Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1037 | all-in-one-wp-security-and-firewall (WordPress plugin) | The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' pa | medium | 6.1 | 1% |
| CVE-2022-44628 | 4ecps-webforms (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress. | medium | 5.9 | 1% |
| CVE-2022-4833 | yourchannel (WordPress plugin) | The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode at | medium | 5.4 | 1% |
| CVE-2023-0153 | vimeo-video-autoplay-automute (WordPress plugin) | The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputti | medium | 5.4 | 1% |
| CVE-2024-37296 | aimeos/ai-client-html | Digital products download without proper payment status check | medium | 5.3 | 1% |
| CVE-2024-38873 | studiomitte/friendlycaptcha | FriendlyCaptcha Plugin for TYPO3 Captcha Check Bypass | medium | 5.3 | 1% |
| CVE-2024-9578 | hide-links (WordPress plugin) | The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to do_shortcode being hooked through the comment_t | medium | 5.3 | 1% |
| CVE-2021-36858 | super-testimonial (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themepoints Testimonials plugin <= 2.6 on WordPress. | medium | 4.8 | 1% |
| CVE-2022-0446 | simple-banner (WordPress plugin) | The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users | medium | 4.8 | 1% |
| CVE-2022-36428 | rock-convert (WordPress plugin) | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress. | medium | 4.8 | 1% |
| CVE-2022-40311 | analytics-cat (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress. | medium | 4.8 | 1% |
| CVE-2022-44576 | agenteasy-properties (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in AgentEasy Properties plugin <= 1.0.4 on WordPress. | medium | 4.8 | 1% |
| CVE-2022-44586 | am-hili-affiliate-manager-for-publishers (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) in Ayoub Media AM-HiLi plugin <= 1.0 on WordPress. | medium | 4.8 | 1% |
| CVE-2023-7236 | backup-bolt (WordPress plugin) | The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it | medium | 4.7 | 1% |
| CVE-2022-45369 | plugin-for-google-reviews (WordPress plugin) | Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress. | medium | 4.3 | 1% |
| CVE-2023-0993 | wp-simple-firewall (WordPress plugin) | The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, an | medium | 4.3 | 1% |
| CVE-2023-1911 | blocksy-companion (WordPress plugin) | The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be | medium | 4.3 | 1% |
| CVE-2023-49337 | concrete5/concrete5 | Concrete CMS Stored XSS | low | 2.4 | 1% |
| CVE-2024-13553 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versi | critical | 9.8 | 1% |
| CVE-2026-41249 | coreshop/core-shop | CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration | high | 8.2 | 1% |
| CVE-2022-0229 | google-authenticator (WordPress plugin) | The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the recon | high | 8.1 | 1% |
| CVE-2023-3325 | cms-commander-client (WordPress plugin) | The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signat | high | 8.1 | 1% |
| CVE-2023-6584 | jobsearch-wp-job-board (WordPress plugin) | The WP JobSearch WordPress plugin before 2.3.4 does not prevent attackers from logging-in as any users with the only knowledge of that user' | high | 7.5 | 1% |
| CVE-2024-1536 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | high | 7.4 | 1% |
| CVE-2024-13569 | front-end-users (WordPress plugin) | The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading | high | 7.1 | 1% |
| CVE-2021-24674 | genie-wp-favicon (WordPress plugin) | The Genie WP Favicon WordPress plugin through 0.5.2 does not have CSRF in place when updating the favicon, which could allow attackers to ma | medium | 6.5 | 1% |
| CVE-2021-24766 | 404-to-301 (WordPress plugin) | The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, | medium | 6.5 | 1% |
| CVE-2021-24767 | redirect-404-error-page-to-homepage-or-custom-page-with-logs (WordPress plugin) | The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, w | medium | 6.5 | 1% |
| CVE-2021-24784 | wp-admin-logo-changer (WordPress plugin) | The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to mak | medium | 6.5 | 1% |
| CVE-2021-24795 | filter-portfolio-gallery (WordPress plugin) | The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which | medium | 6.5 | 1% |
| CVE-2021-24802 | colorful-categories (WordPress plugin) | The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin o | medium | 6.5 | 1% |
| CVE-2021-24852 | mousewheel-smooth-scroll (WordPress plugin) | The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers | medium | 6.5 | 1% |
| CVE-2021-42367 | variation-swatches-for-woocommerce (WordPress plugin) | The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/i | medium | 6.4 | 1% |
| CVE-2022-22109 | bottelet/flarepoint | Cross-site Scripting in DayByDay CRM | medium | 5.4 | 1% |
| CVE-2023-1431 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 due | medium | 5.3 | 1% |
| CVE-2024-1079 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() | medium | 5.3 | 1% |
| CVE-2024-1109 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ini | medium | 5.3 | 1% |
| CVE-2026-73858 | solspace/craft-freeform | Solspace Freeform: Limited Twig template injection via submitted field values | medium | 5.3 | 1% |
| CVE-2020-36835 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's databa | medium | 4.9 | 1% |
| CVE-2022-3539 | super-testimonials (WordPress plugin) | The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, a | medium | 4.8 | 1% |
| CVE-2022-3631 | oauth-client (WordPress plugin) | The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high | medium | 4.8 | 1% |
| CVE-2022-3753 | evaluate (WordPress plugin) | The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as | medium | 4.8 | 1% |
| CVE-2022-3828 | video-thumbnails (WordPress plugin) | The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 1% |
| CVE-2022-41692 | appointment-hour-booking (WordPress plugin) | Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. | medium | 4.3 | 1% |
| CVE-2022-43482 | appointment-booking-calendar (WordPress plugin) | Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress. | medium | 4.3 | 1% |
| CVE-2024-23825 | tablepress (WordPress plugin) | TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by | low | 3.0 | 1% |
| CVE-2025-1026 | spatie/browsershot | Browsershot Local File Inclusion | high | 8.6 | 1% |
| CVE-2024-13792 | woocommerce-food (WordPress plugin) | The WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions u | high | 7.3 | 1% |
| CVE-2024-13797 | pressmart (WordPress theme) | The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versi | high | 7.3 | 1% |
| CVE-2024-8379 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statem | high | 7.2 | 1% |