Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24569 | cookie-notice-\&-compliance-for-gdpr-\/-ccpa (WordPress plugin) | The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outpu | medium | 4.8 | 1% |
| CVE-2021-24592 | sitewide-notice (WordPress plugin) | The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing | medium | 4.8 | 1% |
| CVE-2021-24600 | wp-dialog (WordPress plugin) | The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing h | medium | 4.8 | 1% |
| CVE-2021-24604 | availability-calendar (WordPress plugin) | The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post w | medium | 4.8 | 1% |
| CVE-2021-24607 | storefront-footer-text (WordPress plugin) | The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing hig | medium | 4.8 | 1% |
| CVE-2021-24609 | wp-mapa-politico-espana (WordPress plugin) | The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attribu | medium | 4.8 | 1% |
| CVE-2021-24613 | post-views-counter (WordPress plugin) | The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privi | medium | 4.8 | 1% |
| CVE-2021-24614 | book-appointment-online (WordPress plugin) | The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which | medium | 4.8 | 1% |
| CVE-2021-24619 | per-page-add-to-head (WordPress plugin) | The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserte | medium | 4.8 | 1% |
| CVE-2021-24621 | wp-courses-lms (WordPress plugin) | The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by hi | medium | 4.8 | 1% |
| CVE-2021-24623 | wordpress-advanced-ticket-system (WordPress plugin) | The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before s | medium | 4.8 | 1% |
| CVE-2021-24645 | booking.com-product-helper (WordPress plugin) | The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, whic | medium | 4.8 | 1% |
| CVE-2021-24646 | booking.com-banner-creator (WordPress plugin) | The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high | medium | 4.8 | 1% |
| CVE-2021-24653 | cookie-bar (WordPress plugin) | The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2021-24656 | simple-social-buttons (WordPress plugin) | The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the fro | medium | 4.8 | 1% |
| CVE-2021-24673 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege user | medium | 4.8 | 1% |
| CVE-2021-24687 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, al | medium | 4.8 | 1% |
| CVE-2021-24700 | forminator (WordPress plugin) | The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to | medium | 4.8 | 1% |
| CVE-2021-24701 | quiz-tool-lite (WordPress plugin) | The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managing quizzes and in oth | medium | 4.8 | 1% |
| CVE-2021-24706 | qwizcards (WordPress plugin) | The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allow | medium | 4.8 | 1% |
| CVE-2021-24708 | wp-all-export (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Expo | medium | 4.8 | 1% |
| CVE-2021-24709 | weather-effect (WordPress plugin) | The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf | medium | 4.8 | 1% |
| CVE-2021-24713 | video-lessons-manager (WordPress plugin) | The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize | medium | 4.8 | 1% |
| CVE-2021-24714 | wp-all-import (WordPress plugin) | The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outpu | medium | 4.8 | 1% |
| CVE-2021-24718 | contact-form\,-survey-\&-popup-form-plugin-for-wordpress---arforms-form-builder (WordPress plugin) | The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high p | medium | 4.8 | 1% |
| CVE-2021-24737 | wpdiscuz (WordPress plugin) | The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputti | medium | 4.8 | 1% |
| CVE-2021-24744 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in so | medium | 4.8 | 1% |
| CVE-2021-24768 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HT | medium | 4.8 | 1% |
| CVE-2021-24771 | inspirational-quote-rotator (WordPress plugin) | The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a q | medium | 4.8 | 1% |
| CVE-2021-24782 | flex-local-fonts (WordPress plugin) | The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privile | medium | 4.8 | 1% |
| CVE-2021-24785 | great-quotes (WordPress plugin) | The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow hi | medium | 4.8 | 1% |
| CVE-2021-24787 | client-invoicing-by-sprout-invoices (WordPress plugin) | The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow | medium | 4.8 | 1% |
| CVE-2021-24811 | shop-page-wp (WordPress plugin) | The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to per | medium | 4.8 | 1% |
| CVE-2021-24815 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could al | medium | 4.8 | 1% |
| CVE-2021-24882 | slideshow-gallery (WordPress plugin) | The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" field | medium | 4.8 | 1% |
| CVE-2021-24896 | caldera-forms (WordPress plugin) | The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could a | medium | 4.8 | 1% |
| CVE-2021-24902 | typebot (WordPress plugin) | The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which | medium | 4.8 | 1% |
| CVE-2021-24972 | pixel-cat (WordPress plugin) | The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Si | medium | 4.8 | 1% |
| CVE-2021-24992 | buttonizer (WordPress plugin) | The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attr | medium | 4.8 | 1% |
| CVE-2023-33194 | craftcms/cms | CraftCMS stored XSS in Quick Post widget error message | low | 3.7 | 1% |
| CVE-2021-4017 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2022-2864 | demon-image-annotation (WordPress plugin) | The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is d | high | 8.8 | 1% |
| CVE-2024-6660 | bookingpress-appointment-booking (WordPress plugin) | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modif | high | 8.8 | 1% |
| CVE-2026-33483 | wwbn/avideo | AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php | high | 7.5 | 1% |
| CVE-2024-13499 | gamipress (WordPress plugin) | The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to ar | high | 7.3 | 1% |
| CVE-2020-22765 | nukeviet/nukeviet | NukeViet Cross-site Scripting via the editor in the News module | medium | 6.1 | 1% |
| CVE-2023-7199 | relevanssi (WordPress plugin) | The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read dra | medium | 5.3 | 1% |
| CVE-2023-3814 | advanced-file-manager (WordPress plugin) | The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site ad | medium | 4.9 | 1% |
| CVE-2014-125102 | relevant (WordPress plugin) | A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability | medium | 4.3 | 1% |
| CVE-2026-46634 | twig/twig | Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name | medium | 0.0 | 1% |