Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-44011 | craftcms/cms | Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior | high | 0.0 | 1% |
| CVE-2024-9265 | echo-rss-feed-post-generator (WordPress plugin) | The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. Thi | critical | 9.8 | 1% |
| CVE-2022-3852 | vr-calendar-sync (WordPress plugin) | The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to mis | high | 8.8 | 1% |
| CVE-2024-5455 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, | high | 8.8 | 1% |
| CVE-2025-5012 | workreap (WordPress plugin) | The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due | high | 8.8 | 1% |
| CVE-2024-7031 | filester (WordPress plugin) | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | high | 7.5 | 1% |
| CVE-2021-41924 | krayin/laravel-crm | Cross-site Scripting in krayin/laravel-crm | medium | 6.1 | 1% |
| CVE-2022-3896 | wp-affiliate-platform (WordPress plugin) | The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to | medium | 6.1 | 1% |
| CVE-2022-40193 | awesome-filterable-portfolio (WordPress plugin) | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress. | medium | 6.1 | 1% |
| CVE-2023-6627 | wp-go-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attacke | medium | 6.1 | 1% |
| CVE-2021-27676 | centreon/centreon | Cross-site scripting in Centreon | medium | 5.4 | 1% |
| CVE-2022-0348 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 5.4 | 1% |
| CVE-2022-0510 | pimcore/pimcore | Cross-site Scripting pimcore | medium | 5.4 | 1% |
| CVE-2022-0720 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update oth | medium | 5.4 | 1% |
| CVE-2022-0837 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send | medium | 5.4 | 1% |
| CVE-2022-0941 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2018-10234 | ultimate-member (WordPress plugin) | Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Cust | medium | 4.8 | 1% |
| CVE-2025-27517 | livewire/volt | Volt Allows RCE Via User-Crafted Requests | critical | 0.0 | 1% |
| CVE-2021-24704 | orange-form (WordPress plugin) | In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared | high | 8.8 | 1% |
| CVE-2024-3564 | custom-post-widget (WordPress plugin) | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3 | high | 8.8 | 1% |
| CVE-2024-7548 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versio | high | 8.8 | 1% |
| CVE-2023-7072 | post-grid (WordPress plugin) | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i | high | 7.5 | 1% |
| CVE-2024-11372 | connexion-logs (WordPress plugin) | The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admi | high | 7.2 | 1% |
| CVE-2017-8875 | clean-login (WordPress plugin) | CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL. | medium | 6.5 | 1% |
| CVE-2021-25044 | cryptocurrency-pricing-list-and-ticker (WordPress plugin) | The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outpu | medium | 6.1 | 1% |
| CVE-2022-2654 | classified-listing (WordPress plugin), classified-listing-store-\&-membership (WordPress plugin), classima (WordPress plugin) +1 more | The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before | medium | 6.1 | 1% |
| CVE-2022-2669 | wp-taxonomy-import (WordPress plugin) | The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leadin | medium | 6.1 | 1% |
| CVE-2022-3209 | soledad (WordPress plugin) | The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX a | medium | 6.1 | 1% |
| CVE-2020-14146 | kumbiaphp/kumbiapp | KumbiaPHP Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-24665 | wp-video-lightbox (WordPress plugin) | The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as c | medium | 5.4 | 1% |
| CVE-2021-42361 | contact-form-to-email (WordPress plugin) | The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via t | medium | 4.8 | 1% |
| CVE-2024-3107 | ultimate-addons-for-gutenberg (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via t | medium | 4.3 | 1% |
| CVE-2024-24754 | bref/bref | Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions | low | 3.7 | 1% |
| CVE-2024-10285 | ce21-suite (WordPress plugin) | The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and includin | critical | 9.8 | 1% |
| CVE-2022-1912 | smartsoftbutton-widget-de-botones-de-chat (WordPress plugin) | The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This i | high | 8.8 | 1% |
| CVE-2024-0405 | burst-statistics (WordPress plugin) | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via | high | 7.2 | 1% |
| CVE-2024-12878 | lazy-blocks (WordPress plugin) | The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, lead | high | 7.1 | 1% |
| CVE-2021-4338 | 404-to-301 (WordPress plugin) | The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redir | medium | 6.4 | 1% |
| CVE-2018-16327 | intelliants/subrion | Subrion Cross-site Scripting (XSS) | medium | 4.8 | 1% |
| CVE-2021-24296 | wp-customer-reviews (WordPress plugin) | The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administr | medium | 4.8 | 1% |
| CVE-2021-24327 | seo-redirection-plugin (WordPress plugin) | The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when | medium | 4.8 | 1% |
| CVE-2021-24378 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Setti | medium | 4.8 | 1% |
| CVE-2021-24381 | contact-form (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, w | medium | 4.8 | 1% |
| CVE-2021-24440 | sign-up-sheets (WordPress plugin) | The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high pri | medium | 4.8 | 1% |
| CVE-2021-24485 | wp-special-textboxes (WordPress plugin) | The Special Text Boxes WordPress plugin before 5.9.110 does not sanitise or escape some of its settings, which could allow high privilege us | medium | 4.8 | 1% |
| CVE-2021-24514 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin | medium | 4.8 | 1% |
| CVE-2021-24515 | video-gallery (WordPress plugin) | The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them | medium | 4.8 | 1% |
| CVE-2021-24524 | givewp (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donati | medium | 4.8 | 1% |
| CVE-2021-24530 | alojapro-widget (WordPress plugin) | The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perf | medium | 4.8 | 1% |
| CVE-2021-24533 | maintenance (WordPress plugin) | The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin t | medium | 4.8 | 1% |