Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-0681 | page-and-post-restriction (WordPress plugin) | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up | medium | 5.3 | 1% |
| CVE-2020-35239 | cakephp/cakephp | CakePHP allows method override parameters to bypass CSRF checks | high | 8.8 | 1% |
| CVE-2021-43353 | crisp (WordPress plugin) | The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settin | high | 8.8 | 1% |
| CVE-2024-9302 | app-builder (WordPress plugin) | The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account take | high | 8.1 | 1% |
| CVE-2024-10899 | wc-product-table-lite (WordPress plugin) | The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includ | high | 7.3 | 1% |
| CVE-2018-18921 | phpservermon/phpservermon | CSRF in PHP Server Monitor before 3.3.2 | medium | 6.5 | 1% |
| CVE-2015-10126 | easy2map-photos (WordPress plugin) | A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The | medium | 6.3 | 1% |
| CVE-2023-0541 | gs-books-showcase (WordPress plugin) | The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 1% |
| CVE-2021-4227 | ark-wysiwyg-comment-editor (WordPress plugin) | The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing atta | medium | 5.3 | 1% |
| CVE-2024-0909 | anonymous-restricted-content (WordPress plugin) | The Anonymous Restricted Content plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.6.2. T | medium | 5.3 | 1% |
| CVE-2022-43688 | concrete5/concrete5 | Concrete CMS vulnerable to Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2023-22476 | mantisbt/mantisbt | MantisBT may expose private issues' summaries to unauthorized users | medium | 4.3 | 1% |
| CVE-2019-25149 | gallery-images-ape (WordPress plugin) | The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This all | high | 7.6 | 1% |
| CVE-2024-37295 | aimeos/aimeos-core | Remote code execution in web server context | high | 7.2 | 1% |
| CVE-2023-2591 | nilsteampassnet/teampass | teampass vulnerable to code injection | high | 7.1 | 1% |
| CVE-2022-0612 | remdex/livehelperchat | Cross-site Scripting in livehelperchat | medium | 6.7 | 1% |
| CVE-2023-2710 | wp-responsive-video-gallery-with-lightbox (WordPress plugin) | The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter i | medium | 6.1 | 1% |
| CVE-2018-11580 | mass-pagesposts-creator (WordPress plugin) | An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in | medium | 5.4 | 1% |
| CVE-2018-16342 | showdoc/showdoc | Showdoc XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2018-20758 | modx/revolution | MODX vulnerability allows for XSS via user settings parameters | medium | 5.4 | 1% |
| CVE-2021-24965 | five-star-restaurant-reservations (WordPress plugin) | The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule | medium | 5.4 | 1% |
| CVE-2021-24974 | product-feed-pro-for-woocommerce (WordPress plugin) | The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, | medium | 5.4 | 1% |
| CVE-2022-0502 | remdex/livehelperchat | Cross-site Scripting in LiveHelperChat | medium | 5.4 | 1% |
| CVE-2021-36857 | testimonial-builder (WordPress plugin) | Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress. | medium | 4.8 | 1% |
| CVE-2023-2085 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templa | medium | 4.3 | 1% |
| CVE-2015-10095 | woo-popup (WordPress plugin) | A vulnerability classified as problematic has been found in woo-popup Plugin up to 1.2.2 on WordPress. This affects an unknown part of the f | low | 3.5 | 1% |
| CVE-2015-10117 | gf-windcave-free (WordPress plugin) | A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an u | low | 3.5 | 1% |
| CVE-2024-21549 | spatie/browsershot | Browsershot Improper Input Validation vulnerability | high | 8.6 | 1% |
| CVE-2023-1895 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint | high | 8.5 | 1% |
| CVE-2023-4668 | ad-inserter (WordPress plugin) | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-proc | medium | 5.3 | 1% |
| CVE-2024-0421 | mappress-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX act | medium | 5.3 | 1% |
| CVE-2024-1176 | ht-easy-google-analytics (WordPress plugin) | The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 1% |
| CVE-2024-45048 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet encoding is returned | high | 8.8 | 1% |
| CVE-2024-43434 | moodle/moodle | Moodle has CSRF risk in Feedback non-respondents report | high | 8.1 | 1% |
| CVE-2025-54264 | magento/community-edition, magento/project-community-edition | Magento vulnerable to stored Cross-Site Scripting (XSS) | high | 8.1 | 1% |
| CVE-2022-24879 | shopware/shopware | Malfunction of CSRF token validation in Shopware | high | 7.5 | 1% |
| CVE-2023-3087 | fluent-smtp (WordPress plugin) | The FluentSMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.2. | high | 7.2 | 1% |
| CVE-2023-3158 | mail-control (WordPress plugin) | The Mail Control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 0. | high | 7.2 | 1% |
| CVE-2016-10883 | simple-add-pages-or-posts (WordPress plugin) | The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users. | medium | 6.5 | 1% |
| CVE-2022-41609 | bp-better-messages (WordPress plugin) | Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress. | medium | 6.4 | 1% |
| CVE-2024-0591 | wpdatatables (WordPress plugin) | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scr | medium | 6.1 | 1% |
| CVE-2022-4756 | my-youtube-channel (WordPress plugin) | The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 1% |
| CVE-2022-4762 | materialis-companion (WordPress plugin) | The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 1% |
| CVE-2022-4826 | simple-tooltips (WordPress plugin) | The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2022-4097 | all-in-one-security (WordPress plugin) | The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security feat | medium | 5.3 | 1% |
| CVE-2024-45124 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2021-25005 | seur-oficial (WordPress plugin) | The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cr | medium | 4.8 | 1% |
| CVE-2021-4375 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_sy | medium | 4.3 | 1% |
| CVE-2018-5656 | pinterest-feeds (WordPress plugin) | An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php. | high | 8.8 | 1% |
| CVE-2022-0335 | moodle/moodle | Cross Site Request Forgery in Moodle | high | 8.8 | 1% |