Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-56520 | tecnickcom/tc-lib-pdf-font | tecnickcom/tc-lib-pdf-font mishandles fonts | medium | 0.0 | 1% |
| CVE-2026-21451 | bagisto/bagisto | Bagisto has HTML Filter Bypass that Enables Stored XSS | medium | 0.0 | 1% |
| CVE-2022-3771 | noumo/easyii | easyii CMS's File Upload Management vulnerable to unrestricted upload | critical | 9.8 | 1% |
| CVE-2024-11721 | acf-frontend-form-element (WordPress plugin) | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. Th | high | 8.1 | 1% |
| CVE-2022-1235 | remdex/livehelperchat | Weak password hash in LiveHelperChat | high | 7.5 | 1% |
| CVE-2024-5598 | file-manager-advanced (WordPress plugin) | The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 v | high | 7.5 | 1% |
| CVE-2023-48865 | reportico-web/reportico | Reportico affected by Incorrect Access Control | medium | 6.5 | 1% |
| CVE-2023-4620 | booking-calendar (WordPress plugin) | The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated us | medium | 6.1 | 1% |
| CVE-2018-20682 | forkcms/forkcms | Fork CMS XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8092 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8117 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8120 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8128 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Scripting via store name | medium | 5.4 | 1% |
| CVE-2019-8129 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Scripting via Signifyd Guarantee Option Translation Override | medium | 5.4 | 1% |
| CVE-2019-8131 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8132 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8138 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8139 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8142 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8145 | magento/community-edition, magento/product-community-edition | Magento Cross-Site Scripting via Attribute Set Name | medium | 5.4 | 1% |
| CVE-2019-8146 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-8147 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2020-9311 | silverstripe/cms, silverstripe/framework | Silverstripe CMS XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2021-24265 | rife-elementor-extensions-\&-templates (WordPress plugin) | The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS | medium | 5.4 | 1% |
| CVE-2022-38461 | wpml (WordPress plugin) | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher | medium | 5.4 | 1% |
| CVE-2021-23209 | accelerated-mobile-pages (WordPress plugin) | Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile | medium | 4.8 | 1% |
| CVE-2015-9418 | watupro (WordPress plugin) | The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes. | medium | 4.3 | 1% |
| CVE-2022-38974 | wpml (WordPress plugin) | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher us | medium | 4.3 | 1% |
| CVE-2024-10002 | rover-idx (WordPress plugin) | The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insuf | high | 8.8 | 1% |
| CVE-2024-11638 | gtbabel (WordPress plugin) | The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow u | high | 8.8 | 1% |
| CVE-2023-1129 | wp-fevents-book (WordPress plugin) | The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowi | medium | 6.5 | 1% |
| CVE-2023-35093 | masterstudy-lms (WordPress plugin) | Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 ve | medium | 6.5 | 1% |
| CVE-2024-2255 | essential-blocks (WordPress plugin) | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | 1% |
| CVE-2022-4647 | microweber/microweber | Microweber vulnerable to Stored Cross-Site Scripting | medium | 6.1 | 1% |
| CVE-2023-29009 | baserproject/basercms | baserCMS Cross-site Scripting Vulnerability in Favorites Feature | medium | 6.1 | 1% |
| CVE-2020-15514 | haffner/jh_captcha | jh_captcha for Typo3 XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2020-15517 | tpwd/ke_search | ke_search for Typo3 XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2021-28380 | aimeos/aimeos-typo3 | Aimeos Typo3 extension contains Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-4448 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a pag | medium | 5.4 | 1% |
| CVE-2022-4674 | ibtana (WordPress plugin) | The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role | medium | 5.4 | 1% |
| CVE-2024-1047 | orbit-fox (WordPress plugin) | Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing cap | medium | 5.3 | 1% |
| CVE-2025-27190 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control leads to Security feature bypass | medium | 5.3 | 1% |
| CVE-2022-34656 | polls-widget (WordPress plugin) | Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at | medium | 4.8 | 1% |
| CVE-2024-5727 | widget4call (WordPress plugin) | The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 4.7 | 1% |
| CVE-2024-11354 | ultimate-youtube-video-player (WordPress plugin) | The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 1% |
| CVE-2024-48227 | funadmin/funadmin | Logic flaw in Funadmin | high | 7.5 | 1% |
| CVE-2025-4840 | likes-and-dislikes (WordPress plugin) | The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a | high | 7.5 | 1% |
| CVE-2024-1290 | user-registration-forms (WordPress plugin) | The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortc | medium | 6.5 | 1% |
| CVE-2020-36670 | nex-forms (WordPress plugin) | The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 | medium | 6.3 | 1% |
| CVE-2023-6965 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, | medium | 4.3 | 1% |