Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-7503 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is | critical | 9.8 | 1% |
| CVE-2025-4689 | ads-pro (WordPress plugin) | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to R | critical | 9.8 | 1% |
| CVE-2023-4432 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | high | 8.3 | 1% |
| CVE-2019-15062 | dolibarr/dolibarr | Dolibarr Cross-Site Request Forgery (CSRF) | high | 8.0 | 1% |
| CVE-2023-5864 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | high | 7.4 | 1% |
| CVE-2025-1509 | show-me-the-cookies (WordPress plugin) | The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. T | high | 7.3 | 1% |
| CVE-2024-7617 | contact-form-to-any-api (WordPress plugin) | The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fields in all versions | high | 7.2 | 1% |
| CVE-2025-4102 | beaver-builder (WordPress plugin) | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | high | 7.2 | 1% |
| CVE-2023-1868 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin c | medium | 6.5 | 1% |
| CVE-2017-8298 | austintoddj/canvas | Canvs Canvas Cross-site Scripting (XSS) via title and content fields | medium | 5.4 | 1% |
| CVE-2023-1755 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2024-6088 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check | medium | 5.3 | 1% |
| CVE-2022-1093 | wp-meta-seo (WordPress plugin) | The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowin | medium | 4.8 | 1% |
| CVE-2022-1094 | amr-users (WordPress plugin) | The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-39325 | baserproject/basercms | baserproject/basercms vulnerable to cross-site scripting (XSS) vulnerability | medium | 4.6 | 1% |
| CVE-2026-53965 | mcp/sdk | MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter | high | 0.0 | 1% |
| CVE-2026-56346 | wwbn/avideo | AVideo has Unauthenticated PGP Message Decryption via Public Endpoint | medium | 0.0 | 1% |
| CVE-2023-6214 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | high | 7.5 | 1% |
| CVE-2024-56522 | tecnickcom/tcpdf | TCPDF has incorrect comparison | high | 7.5 | 1% |
| CVE-2025-24019 | yeswiki/yeswiki | Authenticated arbitrary file deletion in YesWiki | high | 7.1 | 1% |
| CVE-2021-24328 | wp-login-security-and-history (WordPress plugin) | The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or val | medium | 6.2 | 1% |
| CVE-2017-20175 | mediawiki/matomo | Cross-site Scripting in DaSchTour matomo-mediawiki-extension | medium | 6.1 | 1% |
| CVE-2022-2543 | visual-portfolio\,-photo-gallery-\&-post-grid (WordPress plugin) | The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST | medium | 6.1 | 1% |
| CVE-2021-24423 | updraftplus (WordPress plugin) | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privile | medium | 4.8 | 1% |
| CVE-2023-3175 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perfor | medium | 4.8 | 1% |
| CVE-2022-4705 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action i | medium | 4.3 | 1% |
| CVE-2022-4708 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX acti | medium | 4.3 | 1% |
| CVE-2022-4709 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX actio | medium | 4.3 | 1% |
| CVE-2024-3607 | propertyhive (WordPress plugin) | The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() | medium | 4.3 | 1% |
| CVE-2022-37407 | photoblocks-grid-gallery (WordPress plugin) | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. | medium | 4.1 | 1% |
| CVE-2017-6068 | intelliants/subrion | Subrion CMS vulnerable to CSRF in admin/blocks/add | high | 8.8 | 1% |
| CVE-2025-54263 | magento/community-edition, magento/project-community-edition | Magento provides incorrect authorization through a security feature bypass | high | 8.1 | 1% |
| CVE-2023-2665 | francoisjacquet/rosariosis | RosarioSIS Stores Sensitive Data in a Mechanism without Access Control | high | 7.5 | 1% |
| CVE-2025-49554 | magento/community-edition, magento/project-community-edition | Magento vulnerable to denial of service | high | 7.5 | 1% |
| CVE-2024-10499 | ai-engine (WordPress plugin) | The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a | high | 7.2 | 1% |
| CVE-2024-0326 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Link Wrapper functionali | medium | 6.4 | 1% |
| CVE-2022-0372 | bytefury/crater | Cross-site Scripting in Crater Invoice | medium | 5.4 | 1% |
| CVE-2023-0147 | flexible-captcha (WordPress plugin) | The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2021-24343 | iflychat (WordPress plugin) | The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authent | medium | 4.8 | 1% |
| CVE-2021-24448 | profile-builder (WordPress plugin) | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirec | medium | 4.8 | 1% |
| CVE-2021-24479 | drawblog (WordPress plugin) | The DrawBlog WordPress plugin through 0.90 does not sanitise or validate some of its settings before outputting them back in the page, leadi | medium | 4.8 | 1% |
| CVE-2021-24480 | event-geek (WordPress plugin) | The Event Geek WordPress plugin through 2.5.2 does not sanitise or escape its "Use your own " setting before outputting it in the page, lead | medium | 4.8 | 1% |
| CVE-2021-24481 | any-hostname (WordPress plugin) | The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored | medium | 4.8 | 1% |
| CVE-2021-24519 | car-rental-management-system (WordPress plugin) | The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or ed | medium | 4.8 | 1% |
| CVE-2023-0447 | youtube-channel (WordPress plugin) | The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache f | medium | 4.3 | 1% |
| CVE-2021-25010 | post-snippets (WordPress plugin) | The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin i | critical | 9.6 | 1% |
| CVE-2026-63221 | codeigniter4/framework | CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions | critical | 9.4 | 1% |
| CVE-2021-24879 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escapin | high | 8.8 | 1% |
| CVE-2022-0770 | translate-wordpress-with-gtranslate (WordPress plugin) | The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as u | high | 8.8 | 1% |
| CVE-2022-1758 | genki-pre-publish-reminder (WordPress plugin) | The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allo | high | 8.8 | 1% |