Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-41169 | sulu/sulu | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu | medium | 6.2 | 1% |
| CVE-2021-4244 | yikesinc/yikes-inc-easy-mailchimp-extender | yikes-inc-easy-mailchimp-extender Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-4524 | roots/soil | Roots Soil plugin vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2026-52773 | yeswiki/yeswiki | YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` | medium | 6.1 | 1% |
| CVE-2019-8157 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Scripting via admin panel | medium | 5.4 | 1% |
| CVE-2023-44770 | tribalsystems/zenario | Zenario CMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-28472 | concrete5/concrete5 | Concrete CMS missing secure cookie parameters | medium | 5.3 | 1% |
| CVE-2019-8152 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2022-1945 | coming-soon-\&-maintenance-mode (WordPress plugin) | The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high priv | medium | 4.8 | 1% |
| CVE-2022-2114 | data-tables-generator (WordPress plugin) | The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could | medium | 4.8 | 1% |
| CVE-2022-3831 | recaptcha (WordPress plugin) | The reCAPTCHA WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2023-4304 | froxlor/froxlor | Froxlor vulnerable to business logic errors | low | 3.8 | 1% |
| CVE-2024-8485 | rest-api-to-miniprogram (WordPress plugin) | The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and includ | critical | 9.8 | 1% |
| CVE-2025-5482 | sunshine-photo-cart (WordPress plugin) | The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via accoun | high | 8.8 | 1% |
| CVE-2022-25278 | drupal/core | Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user | medium | 6.5 | 1% |
| CVE-2021-24255 | essential-addons-for-elementor (WordPress plugin) | The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XS | medium | 5.4 | 1% |
| CVE-2021-24256 | elementor---header\,-footer-\&-blocks-template (WordPress plugin) | The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Sc | medium | 5.4 | 1% |
| CVE-2021-24257 | premium-addons-for-elementor (WordPress plugin) | The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS | medium | 5.4 | 1% |
| CVE-2021-24259 | elementor-addon-elements (WordPress plugin) | The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) b | medium | 5.4 | 1% |
| CVE-2021-24262 | woolentor---woocommerce-elementor-addons-\+-builder (WordPress plugin) | The “WooLentor – WooCommerce Elementor Addons + Builder” WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site | medium | 5.4 | 1% |
| CVE-2021-24264 | image-hover-effects (WordPress plugin) | The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting (XS | medium | 5.4 | 1% |
| CVE-2021-24266 | the-plus-addons-for-elementor-page-builder-lite (WordPress plugin) | The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Sit | medium | 5.4 | 1% |
| CVE-2021-24268 | jetwidgets-for-elementor (WordPress plugin) | The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by | medium | 5.4 | 1% |
| CVE-2021-24269 | sina-extension-for-elementor (WordPress plugin) | The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XS | medium | 5.4 | 1% |
| CVE-2021-24270 | dethemekit-for-elementor (WordPress plugin) | The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lowe | medium | 5.4 | 1% |
| CVE-2021-24271 | ultimate-addons-for-elementor (WordPress plugin) | The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (X | medium | 5.4 | 1% |
| CVE-2021-24273 | clever-addons-for-elementor (WordPress plugin) | The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2022-4362 | popup-maker (WordPress plugin) | The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a | medium | 5.4 | 1% |
| CVE-2021-24539 | coming-soon\,-under-construction-\&-maintenance-mode-by-dazzler (WordPress plugin) | The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description | medium | 4.8 | 1% |
| CVE-2022-3622 | blog2social (WordPress plugin) | The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and includin | medium | 4.1 | 1% |
| CVE-2021-25014 | ibtana (WordPress plugin) | The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowin | low | 3.5 | 1% |
| CVE-2025-31493 | getkirby/cms | Kirby vulnerable to path traversal of collection names during file system lookup | medium | 0.0 | 1% |
| CVE-2018-5669 | read-and-understood (WordPress plugin) | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2018-6467 | flickrrss (WordPress plugin) | The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php. | high | 8.8 | 1% |
| CVE-2024-12873 | custom-field-manager (WordPress plugin) | The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leadin | medium | 6.1 | 1% |
| CVE-2010-10008 | simplesamlphp/simplesamlphp-module-openidprovider | simplesamlphp-module-openidprovider Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-0081 | monsterinsights (WordPress plugin) | The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a p | medium | 5.4 | 1% |
| CVE-2023-43828 | intelliants/subrion | Subrion CMS Cross-site Scripting vulnerability in /panel/languages | medium | 5.4 | 1% |
| CVE-2023-43830 | intelliants/subrion | Subrion CMS XSS in /panel/configuration/financial/ | medium | 5.4 | 1% |
| CVE-2020-23700 | lavalite/cms | Cross-site scripting in LavaLite-CMS | medium | 4.8 | 1% |
| CVE-2026-55469 | snipe/snipe-it | Snipe-IT has a path traversal vulnerability via CSV import `image` field | low | 0.0 | 1% |
| CVE-2023-49752 | adifier (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoon themes Adifier - Classified Ads | critical | 9.3 | 1% |
| CVE-2022-2184 | captcha-4wp (WordPress plugin) | The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This c | high | 8.8 | 1% |
| CVE-2025-2485 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, | high | 7.5 | 1% |
| CVE-2024-21667 | pimcore/customer-management-framework-bundle | Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts | medium | 6.5 | 1% |
| CVE-2023-0312 | thorsten/phpmyfaq | thorsten/phpmyfaq is vulnerable to cross-site scripting (XSS) | medium | 6.1 | 1% |
| CVE-2021-36863 | quiz-master-next (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress. | medium | 5.4 | 1% |
| CVE-2022-33943 | bxslider-wp (WordPress plugin) | Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at W | medium | 5.4 | 1% |
| CVE-2022-4836 | breadcrumb (WordPress plugin) | The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in t | medium | 5.4 | 1% |
| CVE-2023-0718 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder func | medium | 5.4 | 1% |