Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-13869 | verbb/comments | Comments plugin stored Cross-site Scripting via a guest name | medium | 5.4 | 1% |
| CVE-2020-13870 | verbb/comments | Comments plugin stored Cross-site Scripting (XSS) via an asset volume name | medium | 5.4 | 1% |
| CVE-2022-28803 | silverstripe/framework | Stored XSS in link tags added via XHR in SilverStripe Framework | medium | 5.4 | 1% |
| CVE-2022-4473 | widget-shortcode (WordPress plugin) | The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 1% |
| CVE-2022-4562 | meks-flexible-shortcodes (WordPress plugin) | The Meks Flexible Shortcodes WordPress plugin before 1.3.5 does not validate and escape some of its shortcode attributes before outputting t | medium | 5.4 | 1% |
| CVE-2022-4678 | templatesnext-toolkit (WordPress plugin) | The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 1% |
| CVE-2023-0252 | contextual-related-posts (WordPress plugin) | The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them bac | medium | 5.4 | 1% |
| CVE-2023-0275 | easy-accept-payments-for-paypal (WordPress plugin) | The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outp | medium | 5.4 | 1% |
| CVE-2023-0360 | location-weather (WordPress plugin) | The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a p | medium | 5.4 | 1% |
| CVE-2024-10531 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 5.3 | 1% |
| CVE-2022-29418 | night-mode (WordPress plugin) | Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin <= 1.0.0 on WordPress via vulnerable | medium | 4.8 | 1% |
| CVE-2023-0583 | vk-blocks (WordPress plugin) | The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up t | medium | 4.3 | 1% |
| CVE-2023-31250 | drupal/core | The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gain | critical | 0.0 | 1% |
| CVE-2025-47275 | auth0/auth0-php | Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK | critical | 9.1 | 1% |
| CVE-2023-53929 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ contains a CSV injection vulnerability | high | 8.8 | 1% |
| CVE-2025-0308 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | high | 7.5 | 1% |
| CVE-2024-0445 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's element attributes in a | medium | 6.4 | 1% |
| CVE-2022-4453 | 3d-flipbook (WordPress plugin) | The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2022-4464 | portfolio-post (WordPress plugin) | Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them b | medium | 5.4 | 1% |
| CVE-2022-4468 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2022-4469 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 1% |
| CVE-2022-4475 | collapse-o-matic (WordPress plugin) | The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2022-4480 | click-to-chat (WordPress plugin) | The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 1% |
| CVE-2022-4483 | insert-pages (WordPress plugin) | The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2022-4486 | meteor-slides (WordPress plugin) | The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2022-4487 | easy-accordion (WordPress plugin) | The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 1% |
| CVE-2022-4497 | jetpack-crm (WordPress plugin) | The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the | medium | 5.4 | 1% |
| CVE-2022-4507 | wordpress-real-cookie-banner (WordPress plugin) | The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them | medium | 5.4 | 1% |
| CVE-2022-4508 | convertkit---email-marketing\,-email-newsletter-and-landing-pages (WordPress plugin) | The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in t | medium | 5.4 | 1% |
| CVE-2022-4544 | mashshare (WordPress plugin) | The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the | medium | 5.4 | 1% |
| CVE-2022-4571 | seriously-simple-podcasting (WordPress plugin) | The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputti | medium | 5.4 | 1% |
| CVE-2022-4625 | login-logout-menu (WordPress plugin) | The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 1% |
| CVE-2022-4650 | hashbar (WordPress plugin) | The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role | medium | 5.4 | 1% |
| CVE-2022-4672 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before output | medium | 5.4 | 1% |
| CVE-2023-3371 | embedpress (WordPress plugin) | The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_for | medium | 5.3 | 1% |
| CVE-2024-28108 | phpmyfaq/phpmyfaq | phpMyFAQ Stored HTML Injection at contentLink | medium | 5.1 | 1% |
| CVE-2023-2634 | get-your-number (WordPress plugin) | The Get your number WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 1% |
| CVE-2023-4242 | full-customer (WordPress plugin) | The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including | medium | 4.3 | 1% |
| CVE-2023-4245 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetI | medium | 4.3 | 1% |
| CVE-2024-58303 | fof/pretty-mail | FoF Pretty Mail has a server-side template injection vulnerability | high | 0.0 | 1% |
| CVE-2026-55891 | privatebin/privatebin | PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI | low | 0.0 | 1% |
| CVE-2025-6746 | woodmart (WordPress plugin) | The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribu | high | 8.8 | 1% |
| CVE-2022-0834 | amelia (WordPress plugin) | The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter fo | high | 7.2 | 1% |
| CVE-2024-47524 | librenms/librenms | LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name | high | 7.2 | 1% |
| CVE-2021-24989 | accept-donations-with-paypal (WordPress plugin) | The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be del | medium | 6.5 | 1% |
| CVE-2023-2202 | francoisjacquet/rosariosis | RosarioSIS improper access control vulnerability | medium | 6.5 | 1% |
| CVE-2023-3574 | pimcore/customer-management-framework-bundle | Pimcore Customer Management Framework vulnerable to Improper Authorization in Rules Controller | medium | 6.5 | 1% |
| CVE-2022-40487 | processwire/processwire | ProcessWire vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2022-2300 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2023-0404 | events-made-easy (WordPress plugin) | The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions relat | medium | 5.4 | 1% |