Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-21622 | craftcms/cms | Craft CMS Privilege Escalation | medium | 5.4 | 1% |
| CVE-2023-3779 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including | medium | 5.3 | 1% |
| CVE-2021-25056 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perf | medium | 4.8 | 1% |
| CVE-2021-25066 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users t | medium | 4.8 | 1% |
| CVE-2021-25088 | google-xml-sitemaps (WordPress plugin) | The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could a | medium | 4.8 | 1% |
| CVE-2022-0663 | print\,-pdf\,-email-by-printfriendly (WordPress plugin) | The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which cou | medium | 4.8 | 1% |
| CVE-2022-1113 | flower-delivery (WordPress plugin) | The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high pr | medium | 4.8 | 1% |
| CVE-2022-1266 | post-grid\,-slider-\&-carousel-ultimate (WordPress plugin) | The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow hig | medium | 4.8 | 1% |
| CVE-2022-1301 | wp-contact-slider (WordPress plugin) | The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow | medium | 4.8 | 1% |
| CVE-2022-1326 | form---contact-form (WordPress plugin) | The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged us | medium | 4.8 | 1% |
| CVE-2022-1327 | image-gallery (WordPress plugin) | The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged use | medium | 4.8 | 1% |
| CVE-2022-1717 | custom-share-buttons-with-floating-sidebar (WordPress plugin) | The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could al | medium | 4.8 | 1% |
| CVE-2022-1889 | newsletter (WordPress plugin) | The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-1894 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perfo | medium | 4.8 | 1% |
| CVE-2022-1896 | underconstruction (WordPress plugin) | The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting befor | medium | 4.8 | 1% |
| CVE-2022-1915 | wp-zillow-review-slider (WordPress plugin) | The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross- | medium | 4.8 | 1% |
| CVE-2022-1971 | nextcellent-gallery (WordPress plugin) | The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high priv | medium | 4.8 | 1% |
| CVE-2022-1994 | login-with-otp-over-sms\,-email\,-whatsapp-and-google-authenticator (WordPress plugin) | The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing h | medium | 4.8 | 1% |
| CVE-2022-2050 | wp-paginate (WordPress plugin) | The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored | medium | 4.8 | 1% |
| CVE-2022-2093 | wp-duplicate-page (WordPress plugin) | The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-2100 | page-generator (WordPress plugin) | The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to p | medium | 4.8 | 1% |
| CVE-2022-2118 | 404s (WordPress plugin) | The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross | medium | 4.8 | 1% |
| CVE-2022-2148 | linkedin-company-updates (WordPress plugin) | The LinkedIn Company Updates WordPress plugin through 1.5.3 does not sanitise and escape its settings, allowing high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-2149 | very-simple-breadcrumb (WordPress plugin) | The Very Simple Breadcrumb WordPress plugin through 1.0 does not sanitise and escape its settings, allowing high privilege users such as adm | medium | 4.8 | 1% |
| CVE-2022-2151 | best-contact-management-software (WordPress plugin) | The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users | medium | 4.8 | 1% |
| CVE-2022-2169 | loading-page-with-loading-screen (WordPress plugin) | The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admi | medium | 4.8 | 1% |
| CVE-2022-2186 | simple-post-notes (WordPress plugin) | The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin t | medium | 4.8 | 1% |
| CVE-2022-2194 | accept-stripe (WordPress plugin) | The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users s | medium | 4.8 | 1% |
| CVE-2022-3420 | official-integration-for-billingo (WordPress plugin) | The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow hig | medium | 4.8 | 1% |
| CVE-2024-5658 | born05/craft-twofactorauthentication | Improper Authentication in CraftCMS two factor authentication plugin | medium | 4.8 | 1% |
| CVE-2025-30207 | getkirby/cms | Kirby vulnerable to path traversal in the router for PHP's built-in server | low | 0.0 | 1% |
| CVE-2026-28784 | craftcms/cms | Craft CMS has potential authenticated Remote Code Execution via Twig SSTI | medium | 0.0 | 1% |
| CVE-2025-32957 | baserproject/basercms | baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE) | high | 8.7 | 1% |
| CVE-2025-1717 | login-me-now (WordPress plugin) | The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecur | high | 8.1 | 1% |
| CVE-2023-6821 | error-log-viewer (WordPress plugin) | The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 is affected by a Directory Listing issue, allowing users to read and downl | medium | 6.5 | 1% |
| CVE-2020-36665 | artesaos/seotools | Artesãos SEOTools Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2023-5307 | contest-gallery (WordPress plugin) | The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauth | medium | 6.1 | 1% |
| CVE-2024-13543 | zarinpal-paid-download (WordPress plugin) | The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2024-13570 | stray-random-quotes (WordPress plugin) | The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leadi | medium | 6.1 | 1% |
| CVE-2024-22202 | phpmyfaq/phpmyfaq | phpMyFAQ User Removal Page Allows Spoofing Of User Details | medium | 5.7 | 1% |
| CVE-2022-0178 | snipe/snipe-it | Improper Access Control in snipe-it | medium | 5.4 | 1% |
| CVE-2022-1601 | user-access-manager (WordPress plugin) | The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, | medium | 5.3 | 1% |
| CVE-2025-8620 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and | medium | 5.3 | 1% |
| CVE-2022-1321 | google-authenticator (WordPress plugin) | The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious | medium | 4.8 | 1% |
| CVE-2024-29196 | phpmyfaq/phpmyfaq | phpMyFAQ Path Traversal in Attachments | low | 3.8 | 1% |
| CVE-2023-48649 | concrete5/concrete5 | Concrete CMS Cross-site Scripting vulnerability | low | 3.5 | 1% |
| CVE-2024-50345 | symfony/http-foundation, symfony/symfony | Symfony vulnerable to open redirect via browser-sanitized URLs | low | 3.1 | 1% |
| CVE-2024-11267 | jsp-store-locator (WordPress plugin) | The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing use | high | 8.8 | 1% |
| CVE-2024-13556 | affiliate-links (WordPress plugin) | The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in al | high | 8.1 | 1% |
| CVE-2025-6742 | sureforms (WordPress plugin) | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a | high | 7.5 | 1% |