Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-7315 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when gene | high | 7.5 | 1% |
| CVE-2024-13495 | gamipress (WordPress plugin) | The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to ar | high | 7.3 | 1% |
| CVE-2024-7766 | adicon-server (WordPress plugin) | The Adicon Server WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins | high | 7.2 | 1% |
| CVE-2024-12749 | competition-form (WordPress plugin) | The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to | high | 7.1 | 1% |
| CVE-2022-0191 | ad-invalid-click-protector (WordPress plugin) | The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attack | medium | 6.5 | 1% |
| CVE-2024-32489 | tecnickcom/tcpdf | TCPDF Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-38073 | awesome-support (WordPress plugin), awesome-support/awesome-support | Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 | medium | 5.4 | 1% |
| CVE-2023-4453 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields | medium | 5.4 | 1% |
| CVE-2022-0955 | pimcore/data-hub | Cross-site Scripting in Pimcore Datahub | medium | 4.8 | 1% |
| CVE-2025-4578 | file-provider (WordPress plugin) | The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an | critical | 9.8 | 1% |
| CVE-2025-4190 | csv-mass-importer (WordPress plugin) | The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to | high | 7.2 | 1% |
| CVE-2023-5774 | animated-counters (WordPress plugin) | The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, | medium | 6.4 | 1% |
| CVE-2024-0438 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age G | medium | 6.4 | 1% |
| CVE-2024-13219 | privacy-policy-genius (WordPress plugin) | The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, lea | medium | 6.1 | 1% |
| CVE-2024-13220 | google-map-professional (WordPress plugin) | The WordPress Google Map Professional (Map In Your Language) WordPress plugin through 1.0 does not sanitise and escape a parameter before ou | medium | 6.1 | 1% |
| CVE-2021-24415 | polo-video-gallery (WordPress plugin) | The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from | medium | 5.4 | 1% |
| CVE-2021-24416 | streamcast-radio-player (WordPress plugin) | The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing us | medium | 5.4 | 1% |
| CVE-2022-4476 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them ba | medium | 5.4 | 1% |
| CVE-2022-4479 | table-of-contents-plus (WordPress plugin) | The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 1% |
| CVE-2022-4481 | mesmerize-companion (WordPress plugin) | The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 1% |
| CVE-2023-5251 | grid-plus (WordPress plugin) | The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on | medium | 5.4 | 1% |
| CVE-2024-25981 | moodle/moodle | Improper Access Control in moodle | medium | 5.3 | 1% |
| CVE-2025-8081 | elementor (WordPress plugin) | The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images:: | medium | 4.9 | 1% |
| CVE-2024-50803 | redaxo/source | Redaxo Core CMS Cross Site Scripting (XSS) | medium | 0.0 | 1% |
| CVE-2024-9289 | affiliate-pro (WordPress plugin) | The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and includi | critical | 9.8 | 1% |
| CVE-2022-1213 | remdex/livehelperchat | Server side request forgery in LiveHelperChat | high | 7.7 | 1% |
| CVE-2021-34639 | download-manager (WordPress plugin) | Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extensi | high | 7.5 | 1% |
| CVE-2024-1169 | buddyforms (WordPress plugin) | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress | high | 7.5 | 1% |
| CVE-2021-4372 | woocommerce-dynamic-pricing-and-discounts (WordPress plugin) | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and inclu | medium | 6.5 | 1% |
| CVE-2022-2695 | beaver-builder (WordPress plugin) | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to | medium | 6.4 | 1% |
| CVE-2019-25144 | wp-html-mail (WordPress plugin) | The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input san | medium | 5.4 | 1% |
| CVE-2024-0701 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the us | medium | 5.3 | 1% |
| CVE-2024-0447 | artibot (WordPress plugin) | The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 5.0 | 1% |
| CVE-2023-22489 | flarum/core | Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted | low | 3.5 | 1% |
| CVE-2025-29448 | alextselegidis/easyappointments | Easy!Appointments Denial of Service (DoS) | medium | 0.0 | 1% |
| CVE-2026-52766 | yeswiki/yeswiki | YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action | critical | 9.1 | 1% |
| CVE-2023-5905 | export-posts-with-images (WordPress plugin) | The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export | high | 8.1 | 1% |
| CVE-2024-11729 | kivicare-clinic-management-system (WordPress plugin) | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service | medium | 6.5 | 1% |
| CVE-2024-12724 | wp-desklite (WordPress plugin) | The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 1% |
| CVE-2024-12732 | affiliateimportereb (WordPress plugin) | The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leadi | medium | 6.1 | 1% |
| CVE-2024-12734 | advance-post-prefix (WordPress plugin) | The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a pa | medium | 6.1 | 1% |
| CVE-2024-13619 | lifterlms (WordPress plugin) | The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 1% |
| CVE-2023-44761 | concrete5/concrete5 | ConcreteCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2024-1587 | newsmatic (WordPress theme) | The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsm | medium | 5.3 | 1% |
| CVE-2024-3601 | poll-maker (WordPress plugin) | The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch | medium | 5.3 | 1% |
| CVE-2022-3822 | donations-via-paypal (WordPress plugin) | The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 1% |
| CVE-2023-47125 | typo3/html-sanitizer | Bypassing Cross-Site Scripting Protection in TYPO3 HTML Sanitizer | medium | 4.7 | 1% |
| CVE-2021-4387 | opal-estate (WordPress plugin) | The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to mi | medium | 4.3 | 1% |
| CVE-2024-10528 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 4.3 | 1% |
| CVE-2026-96376 | drupal/cloud | The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user | unknown | 0.0 | 1% |