Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-4074 | whmcs-bridge (WordPress plugin) | The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-br | medium | 6.4 | 1% |
| CVE-2023-0791 | thorsten/phpmyfaq | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | 1% |
| CVE-2023-0794 | thorsten/phpmyfaq | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | 1% |
| CVE-2023-1069 | complianz (WordPress plugin), really-simple-plugins/complianz-gdpr | The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcod | medium | 5.4 | 1% |
| CVE-2023-4520 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter s | medium | 5.4 | 1% |
| CVE-2020-10945 | centreon/centreon | Centreon Sensitive Data Exposure vulnerability | medium | 4.3 | 1% |
| CVE-2024-8538 | tuxedo-big-file-uploads (WordPress plugin) | The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, a | medium | 4.3 | 1% |
| CVE-2024-48218 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 1% |
| CVE-2024-48223 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 1% |
| CVE-2024-48226 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 1% |
| CVE-2021-4131 | remdex/livehelperchat | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2026-33686 | code16/sharp | Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil | high | 8.8 | 1% |
| CVE-2024-1776 | admin-side-data-storage-for-contact-form-7 (WordPress plugin) | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'form-id' parameter in all versio | high | 7.2 | 1% |
| CVE-2024-23817 | dolibarr/dolibarr | Dolibarr Application Home Page has HTML injection vulnerability | high | 7.1 | 1% |
| CVE-2022-2517 | beaver-builder (WordPress plugin) | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption - On Hover' value as | medium | 6.4 | 1% |
| CVE-2023-5049 | rafflepress (WordPress plugin) | The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'raffl | medium | 6.4 | 1% |
| CVE-2023-5638 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcj_image' shortcode in versions up to, a | medium | 6.4 | 1% |
| CVE-2024-0382 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, a | medium | 6.4 | 1% |
| CVE-2024-0384 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Notes in all versions up to, and including, | medium | 6.4 | 1% |
| CVE-2022-4374 | bg-bible-references (WordPress plugin) | The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, lead | medium | 6.1 | 1% |
| CVE-2021-35955 | contao/contao, contao/core-bundle | Cross site scripting via HTML attributes in the back end | medium | 5.9 | 1% |
| CVE-2021-36871 | wp-go-maps (WordPress plugin) | Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1 | medium | 5.5 | 1% |
| CVE-2013-4791 | prestashop/prestashop | PrestaShop Stored Cross-Site Scripting Vulnerability | medium | 5.4 | 1% |
| CVE-2019-19981 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings. | medium | 5.4 | 1% |
| CVE-2019-7853 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7862 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7863 | magento/community-edition, magento/product-community-edition | Magento Stored cross-site scripting in admin panel | medium | 4.8 | 1% |
| CVE-2019-7866 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7867 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7868 | magento/community-edition, magento/product-community-edition | Magento Cross-site Scripting in the admin panel | medium | 4.8 | 1% |
| CVE-2019-7869 | magento/community-edition, magento/product-community-edition | Magento Stored Cross-site Scripting vulnerability in the admin panel | medium | 4.8 | 1% |
| CVE-2019-7875 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7880 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7887 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7897 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7908 | magento/community-edition, magento/product-community-edition | Magento Cross-site Scripting in the admin panel | medium | 4.8 | 1% |
| CVE-2019-7909 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Cross-site Scripting Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7926 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7927 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7934 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7935 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7936 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7937 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-7938 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2023-3996 | armember-membership (WordPress plugin) | The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and i | medium | 4.4 | 1% |
| CVE-2024-3068 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cfs[fields][*][name]' parameter in all ver | medium | 4.4 | 1% |
| CVE-2022-0984 | moodle/moodle | Missing authorization in Moodle | medium | 4.3 | 1% |
| CVE-2022-0985 | moodle/moodle | Improper Authentication in moodle | medium | 4.3 | 1% |
| CVE-2023-2287 | orbitfox (WordPress plugin) | The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowin | medium | 4.3 | 1% |
| CVE-2019-7940 | magento/magento1ce, magento/magento1ee, magento/product-community-edition | PRODSECBUG-2371: Stored cross-site scripting in the admin panel | unknown | 0.0 | 1% |