Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-125096 | fancy-gallery (WordPress plugin) | A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability i | low | 3.5 | 1% |
| CVE-2015-10110 | room-spy (WordPress plugin) | A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability af | low | 3.5 | 1% |
| CVE-2015-10120 | wds-multisite-aggregate (WordPress plugin) | A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the | low | 3.5 | 1% |
| CVE-2026-32264 | craftcms/cms | Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController | high | 0.0 | 1% |
| CVE-2016-15040 | kento-post-view-counter (WordPress plugin) | The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kento_pvc_geo' parameter in versions up to, and inc | critical | 9.8 | 1% |
| CVE-2022-0705 | pimcore/pimcore | Cross-site Scripting in Pimcore | medium | 5.4 | 1% |
| CVE-2022-37330 | wha-crossword (WordPress plugin) | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPress. | medium | 5.4 | 1% |
| CVE-2014-125105 | broken-link-checker (WordPress plugin) | A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vul | low | 2.4 | 1% |
| CVE-2015-10094 | fastly (WordPress plugin) | A vulnerability was found in Fastly Plugin up to 0.97 on WordPress. It has been rated as problematic. Affected by this issue is the function | low | 2.4 | 1% |
| CVE-2024-33999 | moodle/moodle | Moodle Improper Input Validation | high | 0.0 | 1% |
| CVE-2024-10114 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.7.7. This | high | 8.1 | 1% |
| CVE-2024-10855 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denia | high | 8.1 | 1% |
| CVE-2024-0608 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to union | medium | 6.5 | 1% |
| CVE-2024-24822 | pimcore/admin-ui-classic-bundle | Pimcore Admin Classic Bundle permissions are not getting checked when working with tags | medium | 6.5 | 1% |
| CVE-2017-20164 | symbiote/silverstripe-seed | Symbiote Seed Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2023-2605 | wp-brutal-ai (WordPress plugin) | The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 1% |
| CVE-2023-28429 | pimcore/pimcore | Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field | medium | 6.1 | 1% |
| CVE-2023-6632 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and includ | medium | 6.1 | 1% |
| CVE-2018-20745 | yiisoft/yii2 | Yii Incorrectly Implements CORS | medium | 5.9 | 1% |
| CVE-2023-2529 | enable-svg-uploads (WordPress plugin) | The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Au | medium | 5.4 | 1% |
| CVE-2023-28471 | concrete5/concrete5 | Stored cross site scripting via container name | medium | 5.4 | 1% |
| CVE-2023-28476 | concrete5/concrete5 | Stored cross site scripting on tags | medium | 5.4 | 1% |
| CVE-2023-2964 | simple-iframe (WordPress plugin) | The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow u | medium | 5.4 | 1% |
| CVE-2022-2983 | salat-times (WordPress plugin) | The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users such as admin to per | medium | 4.8 | 1% |
| CVE-2022-3610 | jeeng-push-notifications (WordPress plugin) | The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 1% |
| CVE-2022-3833 | fancier-author-box (WordPress plugin) | The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 1% |
| CVE-2022-3834 | google-forms (WordPress plugin) | The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2023-24230 | getformwork/formwork | Formwork Cross-site Scripting (XSS) from Page title field | medium | 4.8 | 1% |
| CVE-2020-5226 | simplesamlphp/simplesamlphp | Cross-site scripting in SimpleSAMLphp | medium | 4.4 | 1% |
| CVE-2021-3858 | snipe/snipe-it | Cross-Site Request Forgery in snipe-it | medium | 4.3 | 1% |
| CVE-2025-55166 | enshrined/svg-sanitize | svg-sanitizer Bypasses Attribute Sanitization | medium | 0.0 | 1% |
| CVE-2026-54588 | poweradmin/poweradmin | Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. | critical | 9.6 | 1% |
| CVE-2024-7607 | front-end-only-users (WordPress plugin) | The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and incl | high | 8.8 | 1% |
| CVE-2024-12812 | wp-erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected | high | 7.5 | 1% |
| CVE-2023-6954 | download-manager (WordPress plugin) | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | 1% |
| CVE-2024-3341 | auxin-elements (WordPress plugin) | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_gm | medium | 6.4 | 1% |
| CVE-2024-3724 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Stack Group, Photo S | medium | 6.4 | 1% |
| CVE-2022-3211 | pimcore/pimcore | Pimcore vulnerable to stored stored Cross-site Scripting via`properties` when creating new users | medium | 5.4 | 1% |
| CVE-2021-22954 | concrete5/concrete5 | Cross Site Request Forgery in concrete5/concrete5 | high | 0.0 | 1% |
| CVE-2026-53639 | sylius/sylius | Sylius: IDOR on Shop Payment Request API endpoints | medium | 0.0 | 1% |
| CVE-2026-59989 | phalcon/cphalcon | Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE) | critical | 0.0 | 1% |
| CVE-2025-6206 | aiomatic (WordPress plugin) | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbit | high | 7.5 | 1% |
| CVE-2022-0830 | formbuilder (WordPress plugin) | The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not san | medium | 6.5 | 1% |
| CVE-2022-1407 | hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, a | medium | 6.5 | 1% |
| CVE-2022-1422 | discy (WordPress plugin) | The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an | medium | 6.5 | 1% |
| CVE-2022-1424 | ask-me (WordPress plugin) | The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in us | medium | 6.5 | 1% |
| CVE-2022-1605 | email-users (WordPress plugin) | The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 6.5 | 1% |
| CVE-2022-1608 | social-locker (WordPress plugin) | The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow at | medium | 6.5 | 1% |
| CVE-2022-1612 | webriti-smtp-mail (WordPress plugin) | The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 6.5 | 1% |
| CVE-2022-1624 | latest-tweets-widget (WordPress plugin) | The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow atta | medium | 6.5 | 1% |