Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.2, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-36174 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. | medium | 6.5 | 1% |
| CVE-2023-2280 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability ch | medium | 6.5 | 1% |
| CVE-2022-38796 | feehi/cms | Feehi CMS host header injection vulnerability | medium | 6.1 | 1% |
| CVE-2024-12737 | wp-base-booking-of-appointments\,-services-and-events (WordPress plugin) | The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outpu | medium | 6.1 | 1% |
| CVE-2024-13630 | newsticker (WordPress plugin) | The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | medium | 6.1 | 1% |
| CVE-2023-0712 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object func | medium | 5.4 | 1% |
| CVE-2023-0719 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order | medium | 5.4 | 1% |
| CVE-2023-0786 | thorsten/phpmyfaq | Cross-site Scripting in thorsten/phpmyfaq | medium | 4.8 | 1% |
| CVE-2023-1754 | thorsten/phpmyfaq | phpMyFAQ vulnerable to improper input validation | medium | 4.7 | 1% |
| CVE-2024-6317 | generate-pdf-using-contact-form-7 (WordPress plugin) | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions | high | 8.8 | 1% |
| CVE-2022-38057 | th-advance-product-search (WordPress plugin) | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/ | medium | 6.5 | 1% |
| CVE-2023-0446 | youtube-channel (WordPress plugin) | The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and | medium | 5.5 | 1% |
| CVE-2021-24933 | dynamic-widgets (WordPress plugin) | The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when usin | medium | 5.4 | 1% |
| CVE-2021-24958 | meks-easy-photo-feed-widget (WordPress plugin) | The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_ac | medium | 5.4 | 1% |
| CVE-2021-24971 | wp-responsive-menu (WordPress plugin) | The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well | medium | 5.4 | 1% |
| CVE-2021-25057 | translation-exchange (WordPress plugin) | The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Projec | medium | 5.4 | 1% |
| CVE-2021-25058 | the-buffer-button (WordPress plugin) | The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username | medium | 5.4 | 1% |
| CVE-2021-25060 | five-star-business-profile-and-schema (WordPress plugin) | The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_co | medium | 5.4 | 1% |
| CVE-2021-25090 | portfolio-gallery\,-product-catalog---grid-kit-portfolio (WordPress plugin) | The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions relate | medium | 5.4 | 1% |
| CVE-2021-25106 | wplegalpages (WordPress plugin) | The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for | medium | 5.4 | 1% |
| CVE-2022-0200 | portfolio-post (WordPress plugin) | Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the r | medium | 5.4 | 1% |
| CVE-2022-0397 | wpc-smart-wishlist-for-woocommerce (WordPress plugin) | The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it bac | medium | 5.4 | 1% |
| CVE-2022-0423 | 3d-flipbook (WordPress plugin) | The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any | medium | 5.4 | 1% |
| CVE-2022-1152 | menubar (WordPress plugin) | The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the | medium | 5.4 | 1% |
| CVE-2022-1393 | wp-subtitle (WordPress plugin) | The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle i | medium | 5.4 | 1% |
| CVE-2022-3137 | taskbuilder (WordPress plugin) | The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (s | medium | 5.4 | 1% |
| CVE-2026-59193 | getgrav/grav | Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() | medium | 4.9 | 1% |
| CVE-2024-13918 | laravel/framework | Laravel framework susceptible to reflected cross-site scripting | medium | 4.7 | 1% |
| CVE-2024-11260 | events-manager (WordPress plugin) | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_st | high | 7.5 | 1% |
| CVE-2020-25263 | pyrocms/pyrocms | PyroCMS Vulnerable to CSRF | high | 7.1 | 1% |
| CVE-2021-24761 | error-log-viewer (WordPress plugin) | The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal pr | medium | 6.5 | 1% |
| CVE-2023-4919 | iframe (WordPress plugin) | The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `iframe` shortcode in versions up to, and including, 4. | medium | 6.4 | 1% |
| CVE-2023-5362 | spice-post-slider (WordPress plugin) | The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'spice_post_slider' | medium | 6.4 | 1% |
| CVE-2023-5669 | featured-image-caption (WordPress plugin) | The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all | medium | 6.4 | 1% |
| CVE-2022-36791 | torro-forms (WordPress plugin) | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress. | medium | 5.4 | 1% |
| CVE-2023-46745 | librenms/librenms | LibreNMS vulnerable to rate limiting bypass on login page | medium | 5.3 | 1% |
| CVE-2023-2836 | crm-perks-forms (WordPress plugin) | The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1. | medium | 4.4 | 1% |
| CVE-2026-27012 | devcode-it/openstamanager | OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php | critical | 9.8 | 1% |
| CVE-2024-2341 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the k | high | 8.8 | 1% |
| CVE-2021-24230 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers | high | 8.1 | 1% |
| CVE-2021-32668 | typo3/cms, typo3/cms-core | Cross-Site Scripting in Query Generator & Query View | medium | 6.4 | 1% |
| CVE-2022-4410 | permalink-manager (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due t | medium | 6.4 | 1% |
| CVE-2024-1408 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 1% |
| CVE-2022-2280 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2024-10862 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'search_para | medium | 4.9 | 1% |
| CVE-2017-8780 | genix/cms | GeniXCMS Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2021-24707 | nd-learning (WordPress plugin) | The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high | medium | 4.8 | 1% |
| CVE-2021-24810 | wp-event-manager (WordPress plugin) | The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high pr | medium | 4.8 | 1% |
| CVE-2021-24895 | cybersoldier (WordPress plugin) | The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an attribute, which cou | medium | 4.8 | 1% |
| CVE-2021-24898 | editable-table (WordPress plugin) | The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high pri | medium | 4.8 | 1% |