Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2086 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templa | medium | 4.3 | 1% |
| CVE-2024-0366 | starbox (WordPress plugin) | The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and in | medium | 4.3 | 1% |
| CVE-2024-28234 | contao/comments-bundle | Contao: Insufficient BBCode sanitizer | medium | 4.3 | 1% |
| CVE-2022-36343 | enable-svg-webp-ico-upload (WordPress plugin) | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plug | low | 3.4 | 1% |
| CVE-2025-31676 | drupal/email_tfa | This module enables you to do Two-Factor Authentication by email, using a user registered email to send a verification c | unknown | 0.0 | 1% |
| CVE-2026-9558 | mautic/core | Mautic has Server-Side Template Injection (SSTI) in Theme Templates | critical | 9.9 | 1% |
| CVE-2022-3897 | wp-affiliate-platform (WordPress plugin) | The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and in | medium | 5.5 | 1% |
| CVE-2021-36867 | wp-testing (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possib | medium | 5.4 | 1% |
| CVE-2021-36912 | google-news-sitemap (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have | medium | 5.4 | 1% |
| CVE-2023-0310 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2021-3851 | grumpydictator/firefly-iii | Open Redirect in firefly-iii | medium | 5.0 | 1% |
| CVE-2022-25612 | simple-event-planner (WordPress plugin) | Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user w | medium | 4.1 | 1% |
| CVE-2022-29433 | nd-donations (WordPress plugin) | Authenticated (contributor or higher role) Cross-Site Scripting (XSS) vulnerability in Donations plugin <= 1.8 on WordPress. | medium | 4.1 | 1% |
| CVE-2013-10026 | mail-subscribe-list (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress. This issue aff | low | 3.5 | 1% |
| CVE-2022-37328 | timeline-awesome (WordPress plugin) | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress. | low | 3.4 | 1% |
| CVE-2025-54378 | elmsln/haxcms | HAX CMS API Lacks Authorization Checks | high | 8.3 | 1% |
| CVE-2024-42485 | pxlrbt/filament-excel | Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint | high | 7.5 | 1% |
| CVE-2025-6464 | forminator (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all ve | high | 7.5 | 1% |
| CVE-2024-3045 | woocommerce-pdf-invoices-packing-slips (WordPress plugin) | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in | high | 7.2 | 1% |
| CVE-2021-46889 | photo-gallery (WordPress plugin) | The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covere | medium | 6.1 | 1% |
| CVE-2022-25849 | joyqi/hyper-down | HyperDown vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2023-3821 | pimcore/pimcore | Pimcore Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2018-16637 | evolutioncms/evolution | Evolution CMS Stored Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2022-37430 | silverstripe/framework | Stored XSS using uppercase characters in HTMLEditor | medium | 5.4 | 1% |
| CVE-2022-38147 | silverstripe/assets | XSS via uploaded gpx file | medium | 5.4 | 1% |
| CVE-2021-36832 | icegram (WordPress plugin) | WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][h | medium | 4.8 | 1% |
| CVE-2021-36884 | backup-backup (WordPress plugin) | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions. | medium | 4.8 | 1% |
| CVE-2021-36911 | comment-engine-pro (WordPress plugin) | Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by u | medium | 4.8 | 1% |
| CVE-2023-3706 | activitypub (WordPress plugin) | The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing | medium | 4.3 | 1% |
| CVE-2023-3707 | activitypub (WordPress plugin) | The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowi | medium | 4.3 | 1% |
| CVE-2026-45071 | symfony/dom-crawler, symfony/symfony | Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true | low | 0.0 | 1% |
| CVE-2026-46636 | twig/twig | Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders | unknown | 0.0 | 1% |
| CVE-2026-48736 | symfony/http-client, symfony/http-foundation, symfony/symfony | Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpCli | medium | 0.0 | 1% |
| CVE-2025-32931 | tcg/voyager | DevDojo Voyager Argument Injection vulnerability | critical | 9.1 | 1% |
| CVE-2024-27355 | phpseclib/phpseclib | phpseclib guardrails needed on OID length | high | 7.5 | 1% |
| CVE-2020-13156 | nukeviet/nukeviet | NukeViet Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2020-13157 | nukeviet/nukeviet | NukeViet Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2026-36340 | krayin/laravel-crm | Krayin CRM allows a remote attacker to execute arbitrary code via compose email function | high | 8.1 | 1% |
| CVE-2022-25273 | drupal/core | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to impro | high | 7.5 | 1% |
| CVE-2020-26253 | getkirby/cms, getkirby/panel | Kirby .dev domains and some reverse proxy setups were treated as local | medium | 6.8 | 1% |
| CVE-2025-0821 | bit-assist (WordPress plugin) | Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 | medium | 6.5 | 1% |
| CVE-2023-46735 | symfony/symfony, symfony/webhook | Symfony potential Cross-site Scripting in WebhookController | medium | 6.1 | 1% |
| CVE-2023-7253 | import-wp (WordPress plugin) | The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which | medium | 6.1 | 1% |
| CVE-2022-29440 | promotion-slider (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3 | medium | 5.4 | 1% |
| CVE-2022-29442 | private-messages-for-wordpress (WordPress plugin) | Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For WordPress <= 2.1.10 at WordPr | medium | 5.4 | 1% |
| CVE-2022-38460 | notice-board (WordPress plugin) | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress. | medium | 5.4 | 1% |
| CVE-2024-2538 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | medium | 5.4 | 1% |
| CVE-2022-25604 | pricetable (WordPress plugin) | Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin ( | medium | 4.1 | 1% |
| CVE-2023-6486 | ultimate-addons-for-gutenberg (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS metabox in all | medium | 6.4 | 1% |
| CVE-2024-28709 | limesurvey/limesurvey | LimeSurvey Cross Site Scripting vulnerability | medium | 6.1 | 1% |