Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-28710 | limesurvey/limesurvey | LimeSurvey Cross Site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-1750 | sticky-popup (WordPress plugin) | The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and i | medium | 5.5 | 1% |
| CVE-2024-11089 | anonymous-restricted-content (WordPress plugin) | The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 1% |
| CVE-2023-2083 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save f | medium | 4.3 | 1% |
| CVE-2023-4941 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability | medium | 4.3 | 1% |
| CVE-2023-4943 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability | medium | 4.3 | 1% |
| CVE-2022-23601 | symfony/framework-bundle, symfony/symfony | CSRF token missing in Symfony | high | 8.1 | 1% |
| CVE-2022-2716 | beaver-builder (WordPress plugin) | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Editor' block in versio | medium | 6.4 | 1% |
| CVE-2022-2934 | beaver-builder (WordPress plugin) | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image URL' value found in th | medium | 6.4 | 1% |
| CVE-2023-4945 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in versions up to, and | medium | 6.4 | 1% |
| CVE-2019-7882 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-7921 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 5.4 | 1% |
| CVE-2019-7944 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-7945 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2022-37247 | craftcms/cms | Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page | medium | 5.4 | 1% |
| CVE-2023-0306 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-25606 | wp-downloadmanager (WordPress plugin) | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68 | medium | 4.8 | 1% |
| CVE-2024-7493 | wpcom-member (WordPress plugin) | The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to th | critical | 9.8 | 1% |
| CVE-2024-3050 | site-reviews (WordPress plugin) | The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to man | critical | 9.1 | 1% |
| CVE-2021-4349 | process-steps-template-designer (WordPress plugin) | The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1 | high | 8.8 | 1% |
| CVE-2026-30932 | froxlor/froxlor | Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API | high | 8.8 | 1% |
| CVE-2024-8479 | simple-spoiler (WordPress plugin) | The The Simple Spoiler plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 1.2 to 1.3. This is due to the plugin | high | 7.3 | 1% |
| CVE-2024-9846 | enable-shortcodes-inside-widgetscomments-and-experts (WordPress plugin) | The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver | high | 7.3 | 1% |
| CVE-2022-24712 | codeigniter4/framework | Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4 | medium | 6.3 | 1% |
| CVE-2021-36919 | awesome-support (WordPress plugin) | Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnera | medium | 6.1 | 1% |
| CVE-2023-6155 | quiz-maker (WordPress plugin) | The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unau | medium | 5.3 | 1% |
| CVE-2023-7232 | backup-and-restore-wordpress (WordPress plugin) | The Backup and Restore WordPress WordPress plugin through 1.45 does not protect some log files containing sensitive information such as sit | medium | 5.3 | 1% |
| CVE-2024-3678 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 5.3 | 1% |
| CVE-2024-1286 | paid-memberships-pro (WordPress plugin) | The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive infor | medium | 4.9 | 1% |
| CVE-2018-16629 | intelliants/subrion | Subrion CMS XSS | medium | 4.8 | 1% |
| CVE-2022-23979 | ultimate-reviews (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15). | medium | 4.8 | 1% |
| CVE-2022-29422 | countdown-builder (WordPress plugin) | Multiple Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerabilities in Adam Skaat's Countdown & Clock plugin <= 2.3.2 at W | medium | 4.8 | 1% |
| CVE-2022-33191 | testimonials (WordPress plugin) | Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0 | medium | 4.1 | 1% |
| CVE-2022-34650 | adl-team (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at | medium | 4.1 | 1% |
| CVE-2022-34853 | adl-team (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 | medium | 4.1 | 1% |
| CVE-2021-36844 | wp-subscribe (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop WP Subscribe plugin <= 1.2.12 on WordPress. | low | 3.4 | 1% |
| CVE-2026-25495 | craftcms/cms | Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` | high | 0.0 | 1% |
| CVE-2023-0088 | swifty-page-manager (WordPress plugin) | The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is du | high | 8.8 | 1% |
| CVE-2025-26533 | moodle/moodle | Moodle has a SQL injection risk in course search module list filter | high | 8.1 | 1% |
| CVE-2023-41005 | pagekit/pagekit | Command injection in pagekit | high | 7.8 | 1% |
| CVE-2024-21666 | pimcore/customer-management-framework-bundle | Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list | medium | 6.5 | 1% |
| CVE-2022-3975 | nukeviet/nukeviet | NukeView CMS vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2023-2708 | video-slider-with-thumbnails (WordPress plugin) | The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, an | medium | 6.1 | 1% |
| CVE-2022-40191 | mega-forms (WordPress plugin) | Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at W | medium | 5.4 | 1% |
| CVE-2023-6447 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and | medium | 5.3 | 1% |
| CVE-2024-2541 | popup-builder (WordPress plugin) | The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the S | medium | 5.3 | 1% |
| CVE-2023-3129 | url-shortify (WordPress plugin) | The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2023-3225 | float-menu (WordPress plugin) | The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2024-51758 | filament/actions | Filament has exported files stored in default (`public`) filesystem if not reconfigured | low | 2.4 | 1% |
| CVE-2026-11913 | drupal/mothermayi | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 1% |