Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-11269 | ahathat (WordPress plugin) | The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin | high | 7.2 | 1% |
| CVE-2024-12735 | advance-post-prefix (WordPress plugin) | The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing | high | 7.2 | 1% |
| CVE-2024-9831 | taskbuilder (WordPress plugin) | The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins | high | 7.2 | 1% |
| CVE-2023-5335 | buzzsprout-podcasting (WordPress plugin) | The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, an | medium | 6.4 | 1% |
| CVE-2023-5666 | accordions-wp (WordPress plugin) | The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcpaccordion' shortcode in all versions up | medium | 6.4 | 1% |
| CVE-2022-3206 | passster (WordPress plugin) | The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is ea | medium | 5.9 | 1% |
| CVE-2024-25979 | moodle/moodle | Improper Handling of Parameters in moodle | medium | 5.3 | 1% |
| CVE-2022-35882 | gs-testimonial (WordPress plugin) | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9 | medium | 4.8 | 1% |
| CVE-2022-36378 | floating-div (WordPress plugin) | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at | medium | 4.8 | 1% |
| CVE-2024-34355 | typo3/cms-core | TYPO3 vulnerable to an HTML Injection in the History Module | low | 3.5 | 1% |
| CVE-2014-125103 | twitter (WordPress plugin) | A vulnerability was found in BestWebSoft Twitter Plugin up to 1.3.2 on WordPress. It has been declared as problematic. Affected by this vuln | low | 2.4 | 1% |
| CVE-2022-29451 | rara-one-click-demo-import (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress | high | 8.8 | 1% |
| CVE-2024-12269 | safe-ai-malware-protection-for-wp (WordPress plugin) | The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on | high | 7.5 | 1% |
| CVE-2026-34381 | admidio/admidio | Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess | high | 7.5 | 1% |
| CVE-2023-5703 | gift-up (WordPress plugin) | The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gif | medium | 6.4 | 1% |
| CVE-2022-48150 | shopware/shopware | Shopware vulnerable to cross-site scripting (XSS) | medium | 6.1 | 1% |
| CVE-2021-36870 | wp-google-maps (WordPress plugin) | Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12). Vulner | medium | 5.5 | 1% |
| CVE-2021-36872 | wordpress-popular-posts (WordPress plugin) | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widg | medium | 5.5 | 1% |
| CVE-2022-4519 | wp-user (WordPress plugin) | The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, | medium | 5.5 | 1% |
| CVE-2022-37421 | silverstripe/cms | Silverstipe CMS Stored XSS in custom meta tags | medium | 5.4 | 1% |
| CVE-2022-38146 | silverstripe/admin | URL XSS vulnerability due to outdated jquery in CMS | medium | 5.4 | 1% |
| CVE-2021-36397 | moodle/moodle | Moodle has Incorrect Default Permissions | medium | 5.3 | 1% |
| CVE-2022-1028 | wordpress-security (WordPress plugin) | The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its setti | medium | 4.8 | 1% |
| CVE-2022-1995 | malware-scanner (WordPress plugin) | The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with adminis | medium | 4.8 | 1% |
| CVE-2024-13831 | wc-tabs (WordPress plugin) | The Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserial | high | 7.2 | 1% |
| CVE-2024-13114 | wp-projects-portfolio-with-client-testimonials (WordPress plugin) | The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting i | medium | 6.1 | 1% |
| CVE-2024-13222 | user-messages (WordPress plugin) | The User Messages WordPress plugin through 1.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 1% |
| CVE-2024-13325 | glossy (WordPress plugin) | The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle | medium | 6.1 | 1% |
| CVE-2024-13326 | ibuildapp (WordPress plugin) | The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 1% |
| CVE-2024-13327 | musicbox (WordPress plugin) | The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref | medium | 6.1 | 1% |
| CVE-2024-13328 | giga-messenger (WordPress plugin) | The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 1% |
| CVE-2024-13492 | guten-free-options (WordPress plugin) | The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leadin | medium | 6.1 | 1% |
| CVE-2024-0904 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privileg | medium | 5.9 | 1% |
| CVE-2023-28477 | concrete5/concrete5 | Stored cross site scripting on API integration | medium | 5.5 | 1% |
| CVE-2020-13971 | shopware/platform | Shopware vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-44764 | concrete5/concrete5 | ConcreteCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2024-29643 | croogo/croogo | croogo Host header injection | medium | 0.0 | 1% |
| CVE-2026-9559 | mautic/core | Mautic vulnerable to Path Traversal via Campaign Import | critical | 9.9 | 1% |
| CVE-2021-24890 | scripts-organizer (WordPress plugin) | The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both | high | 8.8 | 1% |
| CVE-2022-3561 | librenms/librenms | Cross-site Scripting in librenms/librenms | medium | 6.1 | 1% |
| CVE-2025-1303 | plugin-oficial (WordPress plugin) | The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading t | medium | 6.1 | 1% |
| CVE-2022-4619 | codelights-shortcodes-and-widgets (WordPress plugin) | The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in v | medium | 5.5 | 1% |
| CVE-2022-27854 | wp-testing (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possib | medium | 5.4 | 1% |
| CVE-2024-10540 | bookingpress-appointment-booking (WordPress plugin) | The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'se | medium | 5.3 | 1% |
| CVE-2021-41836 | fathom-analytics (WordPress plugin) | The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the | medium | 4.8 | 1% |
| CVE-2022-3469 | wp-attachments (WordPress plugin) | The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users | medium | 4.8 | 1% |
| CVE-2015-10101 | google-analytics-top-content-widget (WordPress plugin) | A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this | low | 3.5 | 1% |
| CVE-2021-36889 | tarteaucitronjs (WordPress plugin) | Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR Wo | low | 3.4 | 1% |
| CVE-2024-48222 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 1% |
| CVE-2023-5320 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | critical | 9.0 | 1% |