Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4239 | workreap (WordPress plugin) | The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it i | medium | 6.5 | 1% |
| CVE-2024-37499 | online-booking-\&-scheduling-calendar (WordPress plugin) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vCita Online Booking & Scheduling Calendar f | medium | 6.5 | 1% |
| CVE-2024-13853 | seo-tools (WordPress plugin) | The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 1% |
| CVE-2022-2600 | auto-hyperlink-urls (WordPress plugin) | The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbi | medium | 5.4 | 1% |
| CVE-2023-0070 | responsivevoice-text-to-speech (WordPress plugin) | The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before output | medium | 5.4 | 1% |
| CVE-2018-5369 | srbtranslatin (WordPress plugin) | The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificat | medium | 4.8 | 1% |
| CVE-2018-5660 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_su | medium | 4.8 | 1% |
| CVE-2018-5662 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title | medium | 4.8 | 1% |
| CVE-2018-5663 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_li | medium | 4.8 | 1% |
| CVE-2018-5665 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height pa | medium | 4.8 | 1% |
| CVE-2018-5666 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color param | medium | 4.8 | 1% |
| CVE-2018-5670 | booking-calendar (WordPress plugin) | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] p | medium | 4.8 | 1% |
| CVE-2018-5671 | booking-calendar (WordPress plugin) | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_ | medium | 4.8 | 1% |
| CVE-2018-5672 | booking-calendar (WordPress plugin) | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] paramet | medium | 4.8 | 1% |
| CVE-2024-2543 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_u | medium | 4.3 | 1% |
| CVE-2023-5917 | phpbb/phpbb | phpBB's Smiley Pack acp_icons.php main pack vulnerable to cross site scripting | low | 2.4 | 1% |
| CVE-2024-56519 | tecnickcom/tcpdf | TCPDF lacks SVG sanitization | medium | 0.0 | 1% |
| CVE-2026-41587 | ci4-cms-erp/ci4ms | CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution | high | 0.0 | 1% |
| CVE-2023-52182 | ari-stream-quiz (WordPress plugin) | Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – | critical | 9.9 | 1% |
| CVE-2024-7419 | wp-all-export (WordPress plugin) | The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom | high | 8.3 | 1% |
| CVE-2023-5740 | wp-facebook-messenger (WordPress plugin) | The Live Chat with Facebook Messenger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'messenger' shortco | medium | 6.4 | 1% |
| CVE-2024-13538 | bigbuy-wc-dropshipping-connector (WordPress plugin) | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and incl | medium | 5.3 | 1% |
| CVE-2021-24427 | w3-total-cache (WordPress plugin) | The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use J | medium | 4.8 | 1% |
| CVE-2022-0674 | kunze-law (WordPress plugin) | The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-0700 | simple-tracking (WordPress plugin) | The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to pe | medium | 4.8 | 1% |
| CVE-2022-0702 | petfinder-listings (WordPress plugin) | The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform | medium | 4.8 | 1% |
| CVE-2022-0703 | gd-mylist (WordPress plugin) | The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege users such as admin | medium | 4.8 | 1% |
| CVE-2022-0763 | microweber/microweber | Cross-site Scripting in microweber | medium | 4.8 | 1% |
| CVE-2022-0772 | librenms/librenms | Cross site scripting in LibreNMS | medium | 4.8 | 1% |
| CVE-2022-0906 | microweber/microweber | Unrestricted file upload leads to stored cross-site scripting in Microweber | medium | 4.8 | 1% |
| CVE-2022-1324 | event-timeline (WordPress plugin) | The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such a | medium | 4.8 | 1% |
| CVE-2022-2152 | duplicate-page-and-post (WordPress plugin) | The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2022-2278 | featured-image-from-url (WordPress plugin) | The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could al | medium | 4.8 | 1% |
| CVE-2022-2305 | popups (WordPress plugin) | The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 1% |
| CVE-2022-2325 | invitation-based-registrations (WordPress plugin) | The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 1% |
| CVE-2022-2328 | flexi-quote-rotator (WordPress plugin) | The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admi | medium | 4.8 | 1% |
| CVE-2022-2372 | yaysmtp (WordPress plugin) | The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-2384 | digital-publications-by-supsystic (WordPress plugin) | The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users | medium | 4.8 | 1% |
| CVE-2022-2395 | weforms (WordPress plugin) | The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform | medium | 4.8 | 1% |
| CVE-2022-2398 | wordpress-comments-fields (WordPress plugin) | The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to pe | medium | 4.8 | 1% |
| CVE-2022-2409 | rough-chart (WordPress plugin) | The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform | medium | 4.8 | 1% |
| CVE-2022-2410 | mtouch-quiz (WordPress plugin) | The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2022-2411 | auto-more-tag (WordPress plugin) | The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2022-2412 | better-tag-cloud (WordPress plugin) | The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 1% |
| CVE-2022-2423 | dw-promobar (WordPress plugin) | The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2022-2424 | google-maps-anywhere (WordPress plugin) | The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-2425 | wp-ds-blog-map (WordPress plugin) | The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-2426 | thinkific-uploader (WordPress plugin) | The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-2709 | float-to-top-button (WordPress plugin) | The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-3021 | slickr-flickr (WordPress plugin) | The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to p | medium | 4.8 | 1% |