Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1645 | amazon-link (WordPress plugin) | The Amazon Link WordPress plugin through 3.2.10 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 1% |
| CVE-2022-1646 | simple-real-estate-pack (WordPress plugin) | The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 1% |
| CVE-2022-1647 | formcraft (WordPress plugin) | The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perfor | medium | 4.8 | 1% |
| CVE-2022-1710 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allo | medium | 4.8 | 1% |
| CVE-2022-1814 | wp-admin-style (WordPress plugin) | The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-23987 | ws-form (WordPress plugin) | The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2023-0691 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in version | medium | 4.3 | 1% |
| CVE-2023-0692 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in ve | medium | 4.3 | 1% |
| CVE-2022-41618 | media-library-assistant (WordPress plugin) | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. | low | 3.7 | 1% |
| CVE-2025-61417 | tastyigniter/tastyigniter | TastyIgniter vulnerable to Cross-Site Scripting | low | 0.0 | 1% |
| CVE-2026-45067 | symfony/mime, symfony/symfony | Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address | high | 0.0 | 1% |
| CVE-2018-6009 | yiisoft/yii2, yiisoft/yii2-dev | Yii Framework Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2023-0555 | quick-restaurant-menu (WordPress plugin) | The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions i | high | 8.1 | 1% |
| CVE-2022-36573 | pagekit/pagekit | Pagekit CMS cross-site scripting in Markdown text box where articles are edited | medium | 6.1 | 1% |
| CVE-2023-44765 | concrete5/concrete5 | ConcreteCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-2575 | wbw-currency-switcher-for-woocommerce (WordPress plugin) | The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow | medium | 4.8 | 1% |
| CVE-2022-2823 | slider\,-gallery\,-and-carousel (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parame | medium | 4.8 | 1% |
| CVE-2022-3069 | wordlift (WordPress plugin) | The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perfor | medium | 4.8 | 1% |
| CVE-2022-3207 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2022-40195 | address-email-and-phone-validation (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-40672 | cpo-shortcodes (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress. | medium | 4.8 | 1% |
| CVE-2024-1387 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the du | medium | 4.3 | 1% |
| CVE-2021-4096 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it pos | high | 8.8 | 1% |
| CVE-2024-27354 | phpseclib/phpseclib | phpseclib: guardrails needed on isPrime and randomPrime | high | 7.5 | 1% |
| CVE-2023-2082 | buymeacoffee (WordPress plugin) | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including | medium | 6.4 | 1% |
| CVE-2023-2404 | crm-customer-relationship-management-by-vcita (WordPress plugin) | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions | medium | 6.4 | 1% |
| CVE-2017-20057 | elefant/cms | Cross site scripting in Elefant CMS | medium | 6.1 | 1% |
| CVE-2024-6704 | wpdiscuz (WordPress plugin) | The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a | medium | 5.3 | 1% |
| CVE-2022-3462 | highlight-focus (WordPress plugin) | The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2023-4423 | wp-event-manager (WordPress plugin) | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | medium | 4.4 | 1% |
| CVE-2024-45133 | magento/community-edition | Magento Open Source Information Exposure vulnerability | low | 2.7 | 1% |
| CVE-2026-48489 | symfony/security-http, symfony/symfony | Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes | high | 0.0 | 1% |
| CVE-2026-37709 | snipe/snipe-it | Snipe-IT has insecure permissions in file uploads | critical | 9.8 | 1% |
| CVE-2022-2432 | ecwid-shopping-cart (WordPress plugin) | The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23 | high | 8.8 | 1% |
| CVE-2022-41996 | avada (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugi | high | 8.8 | 1% |
| CVE-2024-11038 | wpb-popup-for-contact-form-7 (WordPress plugin) | The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to ar | high | 7.3 | 1% |
| CVE-2024-13094 | wp-triggers-lite (WordPress plugin) | The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading | high | 7.1 | 1% |
| CVE-2024-13347 | essential-wp-real-estate (WordPress plugin) | The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to | medium | 6.8 | 1% |
| CVE-2017-20158 | vova07/yii2-fileapi-widget | Yii2 FileAPI Widget vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2017-1000227 | salutation (WordPress plugin) | Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin c | medium | 5.4 | 1% |
| CVE-2018-5214 | add-link-to-facebook (WordPress plugin) | The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php. | medium | 5.4 | 1% |
| CVE-2018-5311 | easy-custom-auto-excerpt (WordPress plugin) | The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php? | medium | 5.4 | 1% |
| CVE-2018-5312 | tabs-responsive (WordPress plugin) | The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php. | medium | 5.4 | 1% |
| CVE-2020-20129 | wanglelecc/laracms | Cross-site Scripting in LaraCMS | medium | 5.4 | 1% |
| CVE-2020-23049 | forkcms/forkcms | Cross-site scripting in forkcms | medium | 5.4 | 1% |
| CVE-2020-28957 | froxlor/froxlor | Foxlor cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2022-1776 | popups\,-welcome-bar\,-optins-and-lead-generation-plugin (WordPress plugin) | The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign paramete | medium | 5.4 | 1% |
| CVE-2022-1964 | easy-svg-support (WordPress plugin) | The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Autho | medium | 5.4 | 1% |
| CVE-2023-44766 | concrete5/concrete5 | ConcreteCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-3426 | advanced-wp-columns (WordPress plugin) | The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 1% |