Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-5218 | sylius/resource-bundle, sylius/sylius | Ability to expose data in Sylius by using an unintended serialisation group | medium | 4.4 | 1% |
| CVE-2023-2189 | stax-addons-for-elementor (WordPress plugin) | The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 1% |
| CVE-2025-31674 | drupal/core | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | medium | 0.0 | 1% |
| CVE-2025-51504 | microweber/microweber | Microweber XSS Vulnerability in the homepage Endpoint | medium | 0.0 | 1% |
| CVE-2023-1509 | gmace (WordPress plugin) | The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing n | high | 8.8 | 1% |
| CVE-2024-2342 | simply-schedule-appointments (WordPress plugin) | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the c | high | 8.8 | 1% |
| CVE-2023-46468 | juzaweb/cms | juzawebCMS Injection vulnerability | high | 7.8 | 1% |
| CVE-2024-2203 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via | medium | 6.4 | 1% |
| CVE-2024-3675 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flip Carousel, F | medium | 6.4 | 1% |
| CVE-2024-11002 | inpost-gallery (WordPress plugin) | The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJA | medium | 6.3 | 1% |
| CVE-2023-3708 | amela (WordPress plugin), arendelle (WordPress plugin), everse (WordPress plugin) +2 more | Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insuff | medium | 6.1 | 1% |
| CVE-2024-13112 | wp-mediatagger (WordPress plugin) | The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 1% |
| CVE-2024-13221 | fantastic-elasticsearch (WordPress plugin) | The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, l | medium | 6.1 | 1% |
| CVE-2024-13224 | slidedeck-1-lite-content-slider (WordPress plugin) | The SlideDeck 1 Lite Content Slider WordPress plugin through 1.4.8 does not sanitise and escape a parameter before outputting it back in the | medium | 6.1 | 1% |
| CVE-2024-13225 | ect-home-page-products (WordPress plugin) | The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2024-13226 | a5-custom-login-page (WordPress plugin) | The A5 Custom Login Page WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2024-37893 | grumpydictator/firefly-iii | Firefly III has a MFA bypass in oauth flow | medium | 5.9 | 1% |
| CVE-2024-9944 | woocommerce (WordPress plugin) | The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin | medium | 5.3 | 1% |
| CVE-2023-41798 | directorist (WordPress plugin) | Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Clas | medium | 5.1 | 1% |
| CVE-2022-25773 | mautic/core | Mautic allows Relative Path Traversal in assets file upload | medium | 4.3 | 1% |
| CVE-2023-0293 | mediamatic (WordPress plugin) | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its A | medium | 4.3 | 1% |
| CVE-2025-27188 | magento/community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2013-10020 | a-forms (WordPress plugin) | A vulnerability, which was classified as problematic, was found in MMDeveloper A Forms Plugin up to 1.4.2 on WordPress. This affects an unkn | low | 3.5 | 1% |
| CVE-2014-125090 | media-downloader (WordPress plugin) | A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects t | low | 3.5 | 1% |
| CVE-2015-10107 | simplr-registration-form-plus\+ (WordPress plugin) | A vulnerability was found in Simplr Registration Form Plus+ Plugin up to 2.3.4 on WordPress and classified as problematic. This issue affect | low | 3.5 | 1% |
| CVE-2015-10119 | view-all-post\'s-pages (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affe | low | 3.5 | 1% |
| CVE-2021-24159 | contact-form-7-style (WordPress plugin) | Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject maliciou | high | 8.8 | 1% |
| CVE-2024-5431 | wp-cafe (WordPress plugin) | The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local F | high | 8.8 | 1% |
| CVE-2022-25775 | mautic/core | Mautic SQL Injection in dynamic Reports | medium | 6.6 | 1% |
| CVE-2023-4961 | poptin (WordPress plugin) | The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1 | medium | 6.4 | 1% |
| CVE-2023-46722 | pimcore/admin-ui-classic-bundle | Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews | medium | 6.1 | 1% |
| CVE-2024-0907 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 5.3 | 1% |
| CVE-2024-1129 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 5.3 | 1% |
| CVE-2024-1130 | nex-forms-express-wp-form-builder (WordPress plugin) | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missi | medium | 5.3 | 1% |
| CVE-2023-53957 | kimai/kimai | Kimai contains a SameSite cookie vulnerability | critical | 9.8 | 1% |
| CVE-2024-13694 | smart-wishlist-for-more-convert (WordPress plugin) | The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insec | high | 7.5 | 1% |
| CVE-2021-3904 | getgrav/grav | Cross-Site Scripting in grav | medium | 6.3 | 1% |
| CVE-2023-27237 | lavalite/cms | LavaLite CMS vulnerable to host header injection attack | medium | 6.1 | 1% |
| CVE-2024-0976 | wp-event-manager (WordPress plugin) | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-S | medium | 6.1 | 1% |
| CVE-2021-32475 | moodle/moodle | Moodle stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2024-1038 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via a 'playground | medium | 5.4 | 1% |
| CVE-2024-45128 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 5.4 | 1% |
| CVE-2023-5549 | moodle/moodle | Moodle Improper Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2022-3824 | wp-admin-ui-customize (WordPress plugin) | The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2025-65345 | alexusmai/laravel-file-manager | alexusmai laravel-file-manager is vulnerable to Directory Traversal | low | 0.0 | 1% |
| CVE-2024-5606 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the | high | 8.8 | 1% |
| CVE-2025-66295 | getgrav/grav | Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption | high | 8.8 | 1% |
| CVE-2024-4469 | wp-staging (WordPress plugin) | The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conduc | high | 7.5 | 1% |
| CVE-2024-0386 | weforms (WordPress plugin) | The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Referer' HTTP header in all versions up to, and inclu | high | 7.2 | 1% |
| CVE-2026-29782 | devcode-it/openstamanager | OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2 | high | 7.2 | 1% |