | medium | 5.4 | 1% |
| CVE-2021-24420 | request-a-quote (WordPress plugin) | The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, | medium | 5.4 | 1% |
| CVE-2021-24468 | leaflet-map (WordPress plugin) | The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, whi | medium | 5.4 | 1% |
| CVE-2021-24486 | simple-social-media-share-buttons (WordPress plugin) | The Simple Social Media Share Buttons – Social Sharing for Everyone WordPress plugin before 3.2.3 did not escape the align and like_button_s | medium | 5.4 | 1% |
| CVE-2021-24503 | popular-brand-icons---simple-icons (WordPress plugin) | The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as | medium | 5.4 | 1% |
| CVE-2021-24509 | page-view-count (WordPress plugin) | The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as | medium | 5.4 | 1% |
| CVE-2021-24513 | form-builder (WordPress plugin) | The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high | medium | 5.4 | 1% |