Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-25575 | api-platform/core | api-platform/core's secured properties may be accessible within collections | high | 7.7 | 1% |
| CVE-2021-42360 | starter-templates (WordPress plugin) | On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which include | high | 7.6 | 1% |
| CVE-2021-27912 | mautic/core | XSS vulnerability on asset view | high | 7.1 | 1% |
| CVE-2024-1316 | event-tickets (WordPress plugin) | The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users w | medium | 6.5 | 1% |
| CVE-2023-2120 | wp-responsive-thumbnail-slider (WordPress plugin) | The Thumbnail carousel slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions | medium | 6.1 | 1% |
| CVE-2024-2738 | permalink-manager (WordPress plugin) | The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple | medium | 6.1 | 1% |
| CVE-2025-5084 | ajax-filter-posts (WordPress plugin) | The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘argsArray['read_more_text']’ parameter in | medium | 6.1 | 1% |
| CVE-2021-24821 | cost-calculator (WordPress plugin) | The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attack | medium | 5.4 | 1% |
| CVE-2021-24826 | custom-content-shortcode (WordPress plugin) | The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contribut | medium | 5.4 | 1% |
| CVE-2021-24880 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users wit | medium | 5.4 | 1% |
| CVE-2021-24897 | add-subtitle (WordPress plugin) | The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when ou | medium | 5.4 | 1% |
| CVE-2021-25113 | dropdown-menu-widget (WordPress plugin) | The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low p | medium | 5.4 | 1% |
| CVE-2022-0186 | image-photo-gallery-final-tiles-grid (WordPress plugin) | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gal | medium | 5.4 | 1% |
| CVE-2022-0205 | yop-poll (WordPress plugin) | The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as autho | medium | 5.4 | 1% |
| CVE-2022-0450 | menu-image\,-icons-made-easy (WordPress plugin) | The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving menu settings, and doe | medium | 5.4 | 1% |
| CVE-2022-0898 | igniteup (WordPress plugin) | The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_htm | medium | 5.4 | 1% |
| CVE-2022-1506 | wp-born-babies (WordPress plugin) | The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low | medium | 5.4 | 1% |
| CVE-2022-1549 | wp-athletics (WordPress plugin) | The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the val | medium | 5.4 | 1% |
| CVE-2022-1562 | enable-svg (WordPress plugin) | The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to u | medium | 5.4 | 1% |
| CVE-2022-3074 | slider-hero (WordPress plugin) | The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site | medium | 4.8 | 1% |
| CVE-2022-3995 | woo-wallet (WordPress plugin) | The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due t | medium | 4.3 | 1% |
| CVE-2025-44163 | billz/raspap-webgui | raspap-webgui has a Directory Traversal vulnerability | high | 0.0 | 1% |
| CVE-2024-8292 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all ve | critical | 9.8 | 1% |
| CVE-2024-9862 | miniorange-firebase-sms-otp-verification (WordPress plugin) | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and in | critical | 9.8 | 1% |
| CVE-2019-14933 | bagisto/bagisto | Bagisto CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2024-8290 | wc-frontend-manager (WordPress plugin) | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insec | high | 8.8 | 1% |
| CVE-2024-9941 | wordpress-gym-management-system (WordPress plugin) | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on | high | 8.8 | 1% |
| CVE-2022-44543 | in2code/femanager | TYPO3 Extension femanager vulnerable to Broken Access Control | medium | 6.5 | 1% |
| CVE-2023-4190 | admidio/admidio | Admidio Insufficient Session Expiration vulnerability | medium | 6.5 | 1% |
| CVE-2021-32667 | typo3/cms, typo3/cms-core | Cross-Site Scripting in Page Preview | medium | 6.4 | 1% |
| CVE-2021-32669 | typo3/cms, typo3/cms-core | Cross-Site Scripting in Backend Grid View | medium | 6.4 | 1% |
| CVE-2024-0680 | wp-private-content-plus (WordPress plugin) | The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is | medium | 5.3 | 1% |
| CVE-2024-2302 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to | medium | 5.3 | 1% |
| CVE-2021-4376 | woo-multi-currency (WordPress plugin) | The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This m | medium | 4.3 | 1% |
| CVE-2026-42608 | getgrav/grav | Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component | high | 0.0 | 1% |
| CVE-2022-1672 | insights-from-google-pagespeed (WordPress plugin) | The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Cust | high | 8.8 | 1% |
| CVE-2022-1900 | copify (WordPress plugin) | The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing | high | 8.8 | 1% |
| CVE-2023-6585 | jobsearch-wp-job-board (WordPress plugin) | The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload | high | 7.5 | 1% |
| CVE-2024-42357 | shopware/core, shopware/platform | Shopware vulnerable to blind SQL-injection in DAL aggregations | high | 7.3 | 1% |
| CVE-2023-2298 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'b | high | 7.2 | 1% |
| CVE-2024-0826 | qi-addons-for-elementor (WordPress plugin) | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to | medium | 6.4 | 1% |
| CVE-2024-2081 | foogallery (WordPress plugin) | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the foogallery_attachme | medium | 6.4 | 1% |
| CVE-2024-4036 | sydney-toolbox (WordPress plugin) | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in all versions up to, and incl | medium | 6.4 | 1% |
| CVE-2024-4156 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 1% |
| CVE-2022-30429 | neos/neos | Neos CMS vulnerable to XSS in various backend modules | medium | 5.4 | 1% |
| CVE-2023-5544 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2024-25983 | moodle/moodle | Authorization Bypass in moodle | medium | 5.3 | 1% |
| CVE-2022-3136 | social-rocket (WordPress plugin) | The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 1% |
| CVE-2022-3220 | advanced-comment-form (WordPress plugin) | The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2023-4836 | wordpress-file-sharing-plugin (WordPress plugin) | The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing u | medium | 4.3 | 1% |