Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-35933 | prestashop/productcomments | PrestaShop Product Comments Cross-site Scripting vulnerability | medium | 4.3 | 1% |
| CVE-2023-2715 | groundhogg (WordPress plugin) | The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_tick | medium | 4.3 | 1% |
| CVE-2023-47127 | typo3/cms-core | TYPO3 vulnerable to Weak Authentication in Session Handling | medium | 4.2 | 1% |
| CVE-2025-3603 | flynax-bridge (WordPress plugin) | The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2. | critical | 9.8 | 1% |
| CVE-2024-48225 | funadmin/funadmin | SQL injection in funadmin | critical | 9.1 | 1% |
| CVE-2021-34631 | newsplugin (WordPress plugin) | The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.ph | high | 8.8 | 1% |
| CVE-2023-5235 | ovic-responsive-wpbakery (WordPress plugin) | The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which m | high | 8.8 | 1% |
| CVE-2024-1797 | wp-ulike (WordPress plugin) | The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to SQL Injection via the 'status' and 'id' attri | high | 8.8 | 1% |
| CVE-2023-4433 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | high | 8.3 | 1% |
| CVE-2019-8112 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Security Bypass | high | 7.5 | 1% |
| CVE-2023-5426 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | high | 7.5 | 1% |
| CVE-2021-24324 | all-404-redirect-to-homepage (WordPress plugin) | The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user | medium | 6.5 | 1% |
| CVE-2021-24467 | leaflet-map (WordPress plugin) | The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logg | medium | 6.5 | 1% |
| CVE-2023-49833 | spectra (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra – WordPress G | medium | 6.5 | 1% |
| CVE-2021-34668 | real-media-library (WordPress plugin) | The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides | medium | 6.4 | 1% |
| CVE-2022-4005 | donation-button (WordPress plugin) | The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow users with a role as low | medium | 5.4 | 1% |
| CVE-2022-4381 | popup-maker (WordPress plugin) | The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a | medium | 5.4 | 1% |
| CVE-2023-0491 | schedulicity (WordPress plugin) | The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2023-2450 | ajax-search-for-woocommerce (WordPress plugin) | The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version | medium | 4.4 | 1% |
| CVE-2024-25118 | typo3/cms-core | TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords | medium | 4.3 | 1% |
| CVE-2025-68456 | craftcms/cms | Unauthenticated Craft CMS users can trigger a database backup | high | 0.0 | 1% |
| CVE-2026-49209 | symfony/ux-live-component | symfony/ux-live-component: Denial of service via unbounded batch action requests | low | 0.0 | 1% |
| CVE-2023-1125 | ruby-help-desk (WordPress plugin) | The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allo | medium | 6.5 | 1% |
| CVE-2023-1324 | easy-forms-for-mailchimp (WordPress plugin) | The Easy Forms for Mailchimp WordPress plugin before 6.8.8 does not sanitise and escape some parameters before outputting them back in the r | medium | 6.1 | 1% |
| CVE-2023-2428 | thorsten/phpmyfaq | phpMyFAQ vulnerable to Stored Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-42949 | silverstripe/subsites | SilverStripe Subsite weakens file permissions | medium | 5.4 | 1% |
| CVE-2023-1022 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInforma | medium | 5.4 | 1% |
| CVE-2023-4469 | profile-extra-fields (WordPress plugin) | The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check | medium | 5.3 | 1% |
| CVE-2025-51488 | moonshine/moonshine | moonshine Stored Cross-Site Scripting Vulnerability in Create Admin | medium | 4.9 | 1% |
| CVE-2018-16630 | getkirby/kirby | Kirby XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2022-3835 | kwayy-html-sitemap (WordPress plugin) | The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2022-3840 | login-for-google-apps (WordPress plugin) | The Login for Google Apps WordPress plugin before 3.4.5 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-3909 | add-comments (WordPress plugin) | The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 1% |
| CVE-2022-3936 | team-members (WordPress plugin) | The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users su | medium | 4.8 | 1% |
| CVE-2022-4010 | image-hover-effects (WordPress plugin) | The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2022-4110 | eventify (WordPress plugin) | The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2022-4197 | slider (WordPress plugin) | The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 1% |
| CVE-2022-4200 | login-with-cognito (WordPress plugin) | The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 1% |
| CVE-2022-4226 | simple-basic-contact-form (WordPress plugin) | The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 1% |
| CVE-2022-4242 | wp-google-review-slider (WordPress plugin) | The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-4243 | imageinject (WordPress plugin) | The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 1% |
| CVE-2022-36390 | calendar-event (WordPress plugin) | Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at Wor | medium | 4.1 | 1% |
| CVE-2012-10013 | backend-localization (WordPress plugin) | A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affe | low | 3.5 | 1% |
| CVE-2012-10014 | backend-localization (WordPress plugin) | A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function b | low | 3.5 | 1% |
| CVE-2013-10021 | debug-bar (WordPress plugin) | A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerabili | low | 3.5 | 1% |
| CVE-2015-10092 | qtranslate-slug (WordPress plugin) | A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the functi | low | 3.5 | 1% |
| CVE-2015-10098 | broken-link-checker (WordPress plugin) | A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue | low | 3.5 | 1% |
| CVE-2022-2518 | stockists-manager (WordPress plugin) | The Stockists Manager for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0 | high | 8.8 | 1% |
| CVE-2023-7239 | wp-dashboard-notes (WordPress plugin) | The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update | high | 7.5 | 1% |
| CVE-2021-24490 | email-artillery (WordPress plugin) | The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, all | medium | 6.8 | 1% |