Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24903 | grand-flagallery (WordPress plugin) | The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privil | medium | 4.8 | 1% |
| CVE-2021-24944 | absolutely-glamorous-custom-admin (WordPress plugin) | The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perfo | medium | 4.8 | 1% |
| CVE-2021-24995 | html5-responsive-faq (WordPress plugin) | The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, which could allow a high | medium | 4.8 | 1% |
| CVE-2021-25029 | learning-management-system (WordPress plugin) | The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privi | medium | 4.8 | 1% |
| CVE-2021-25101 | anti-malware-security-and-brute-force-firewall (WordPress plugin) | The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputt | medium | 4.8 | 1% |
| CVE-2021-25105 | ivory-search (WordPress plugin) | The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform | medium | 4.8 | 1% |
| CVE-2022-0211 | shield-security (WordPress plugin) | The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perfo | medium | 4.8 | 1% |
| CVE-2022-0376 | user-meta-user-profile-builder-and-user-management (WordPress plugin) | The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting the | medium | 4.8 | 1% |
| CVE-2022-0388 | interactive-medical-drawing-of-human-body (WordPress plugin) | The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privile | medium | 4.8 | 1% |
| CVE-2022-0389 | wp-time-slots-booking-form (WordPress plugin) | The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to | medium | 4.8 | 1% |
| CVE-2022-0418 | event-list (WordPress plugin) | The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege users such as admin | medium | 4.8 | 1% |
| CVE-2022-0590 | bulletproof-security (WordPress plugin) | The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 1% |
| CVE-2022-0649 | adrotate (WordPress plugin) | The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Script | medium | 4.8 | 1% |
| CVE-2022-0659 | sync-qcloud-cos (WordPress plugin) | The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perfo | medium | 4.8 | 1% |
| CVE-2022-0662 | adrotate (WordPress plugin) | The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cros | medium | 4.8 | 1% |
| CVE-2022-0701 | seo-301-meta (WordPress plugin) | The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-0728 | easy-smooth-scroll-links (WordPress plugin) | The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2022-0840 | easy-social-icons (WordPress plugin) | The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing hi | medium | 4.8 | 1% |
| CVE-2022-0874 | wp-social-buttons (WordPress plugin) | The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to | medium | 4.8 | 1% |
| CVE-2022-0876 | social-comments (WordPress plugin) | The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such | medium | 4.8 | 1% |
| CVE-2022-1027 | page-restriction (WordPress plugin) | The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to in | medium | 4.8 | 1% |
| CVE-2022-1046 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high priv | medium | 4.8 | 1% |
| CVE-2022-1062 | th23-social (WordPress plugin) | The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2022-1063 | thank-me-later (WordPress plugin) | The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Message | medium | 4.8 | 1% |
| CVE-2022-1088 | page-security-\&-membership (WordPress plugin) | The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 1% |
| CVE-2022-1089 | bulk-edit-and-create-user-profiles---wp-sheet-editor (WordPress plugin) | The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high p | medium | 4.8 | 1% |
| CVE-2022-1090 | good-bad-comments (WordPress plugin) | The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2022-1156 | books-\&-papers (WordPress plugin) | The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high privilege users to perfo | medium | 4.8 | 1% |
| CVE-2022-1228 | opeansea (WordPress plugin) | The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could a | medium | 4.8 | 1% |
| CVE-2022-1265 | bulletproof-security (WordPress plugin) | The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which could allow high-privi | medium | 4.8 | 1% |
| CVE-2022-1275 | bannerman (WordPress plugin) | The BannerMan WordPress plugin through 0.2.4 does not sanitize or escape its settings, which could allow high-privileged users to perform Cr | medium | 4.8 | 1% |
| CVE-2022-1294 | imdb-info-box (WordPress plugin) | The IMDB info box WordPress plugin through 2.0 does not sanitize and escape some of its settings, which could allow high-privileged users to | medium | 4.8 | 1% |
| CVE-2022-1298 | tabs-responsive (WordPress plugin) | The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as | medium | 4.8 | 1% |
| CVE-2022-1299 | slideshow (WordPress plugin) | The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-pri | medium | 4.8 | 1% |
| CVE-2022-1303 | slide-anything (WordPress plugin) | The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-1335 | slideshow-ck (WordPress plugin) | The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users s | medium | 4.8 | 1% |
| CVE-2022-1336 | carousel-ck (WordPress plugin) | The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users su | medium | 4.8 | 1% |
| CVE-2022-1338 | easily-generate-rest-api (WordPress plugin) | The Easily Generate Rest API Url WordPress plugin through 1.0.0 does not escape some of its settings, allowing high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-1387 | no-future-posts (WordPress plugin) | The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perfo | medium | 4.8 | 1% |
| CVE-2022-1395 | easy-faq-with-expanding-text (WordPress plugin) | The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users | medium | 4.8 | 1% |
| CVE-2022-1408 | hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attribute | medium | 4.8 | 1% |
| CVE-2022-1435 | track-\&-trace (WordPress plugin) | The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-1456 | poll-maker (WordPress plugin) | The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admi | medium | 4.8 | 1% |
| CVE-2022-1469 | fibosearch (WordPress plugin) | The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-1541 | video-slider (WordPress plugin) | The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged use | medium | 4.8 | 1% |
| CVE-2022-1542 | hpb-dashboard (WordPress plugin) | The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2022-1568 | team-members (WordPress plugin) | The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2022-1569 | drag-\&-drop-builder (WordPress plugin) | The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before | medium | 4.8 | 1% |
| CVE-2022-1643 | birthdays-widget (WordPress plugin) | The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-1644 | call\&book-mobile-bar (WordPress plugin) | The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |