Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1694 | useful-banner-manager (WordPress plugin) | The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attack | medium | 6.5 | 1% |
| CVE-2022-1790 | new-user-email-set-up (WordPress plugin) | The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 6.5 | 1% |
| CVE-2023-6637 | host-analyticsjs-local (WordPress plugin) | The CAOS | Host Google Analytics Locally plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 6.5 | 1% |
| CVE-2023-6524 | mappress-google-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title parameter in all version | medium | 6.4 | 1% |
| CVE-2023-1282 | drag-and-drop-multiple-file-upload---contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload P | medium | 6.1 | 1% |
| CVE-2024-10529 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 5.3 | 1% |
| CVE-2024-0956 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time- | medium | 4.9 | 1% |
| CVE-2010-3670 | typo3/cms-frontend | TYPO3 is vulnerable to insecure randomness during hash generation in forgot password function | medium | 4.8 | 1% |
| CVE-2021-24344 | easy-preloader (WordPress plugin) | The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site | medium | 4.8 | 1% |
| CVE-2023-2026 | image-protector (WordPress plugin) | The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to | medium | 4.8 | 1% |
| CVE-2023-2635 | call-now-accessibility-button (WordPress plugin) | The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 1% |
| CVE-2023-2709 | an-gradebook (WordPress plugin) | The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 1% |
| CVE-2023-2967 | tinymce-custom-styles (WordPress plugin) | The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2024-28106 | phpmyfaq/phpmyfaq | phpMyFAQ Stored Cross-site Scripting at FAQ News Content | medium | 4.3 | 1% |
| CVE-2026-46627 | twig/twig | Sandbox does not protect against resource exhaustion | unknown | 0.0 | 1% |
| CVE-2026-46629 | twig/intl-extra | twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments | low | 0.0 | 1% |
| CVE-2025-9083 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform P | critical | 9.8 | 1% |
| CVE-2026-33479 | wwbn/avideo | AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin | high | 8.8 | 1% |
| CVE-2021-24936 | wp-extra-file-types (WordPress plugin) | The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of the | high | 8.0 | 1% |
| CVE-2023-3552 | nilsteampassnet/teampass | TeamPass vulnerable to Improper Encoding or Escaping of Output | high | 7.6 | 1% |
| CVE-2023-50845 | geodirectory (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory | high | 7.6 | 1% |
| CVE-2023-50856 | funnel-builder (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress | high | 7.6 | 1% |
| CVE-2023-52134 | geo-my-wordpress (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO my WordPress.This is | high | 7.6 | 1% |
| CVE-2025-3742 | responsive-lightbox (WordPress plugin) | The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them b | medium | 6.8 | 1% |
| CVE-2023-36238 | bagisto/bagisto | Bagisto vulnerable to Insecure Direct Object Reference (IDOR) | medium | 6.5 | 1% |
| CVE-2023-6638 | gg-woo-feed (WordPress plugin) | The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 6.5 | 1% |
| CVE-2024-4260 | coblocks (WordPress plugin) | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortc | medium | 6.5 | 1% |
| CVE-2022-43120 | intelliants/subrion | Subrion CMS is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2021-32245 | pagekit/pagekit | Cross-site scripting in PageKit | medium | 5.4 | 1% |
| CVE-2022-0966 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2023-2752 | thorsten/phpmyfaq | phpMyFAQ vulnerable to stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2023-4252 | eventprime (WordPress plugin) | The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase booki | medium | 5.3 | 1% |
| CVE-2021-3819 | grumpydictator/firefly-iii | Cross-Site Request Forgery in firefly-iii | medium | 4.3 | 1% |
| CVE-2021-4422 | post-smtp (WordPress plugin) | The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due | medium | 4.3 | 1% |
| CVE-2026-29093 | wwbn/avideo | AVideo: Unauthenticated PHP session store exposed to host network via published memcached port | high | 8.1 | 1% |
| CVE-2026-64665 | statamic/cms | Statamic: Account takeover via OAuth email matching without email-verification check | high | 8.1 | 1% |
| CVE-2023-47236 | ipages-flipbook (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum iPages Flipbook For WordPress. | high | 7.6 | 1% |
| CVE-2024-13671 | music-sheet-viewer (WordPress plugin) | The Music Sheet Viewer plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.1 via the read_scor | high | 7.5 | 1% |
| CVE-2024-9548 | wp-slimstat (WordPress plugin) | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, a | high | 7.2 | 1% |
| CVE-2026-55843 | snipe/snipe-it | Snipe-IT has an Improper Privilege Management issue | medium | 6.5 | 1% |
| CVE-2023-5469 | drop-shadow-boxes (WordPress plugin) | The Drop Shadow Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dropshadowbox' shortcode in versions up to, and | medium | 6.4 | 1% |
| CVE-2023-5658 | wp-mapit (WordPress plugin) | The WP MapIt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_mapit' shortcode in all versions up to, | medium | 6.4 | 1% |
| CVE-2023-5662 | wp-sponsors (WordPress plugin) | The Sponsors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sponsors' shortcode in all versions up to, | medium | 6.4 | 1% |
| CVE-2023-5743 | telephone-number-linker (WordPress plugin) | The Telephone Number Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'telnumlink' shortcode in all | medium | 6.4 | 1% |
| CVE-2024-1425 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for Wor | medium | 6.4 | 1% |
| CVE-2023-0644 | push-notifications (WordPress plugin) | The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before out | medium | 6.1 | 1% |
| CVE-2020-11064 | typo3/cms, typo3/cms-core | Cross-Site Scripting in TYPO3 CMS Form Engine | medium | 5.4 | 1% |
| CVE-2020-11065 | typo3/cms, typo3/cms-core | Cross-Site Scripting in TYPO3 CMS Link Handling | medium | 5.4 | 1% |
| CVE-2020-11070 | t3g/svg-sanitizer | Cross-Site Scripting in SVG Sanitizer | medium | 5.4 | 1% |
| CVE-2020-13459 | verbb/image-resizer | Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action | medium | 5.4 | 1% |