Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-12638 | bulk-me-now\! (WordPress plugin) | The Bulk Me Now! WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | high | 7.1 | 1% |
| CVE-2024-2907 | absolutely-glamorous-custom-admin (WordPress plugin) | The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | medium | 6.8 | 1% |
| CVE-2026-47110 | ueberdosis/tiptap-php | Tiptap contains an input validation vulnerability resulting in DoS | medium | 6.5 | 1% |
| CVE-2022-23504 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration | medium | 5.7 | 1% |
| CVE-2022-4831 | custom-user-profile-fields-for-user-registration (WordPress plugin) | The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attrib | medium | 5.4 | 1% |
| CVE-2023-3575 | quiz-and-survey-master (WordPress plugin) | The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users wit | medium | 5.4 | 1% |
| CVE-2024-4266 | metform (WordPress plugin) | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Ex | medium | 5.3 | 1% |
| CVE-2023-0873 | kanban-boards-for-wordpress (WordPress plugin) | The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 1% |
| CVE-2023-1333 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on | medium | 4.3 | 1% |
| CVE-2023-1334 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability che | medium | 4.3 | 1% |
| CVE-2023-1335 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability | medium | 4.3 | 1% |
| CVE-2023-1336 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check | medium | 4.3 | 1% |
| CVE-2023-1338 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability che | medium | 4.3 | 1% |
| CVE-2023-1339 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check | medium | 4.3 | 1% |
| CVE-2024-1279 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' s | medium | 4.3 | 1% |
| CVE-2024-25120 | typo3/cms-core | TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme | medium | 4.3 | 1% |
| CVE-2024-10102 | robo-gallery (WordPress plugin) | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery setti | low | 2.7 | 1% |
| CVE-2023-2078 | buymeacoffee (WordPress plugin) | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capa | high | 7.3 | 1% |
| CVE-2024-13345 | avada-builder (WordPress plugin) | The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is | high | 7.3 | 1% |
| CVE-2019-25216 | rich-review (WordPress plugin) | The Rich Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the POST body 'update' parameter in versions up to, an | high | 7.2 | 1% |
| CVE-2023-2881 | pimcore/customer-management-framework-bundle | Pimcore customers' list user password hash is disclosed | medium | 6.7 | 1% |
| CVE-2024-1352 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification | medium | 6.5 | 1% |
| CVE-2024-4533 | kkprogressbar2 (WordPress plugin) | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allow | medium | 6.5 | 1% |
| CVE-2024-5570 | simple-photoswipe (WordPress plugin) | The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authe | medium | 6.5 | 1% |
| CVE-2023-4716 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up | medium | 6.4 | 1% |
| CVE-2023-3822 | pimcore/pimcore | Pimcore Cross-site Scripting vulnerability | medium | 6.0 | 1% |
| CVE-2021-24470 | yada-wiki (WordPress plugin) | The Yada Wiki WordPress plugin before 3.4.1 did not sanitise, validate or escape the anchor attribute of its shortcode, leading to a Stored | medium | 5.4 | 1% |
| CVE-2021-24659 | postx---gutenberg-blocks-for-post-grid (WordPress plugin) | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored C | medium | 5.4 | 1% |
| CVE-2022-0394 | remdex/livehelperchat | Cross-site Scripting in LiveHelperChat | medium | 5.4 | 1% |
| CVE-2022-0937 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2022-0940 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2023-28421 | wp-email-capture (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Winwar Media WordPress Email Marketing Plugin – WP Email Capture | medium | 5.3 | 1% |
| CVE-2024-37444 | defender (WordPress plugin) | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defender-security.This issue affects | medium | 5.3 | 1% |
| CVE-2025-71418 | pocketmine/pocketmine-mp | PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() | medium | 5.3 | 1% |
| CVE-2021-24428 | yandex-turbo (WordPress plugin) | The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in | medium | 4.8 | 1% |
| CVE-2024-1720 | user-registration (WordPress plugin) | The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored | medium | 4.7 | 1% |
| CVE-2025-24421 | magento/community-edition, magento/project-community-edition | Magento Incorrect Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2025-24436 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2026-54002 | getkirby/cms | Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` | high | 0.0 | 1% |
| CVE-2024-8420 | dhvc-form (WordPress plugin) | The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plu | critical | 9.8 | 1% |
| CVE-2023-4841 | feeds-for-youtube (WordPress plugin) | The Feeds for YouTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and | medium | 6.4 | 1% |
| CVE-2023-51700 | unofficial-mobile-bankid-integration (WordPress plugin) | Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior | medium | 6.4 | 1% |
| CVE-2023-6923 | matomo (WordPress plugin) | The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite | medium | 6.1 | 1% |
| CVE-2022-40205 | wpforo (WordPress plugin) | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or | medium | 5.4 | 1% |
| CVE-2023-6785 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, a | medium | 5.3 | 1% |
| CVE-2024-0687 | restrict-user-access (WordPress plugin) | The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versio | medium | 5.3 | 1% |
| CVE-2020-20697 | khodakhah/nodcms | NodCMS Cross Site Scripting vulnerability | medium | 4.8 | 1% |
| CVE-2022-29449 | opal-hotel-room-booking (WordPress plugin) | Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 a | medium | 4.1 | 1% |
| CVE-2013-10028 | eelv-newsletter (WordPress plugin) | A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the functi | low | 3.5 | 1% |
| CVE-2014-125095 | contact-form (WordPress plugin) | A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the | low | 3.5 | 1% |