Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24517 | stop-spammers (WordPress plugin) | The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowin | medium | 5.4 | 1% |
| CVE-2021-24525 | shortcodes-ultimate (WordPress plugin) | The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. N | medium | 5.4 | 1% |
| CVE-2021-24528 | fluentsmtp (WordPress plugin) | The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin e | medium | 5.4 | 1% |
| CVE-2021-24534 | phonetrack-meu-site-manager (WordPress plugin) | The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in a | medium | 5.4 | 1% |
| CVE-2021-24540 | wonder-video-embed (WordPress plugin) | The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users w | medium | 5.4 | 1% |
| CVE-2021-24541 | wonder-pdf-embed (WordPress plugin) | The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with | medium | 5.4 | 1% |
| CVE-2021-24568 | addtoany-share-buttons (WordPress plugin) | The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, | medium | 5.4 | 1% |
| CVE-2021-24571 | hd-quiz (WordPress plugin) | The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, | medium | 5.4 | 1% |
| CVE-2021-24576 | easy-accordion (WordPress plugin) | The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion. | medium | 5.4 | 1% |
| CVE-2021-24582 | thinktwit (WordPress plugin) | The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its "Consumer key" setting before outputting it its settings page, le | medium | 5.4 | 1% |
| CVE-2021-24590 | cookie-notice-\&-consent-banner-for-gdpr-\&-ccpa-compliance (WordPress plugin) | The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent inj | medium | 5.4 | 1% |
| CVE-2021-24591 | highlight (WordPress plugin) | The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scr | medium | 5.4 | 1% |
| CVE-2021-24597 | you-shang (WordPress plugin) | The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues | medium | 5.4 | 1% |
| CVE-2021-24601 | wpfront-notification-bar (WordPress plugin) | The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high | medium | 5.4 | 1% |
| CVE-2021-24603 | site-reviews (WordPress plugin) | The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could a | medium | 5.4 | 1% |
| CVE-2021-24634 | recipe-card-blocks-for-gutenberg-\&-elementor (WordPress plugin) | The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Car | medium | 5.4 | 1% |
| CVE-2021-24637 | fonts (WordPress plugin) | The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as ro | medium | 5.4 | 1% |
| CVE-2021-24640 | gutenslider (WordPress plugin) | The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow us | medium | 5.4 | 1% |
| CVE-2021-24643 | wp-map-block (WordPress plugin) | The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as l | medium | 5.4 | 1% |
| CVE-2021-24670 | coolclock (WordPress plugin) | The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor tope | medium | 5.4 | 1% |
| CVE-2021-24671 | mx-time-zone-clocks (WordPress plugin) | The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allo | medium | 5.4 | 1% |
| CVE-2021-24678 | tooltip-glossary (WordPress plugin) | The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a | medium | 5.4 | 1% |
| CVE-2021-24680 | wp-travel-engine (WordPress plugin) | The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pr | medium | 5.4 | 1% |
| CVE-2021-24690 | chained-quiz (WordPress plugin) | The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings. | medium | 5.4 | 1% |
| CVE-2021-24699 | easy-media-download (WordPress plugin) | The Easy Media Download WordPress plugin before 1.1.7 does not escape the text argument of its shortcode, which could allow users with a rol | medium | 5.4 | 1% |
| CVE-2021-24712 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars. | medium | 5.4 | 1% |
| CVE-2021-24729 | logo-showcase-with-slick-slider (WordPress plugin) | The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role a | medium | 5.4 | 1% |
| CVE-2021-24738 | logo-carousel (WordPress plugin) | The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with | medium | 5.4 | 1% |
| CVE-2021-24743 | podcast-subscribe-buttons (WordPress plugin) | The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored | medium | 5.4 | 1% |
| CVE-2021-24745 | about-author-box (WordPress plugin) | The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in a | medium | 5.4 | 1% |
| CVE-2021-24751 | generateblocks (WordPress plugin) | The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow | medium | 5.4 | 1% |
| CVE-2021-24759 | pdf.js-viewer (WordPress plugin) | The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, which could allow user | medium | 5.4 | 1% |
| CVE-2021-24812 | betterlinks (WordPress plugin) | The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Si | medium | 5.4 | 1% |
| CVE-2021-24817 | ultimate-nofollow (WordPress plugin) | The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, allowing users with | medium | 5.4 | 1% |
| CVE-2021-24828 | mortgage-calculator\/loan-calculator (WordPress plugin) | The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode | medium | 5.4 | 1% |
| CVE-2021-24850 | insert-pages (WordPress plugin) | The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by us | medium | 5.4 | 1% |
| CVE-2021-24854 | qr-redirector (WordPress plugin) | The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a | medium | 5.4 | 1% |
| CVE-2021-24855 | display-post-metadata (WordPress plugin) | The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised | medium | 5.4 | 1% |
| CVE-2021-24930 | bookly (WordPress plugin) | The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputtin | medium | 5.4 | 1% |
| CVE-2022-2299 | allow-svg-files (WordPress plugin) | The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author | medium | 5.4 | 1% |
| CVE-2022-2371 | yaysmtp (WordPress plugin) | The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as | medium | 5.4 | 1% |
| CVE-2022-2391 | inspiro-pro (WordPress plugin) | The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to | medium | 5.4 | 1% |
| CVE-2023-0792 | thorsten/phpmyfaq | Code Injection in thorsten/phpmyfaq | medium | 5.4 | 1% |
| CVE-2020-23234 | lavalite/cms | Cross Site Scripting in LavaLite CMS | medium | 4.8 | 1% |
| CVE-2022-29406 | wp-team-manager (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in DynamicWebLab's WordPress Team | medium | 4.1 | 1% |
| CVE-2022-42494 | all-in-one-seo (WordPress plugin) | Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress. | low | 3.0 | 1% |
| CVE-2024-2472 | latepoint (WordPress plugin) | The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability | critical | 9.1 | 1% |
| CVE-2024-2694 | betheme (WordPress plugin) | The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of un | high | 8.8 | 1% |
| CVE-2026-11407 | pimcore/pimcore | Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed | high | 7.2 | 1% |
| CVE-2019-14327 | custom-simple-rss (WordPress plugin) | A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings. | medium | 6.5 | 1% |