Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-10962 | icegram (WordPress plugin) | The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter. | medium | 6.5 | 1% |
| CVE-2023-4145 | pimcore/customer-management-framework-bundle | pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name | medium | 6.5 | 1% |
| CVE-2021-3977 | hillelcoren/invoice-ninja | invoiceninja is vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-2516 | nilsteampassnet/teampass | Cross Site Scripting in nilsteampassnet/teampass | medium | 5.4 | 1% |
| CVE-2023-1374 | solidres (WordPress plugin) | The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currency_name' parameter in versions up to, and incl | medium | 4.4 | 1% |
| CVE-2024-11334 | my-contador-wp (WordPress plugin) | The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportar_reg | medium | 4.3 | 1% |
| CVE-2022-1589 | all-in-one-login (WordPress plugin) | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updati | high | 7.5 | 1% |
| CVE-2024-27917 | shopware/platform, shopware/storefront | Shopware's session is persistent in Cache for 404 pages | high | 7.5 | 1% |
| CVE-2020-20589 | feehi/feehicms | FeehiCMS vulnerable to Cross Site Scripting | medium | 6.1 | 1% |
| CVE-2022-35943 | codeigniter4/shield | CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection | medium | 5.9 | 1% |
| CVE-2021-24694 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site | medium | 5.4 | 1% |
| CVE-2021-25046 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose pa | medium | 5.4 | 1% |
| CVE-2023-34098 | shopware/shopware | Shopware dependency configuration exposed | medium | 5.3 | 1% |
| CVE-2024-1769 | jm-twitter-cards (WordPress plugin) | The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14 via the meta descri | medium | 5.3 | 1% |
| CVE-2022-0209 | facebook-wall-and-social-integration (WordPress plugin) | The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, whi | medium | 4.8 | 1% |
| CVE-2023-3977 | backup-migration (WordPress plugin), clone (WordPress plugin), duplicate-post (WordPress plugin) +7 more | Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missin | medium | 4.3 | 1% |
| CVE-2025-52122 | solspace/craft-freeform | The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability | critical | 9.8 | 1% |
| CVE-2024-2441 | vikbooking-hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with s | high | 8.1 | 1% |
| CVE-2024-0913 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time- | high | 7.2 | 1% |
| CVE-2015-9332 | uninstall (WordPress plugin) | The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI. | medium | 6.5 | 1% |
| CVE-2023-6048 | estatik (WordPress plugin) | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from s | medium | 6.5 | 1% |
| CVE-2024-0378 | ai-engine (WordPress plugin) | The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the A | medium | 6.5 | 1% |
| CVE-2022-4496 | saml-sp-single-sign-on (WordPress plugin) | The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML | medium | 6.1 | 1% |
| CVE-2024-10877 | advanced-form-integration (WordPress plugin) | The AFI – The Easiest Integration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_ar | medium | 6.1 | 1% |
| CVE-2024-1383 | wpvivid-backup-mainwp (WordPress plugin) | The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up | medium | 6.1 | 1% |
| CVE-2024-26129 | prestashop/prestashop | Path disclosure in JavaScript variable | medium | 5.8 | 1% |
| CVE-2024-11297 | page-and-post-restriction (WordPress plugin) | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers | medium | 5.3 | 1% |
| CVE-2019-7168 | croogo/croogo | Croogo vulnerable to XSS in Blog field | medium | 4.8 | 1% |
| CVE-2019-7169 | croogo/croogo | Croogo vulnerable to XSS in title field | medium | 4.8 | 1% |
| CVE-2019-7170 | croogo/croogo | Croogo vulnerable to XSS in title field | medium | 4.8 | 1% |
| CVE-2019-7171 | croogo/croogo | Croogo vulnerable to XSS in title field | medium | 4.8 | 1% |
| CVE-2019-7173 | croogo/croogo | Croogo vulnerable to Cross-site Scripting in title field | medium | 4.8 | 1% |
| CVE-2021-36829 | launcher (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin <= 1.0 | medium | 4.8 | 1% |
| CVE-2021-36847 | webba-booking-lite (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress. | medium | 4.8 | 1% |
| CVE-2023-36236 | bagisto/bagisto | Cross-site Scripting in Bagisto | medium | 4.8 | 1% |
| CVE-2023-0880 | thorsten/phpmyfaq | Misinterpretation of Input in thorsten/phpmyfaq | medium | 4.3 | 1% |
| CVE-2023-4637 | wpvivid-backuprestore (WordPress plugin) | The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_res | medium | 4.3 | 1% |
| CVE-2022-3240 | follow-me (WordPress plugin) | The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due | high | 8.8 | 1% |
| CVE-2025-4954 | axle-demo-importer (WordPress plugin) | The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author | high | 8.8 | 1% |
| CVE-2022-51009 | pocketmine/pocketmine-mp | PocketMine-MP invalid skin geometry JSON data leading to server crash | high | 7.5 | 1% |
| CVE-2023-54390 | pocketmine/pocketmine-mp | PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again) | high | 7.5 | 1% |
| CVE-2024-13408 | post-grid-carousel-ultimate (WordPress plugin) | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local F | high | 7.5 | 1% |
| CVE-2026-86201 | pocketmine/pocketmine-mp | PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket | high | 7.5 | 1% |
| CVE-2023-1889 | directorist (WordPress plugin) | The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. This is d | medium | 6.5 | 1% |
| CVE-2023-6139 | essential-real-estate (WordPress plugin) | The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other thing | medium | 6.5 | 1% |
| CVE-2023-6884 | widget-google-reviews (WordPress plugin) | This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 | medium | 6.4 | 1% |
| CVE-2022-30110 | mojo42/jirafeau | Cross-site Scripting in Jirafeau | medium | 6.1 | 1% |
| CVE-2023-43647 | baserproject/basercms | baserCMS Cross-site Scripting vulnerability in File upload Feature | medium | 6.1 | 1% |
| CVE-2022-21149 | s-cart/core, s-cart/s-cart | SCart is vulnerable to cross-site scripting (XSS) | medium | 5.4 | 1% |
| CVE-2023-5452 | snipe/snipe-it | Cross-site Scripting in snipe/snipe-it | medium | 5.4 | 1% |