Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12822 | media-manager (WordPress plugin) | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation | critical | 9.8 | 1% |
| CVE-2026-52854 | mediawiki/maps | mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function | high | 8.6 | 1% |
| CVE-2022-2446 | wp-editor (WordPress plugin) | The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up | high | 7.2 | 1% |
| CVE-2024-0381 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe- | medium | 6.4 | 1% |
| CVE-2023-37280 | pimcore/admin-ui-classic-bundle | Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page | medium | 6.1 | 1% |
| CVE-2022-4664 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a | medium | 5.4 | 1% |
| CVE-2023-5545 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability | medium | 5.3 | 1% |
| CVE-2024-10393 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a mi | medium | 5.3 | 1% |
| CVE-2024-12601 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due | medium | 5.3 | 1% |
| CVE-2023-0689 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versio | medium | 4.3 | 1% |
| CVE-2024-0385 | categorify (WordPress plugin) | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj | medium | 4.3 | 1% |
| CVE-2024-45135 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | low | 2.7 | 1% |
| CVE-2024-56329 | joelbutcher/socialstream | Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback | high | 0.0 | 1% |
| CVE-2024-5605 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_clou | high | 8.8 | 1% |
| CVE-2024-2020 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all version | high | 7.2 | 1% |
| CVE-2024-3901 | genesis-blocks (WordPress plugin) | The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possi | medium | 6.8 | 1% |
| CVE-2022-3415 | chat-bubble (WordPress plugin) | The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attacker | medium | 6.1 | 1% |
| CVE-2021-24471 | youtube-embed (WordPress plugin) | The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XS | medium | 5.4 | 1% |
| CVE-2022-34658 | download-manager (WordPress plugin) | Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at | medium | 5.4 | 1% |
| CVE-2022-36355 | easy-org-chart (WordPress plugin) | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Easy Org Chart plugin <= 3.1 at WordPress. | medium | 5.4 | 1% |
| CVE-2024-10813 | woo-product-table (WordPress plugin) | The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposur | medium | 5.3 | 1% |
| CVE-2025-51503 | microweber/microweber | Microweber Has Stored XSS Vulnerability in User Profile Fields | low | 0.0 | 1% |
| CVE-2024-13477 | ltl-freight-quotes-unishippers-edition (WordPress plugin) | The LTL Freight Quotes – Unishippers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions | high | 7.5 | 1% |
| CVE-2021-24531 | charitable (WordPress plugin) | The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability wh | medium | 5.4 | 1% |
| CVE-2023-0684 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders | medium | 5.4 | 1% |
| CVE-2023-0711 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state funct | medium | 5.4 | 1% |
| CVE-2023-0713 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder funct | medium | 5.4 | 1% |
| CVE-2023-0715 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder fun | medium | 5.4 | 1% |
| CVE-2023-0716 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder func | medium | 5.4 | 1% |
| CVE-2023-0717 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder fu | medium | 5.4 | 1% |
| CVE-2023-0720 | wicked-folders (WordPress plugin) | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_orde | medium | 5.4 | 1% |
| CVE-2024-52600 | statamic/cms | Statamic CMS has a Path Traversal in Asset Upload | medium | 5.3 | 1% |
| CVE-2023-3469 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting | medium | 5.2 | 1% |
| CVE-2022-37059 | intelliants/subrion | Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel | medium | 4.8 | 1% |
| CVE-2022-3839 | analytics-for-wp (WordPress plugin) | The Analytics for WP WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2023-2630 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) vulnerability in Admin Translations | medium | 4.8 | 1% |
| CVE-2023-1026 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory | medium | 4.3 | 1% |
| CVE-2024-6434 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, a | low | 3.1 | 1% |
| CVE-2024-13239 | drupal/tfa | This module enables you to allow and/or require users to use a second authentication method in addition to password auth | unknown | 0.0 | 1% |
| CVE-2026-33183 | saloonphp/saloon | Saloon has a Fixture Name Path Traversal Vulnerability | medium | 0.0 | 1% |
| CVE-2026-52827 | kimai/kimai | Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP | high | 0.0 | 1% |
| CVE-2026-82394 | sulu/sulu | Sulu: Fix authorization bypass when creating preview links | medium | 0.0 | 1% |
| CVE-2024-12919 | paid-member-subscriptions (WordPress plugin) | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to A | critical | 9.8 | 1% |
| CVE-2021-24945 | like-button-rating (WordPress plugin) | The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes | high | 8.0 | 1% |
| CVE-2024-6477 | userswp (WordPress plugin) | The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated a | high | 7.5 | 1% |
| CVE-2021-24231 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers | medium | 6.5 | 1% |
| CVE-2021-24779 | wp-debugging (WordPress plugin) | The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and | medium | 6.5 | 1% |
| CVE-2021-25081 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow | medium | 6.5 | 1% |
| CVE-2023-28850 | pimcore/perspective-editor | Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name | medium | 6.1 | 1% |
| CVE-2018-16638 | evolutioncms/evolution | Evolution CMS Cross-site Scripting (XSS) | medium | 5.4 | 1% |