Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-12535 | drupal/formatter_field | The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for display | unknown | 0.0 | 1% |
| CVE-2026-9726 | drupal/basket | The Basket module enables e-commerce and checkout functionality for Drupal sites. The module does not sufficiently sani | unknown | 0.0 | 1% |
| CVE-2024-7150 | slider-wd (WordPress plugin) | The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all v | high | 8.8 | 1% |
| CVE-2023-46725 | foodcoopshop/foodcoopshop | FoodCoopShop Server-Side Request Forgery vulnerability | high | 8.1 | 1% |
| CVE-2024-1806 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 1% |
| CVE-2017-9070 | modx/revolution | MODX Revolution cross-site scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-2322 | pimcore/pimcore | Cross-site Scripting (XSS) in Document Properties Parameter | medium | 5.2 | 1% |
| CVE-2022-25605 | wp-downloadmanager (WordPress plugin) | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68 | medium | 4.8 | 1% |
| CVE-2020-36760 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to mi | medium | 4.3 | 1% |
| CVE-2020-36761 | top-10 (WordPress plugin) | The Top 10 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.4. This is due to missing | medium | 4.3 | 1% |
| CVE-2021-4425 | defender-security (WordPress plugin) | The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due | medium | 4.3 | 1% |
| CVE-2021-4426 | absolute-reviews (WordPress plugin) | The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due t | medium | 4.3 | 1% |
| CVE-2021-4427 | free-comments-for-wordpress-vuukle (WordPress plugin) | The Vuukle Comments, Reactions, Share Bar, Revenue plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 1% |
| CVE-2022-40208 | moodle/moodle | Moodle may allow students to bypass sequential navigation during a quiz attempt | medium | 4.3 | 1% |
| CVE-2023-22251 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 4.3 | 1% |
| CVE-2024-5314 | dolibarr/dolibarr | Dolibarr vulnerable to SQL Injection | critical | 9.1 | 1% |
| CVE-2023-49826 | soledad (WordPress plugin) | Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This is | high | 8.1 | 1% |
| CVE-2026-54178 | backpack/crud | Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk | high | 8.1 | 1% |
| CVE-2023-48295 | librenms/librenms | LibreNMS Cross-site Scripting at Device groups Deletion feature | medium | 6.3 | 1% |
| CVE-2023-2119 | responsive-filterable-portfolio (WordPress plugin) | The Responsive Filterable Portfolio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in ve | medium | 6.1 | 1% |
| CVE-2021-41502 | intelliants/subrion | Cross site scripting in intelliants/subrion | medium | 5.4 | 1% |
| CVE-2022-4670 | pdf.js-viewer (WordPress plugin) | The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2022-4677 | leaflet-maps-marker (WordPress plugin) | The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users | medium | 5.4 | 1% |
| CVE-2023-0143 | send-pdf-for-contact-form-7 (WordPress plugin) | The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputt | medium | 5.4 | 1% |
| CVE-2023-0171 | jquery-t\(-\)-countdown-widget (WordPress plugin) | The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputt | medium | 5.4 | 1% |
| CVE-2023-0373 | lightweight-accordion (WordPress plugin) | The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back | medium | 5.4 | 1% |
| CVE-2023-6557 | the-events-calendar (WordPress plugin) | The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 v | medium | 5.3 | 1% |
| CVE-2024-1121 | advanced-forms (WordPress plugin) | The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export | medium | 5.3 | 1% |
| CVE-2023-0565 | froxlor/froxlor | Froxlor contains Business Logic Errors | medium | 4.9 | 1% |
| CVE-2022-25603 | maxgalleria (WordPress plugin) | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versi | medium | 4.8 | 1% |
| CVE-2022-29438 | baslider (WordPress plugin) | Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 a | medium | 4.8 | 1% |
| CVE-2022-35275 | woo-order-export-lite (WordPress plugin) | Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin < | medium | 4.8 | 1% |
| CVE-2022-35725 | wp-forecast (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-36356 | culture-object (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at Wo | medium | 4.8 | 1% |
| CVE-2022-37335 | wha-wordsearch (WordPress plugin) | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in WHA's Word Search Puzzles game plugin <= 2.0.1 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-37403 | add-user-role (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-37404 | add2fav (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-37412 | better-delete-revision (WordPress plugin) | Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin <= 1.6.1 at Word | medium | 4.8 | 1% |
| CVE-2022-38068 | export-post-info (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-4112 | quizlord (WordPress plugin) | The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2023-5228 | user-registration (WordPress plugin) | The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege us | medium | 4.8 | 1% |
| CVE-2024-1795 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the | high | 8.8 | 1% |
| CVE-2024-13472 | wc-product-table-lite (WordPress plugin) | The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includ | high | 7.3 | 1% |
| CVE-2024-13352 | legull (WordPress plugin) | The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle | high | 7.1 | 1% |
| CVE-2021-36886 | contact-form-cfdb7 (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9). | medium | 6.5 | 1% |
| CVE-2023-6158 | eventon (WordPress plugin), eventon-lite (WordPress plugin) | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of da | medium | 6.5 | 1% |
| CVE-2023-4842 | social-warfare (WordPress plugin) | The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode | medium | 6.4 | 1% |
| CVE-2023-3118 | export-all-urls (WordPress plugin) | The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to | medium | 6.1 | 1% |
| CVE-2023-0162 | cpo-companion (WordPress plugin) | The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in v | medium | 5.5 | 1% |
| CVE-2023-0295 | launchpad-by-obox (WordPress plugin) | The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, an | medium | 5.5 | 1% |