Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-3901 | grumpydictator/firefly-iii | Cross-Site Request Forgery in firefly-iii | low | 3.5 | 1% |
| CVE-2022-1732 | rename-wp-login (WordPress plugin) | The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could all | medium | 6.5 | 1% |
| CVE-2023-4775 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, | medium | 6.4 | 1% |
| CVE-2023-5741 | powr-pack (WordPress plugin) | The POWR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'powr-powr-pack' shortcode in all versions up to | medium | 6.4 | 1% |
| CVE-2020-21246 | sheng/yiicms | YiiCMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-1115 | pimcore/pimcore | Pimcore vulnerable to Cross Site Scripting in Documents Link Editable | medium | 5.4 | 1% |
| CVE-2023-4036 | simple-blog-card (WordPress plugin) | The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authen | medium | 4.3 | 1% |
| CVE-2015-10104 | icons-for-features (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue | low | 3.5 | 1% |
| CVE-2025-2232 | realteo (WordPress plugin) | The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all | critical | 9.8 | 1% |
| CVE-2021-24922 | pixel-cat (WordPress plugin) | The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some o | critical | 9.0 | 1% |
| CVE-2023-5664 | garden-gnome-package (WordPress plugin) | The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ggpkg' shortcode in all version | medium | 6.4 | 1% |
| CVE-2024-3728 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 1% |
| CVE-2022-29476 | 8-degree-notification-bar (WordPress plugin) | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPres | medium | 6.1 | 1% |
| CVE-2024-9614 | constant-contact-forms-by-mailmunch (WordPress plugin) | The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg | medium | 6.1 | 1% |
| CVE-2022-41638 | pop-up (WordPress plugin) | Auth. Stored Cross-Site Scripting (XSS) in Pop-Up Chop Chop plugin <= 2.1.7 on WordPress. | medium | 5.4 | 1% |
| CVE-2023-0709 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo | medium | 5.4 | 1% |
| CVE-2023-2753 | thorsten/phpmyfaq | phpMyFAQ vulnerable to stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2019-12186 | sylius/grid, sylius/grid-bundle, sylius/sylius | XSS injection in the Grid component of Sylius | medium | 4.8 | 1% |
| CVE-2019-8115 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2019-8148 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2023-2223 | login-rebuilder (WordPress plugin) | The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2023-2261 | wp-security-audit-log (WordPress plugin) | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call fun | medium | 4.3 | 1% |
| CVE-2015-10093 | mark-user-as-spammer (WordPress plugin) | A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vul | low | 2.6 | 1% |
| CVE-2026-77567 | filament/filament | Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled | high | 8.1 | 1% |
| CVE-2023-38519 | mainwp-dashboard (WordPress plugin), mainwp/mainwp | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Ma | high | 7.6 | 1% |
| CVE-2026-54175 | backpack/crud | Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment | high | 7.6 | 1% |
| CVE-2021-20842 | ec-cube/ec-cube | EC-CUBE Cross-site request forgery (CSRF) vulnerability | medium | 6.5 | 1% |
| CVE-2021-3900 | grumpydictator/firefly-iii | Cross-Site Request Forgery in firefly-iii | medium | 6.5 | 1% |
| CVE-2024-34460 | tribalsystems/zenario | Zenario's Tree Explorer tool from Organizer affected by Cross-site Scripting | medium | 6.5 | 1% |
| CVE-2023-4840 | mappress-google-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to | medium | 6.4 | 1% |
| CVE-2024-4265 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored C | medium | 6.4 | 1% |
| CVE-2023-4471 | order-tracking (WordPress plugin) | The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in ve | medium | 6.1 | 1% |
| CVE-2024-30262 | contao/core-bundle | Contao: Remember-me tokens will not be cleared after a password change | medium | 5.9 | 1% |
| CVE-2025-54265 | magento/community-edition, magento/project-community-edition | Magento allows incorrect authorization | medium | 5.9 | 1% |
| CVE-2017-11127 | bolt/bolt | Bolt CMS Stored XSS | medium | 5.4 | 1% |
| CVE-2017-11128 | bolt/bolt | Bolt stored Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2018-7302 | tikiwiki/tiki-manager | Tiki Wiki CMS XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2024-28593 | moodle/moodle | Cross-site Scripting in Moodle Chat | medium | 5.4 | 1% |
| CVE-2023-0914 | pixelfed/pixelfed | Pixelfed may allow unauthorized actor to view private posts | medium | 5.3 | 1% |
| CVE-2025-46549 | yeswiki/yeswiki | Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting | medium | 5.3 | 1% |
| CVE-2025-46550 | yeswiki/yeswiki | Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting | medium | 5.3 | 1% |
| CVE-2023-0453 | wp-private-messaging (WordPress plugin) | The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private mess | medium | 4.3 | 1% |
| CVE-2023-28334 | moodle/moodle | Moodle may allow authenticated users to enumerate other user's names via learning plans page | medium | 4.3 | 1% |
| CVE-2024-43118 | hummingbird (WordPress plugin) | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects | medium | 4.3 | 1% |
| CVE-2024-45122 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2023-5882 | export-any-wordpress-data-to-xml\/csv (WordPress plugin), wp-all-export (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce | high | 8.8 | 1% |
| CVE-2023-5886 | export-any-wordpress-data-to-xml\/csv (WordPress plugin), wp-all-export (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce | high | 8.8 | 1% |
| CVE-2026-81889 | studio-42/elfinder | elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback | high | 8.6 | 1% |
| CVE-2021-24823 | support-board (WordPress plugin) | The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could a | high | 8.1 | 1% |
| CVE-2022-4943 | miniorange-2-factor-authentication (WordPress plugin) | The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when chan | high | 7.5 | 1% |