Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-1023 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the saveSitem | medium | 5.4 | 1% |
| CVE-2024-1083 | simple-restrict (WordPress plugin) | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the | medium | 5.3 | 1% |
| CVE-2023-32062 | oro/calendar-bundle | OroCalendarBundle has incorrect system calendar events visibility | medium | 5.0 | 1% |
| CVE-2023-32063 | oro/crm-call-bundle | OroCRMCallBundle has incorrect call view page visibility | medium | 5.0 | 1% |
| CVE-2025-3295 | wp-editor (WordPress plugin) | The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possibl | medium | 4.9 | 1% |
| CVE-2022-3855 | 404-to-start (WordPress plugin) | The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 1% |
| CVE-2023-1024 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the regenerateSit | medium | 4.3 | 1% |
| CVE-2021-3938 | snipe/snipe-it | snipe-it is vulnerable to Cross-site Scripting | low | 3.9 | 1% |
| CVE-2026-46644 | symfony/polyfill, symfony/polyfill-intl-idn | symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form | low | 0.0 | 1% |
| CVE-2024-11284 | jobcareer (WordPress plugin) | The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. Th | critical | 9.8 | 1% |
| CVE-2023-1878 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via adminlog | high | 8.3 | 1% |
| CVE-2021-24636 | print-my-blog (WordPress plugin) | The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrator | high | 8.1 | 1% |
| CVE-2021-24641 | images-to-webp (WordPress plugin) | The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could r | high | 8.1 | 1% |
| CVE-2022-1572 | html2wp (WordPress plugin) | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated use | high | 8.1 | 1% |
| CVE-2023-3531 | nilsteampassnet/teampass | TeamPass Cross-site Scripting vulnerability | high | 8.1 | 1% |
| CVE-2024-0609 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Store | high | 7.2 | 1% |
| CVE-2021-25095 | country-blocker (WordPress plugin) | The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocke | high | 7.1 | 1% |
| CVE-2023-0314 | thorsten/phpmyfaq | phpMyFAQ Reflected Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2024-29374 | moodle/moodle | Cross site scripting in moodle | medium | 6.1 | 1% |
| CVE-2018-5215 | forkcms/forkcms | Fork CMS XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2023-3191 | nilsteampassnet/teampass | Teampass Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-1758 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter | high | 8.9 | 1% |
| CVE-2021-24914 | tawk.to-live-chat (WordPress plugin) | The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget | high | 8.0 | 1% |
| CVE-2024-39403 | magento/community-edition, magento/project-community-edition | Magento Stored Cross-Site Scripting (XSS) vulnerability | high | 7.6 | 1% |
| CVE-2025-6993 | ultimate-wp-mail (WordPress plugin) | The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the get_email_log_detai | high | 7.5 | 1% |
| CVE-2024-1812 | everest-forms (WordPress plugin) | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'fon | high | 7.2 | 1% |
| CVE-2023-5470 | etsy-shop (WordPress plugin) | The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, | medium | 6.4 | 1% |
| CVE-2024-10172 | void-visual-whmcs-element (WordPress plugin) | The WPBakery Visual Composer WHMCS Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's void_wbwhmcse | medium | 6.4 | 1% |
| CVE-2010-10004 | simplesamlphp/simplesamlphp-module-infocard | Information Cards Module vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2024-1758 | woocommerce-superfaktura (WordPress plugin) | The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 | medium | 5.4 | 1% |
| CVE-2023-27447 | wp-sms (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, | medium | 5.3 | 1% |
| CVE-2022-0912 | microweber/microweber | Unrestricted Upload of File with Dangerous Type in microweber | medium | 4.8 | 1% |
| CVE-2022-23179 | contact-form-\&-lead-form-elementor-builder (WordPress plugin) | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them | medium | 4.8 | 1% |
| CVE-2023-5842 | dolibarr/dolibarr | Cross-site Scripting (XSS) in dolibarr/dolibarr | medium | 4.8 | 1% |
| CVE-2023-0553 | quick-restaurant-menu (WordPress plugin) | The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, a | medium | 4.4 | 1% |
| CVE-2023-2452 | advanced-woo-search (WordPress plugin) | The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and includi | medium | 4.4 | 1% |
| CVE-2024-0618 | fluentform (WordPress plugin) | The Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cro | medium | 4.4 | 1% |
| CVE-2024-13215 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13 | medium | 4.3 | 1% |
| CVE-2026-54614 | cakephp/debug_kit | cakephp/debug_kit: MailPreview contains unsafe reflection | medium | 4.3 | 1% |
| CVE-2025-54119 | adodb/adodb-php | The ADOdb sqlite3 driver allows SQL injection | critical | 10.0 | 1% |
| CVE-2025-67164 | pagekit/pagekit | Pagekit CMS is vulnerable to OS Command Injection via Storage component | critical | 9.9 | 1% |
| CVE-2024-6666 | erp (WordPress plugin) | The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ and 'status' parameter in all versions up to, and includi | high | 8.8 | 1% |
| CVE-2025-43585 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization leading to security feature bypass | high | 8.2 | 1% |
| CVE-2024-3588 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block in all vers | medium | 6.4 | 1% |
| CVE-2021-4303 | xataface/xataface | Xataface vulnerable to Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2023-5541 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2023-5547 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2024-10519 | wish-list-for-woocommerce (WordPress plugin) | The Wishlist for WooCommerce: Multi Wishlists Per Customer PRO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the | medium | 6.1 | 1% |
| CVE-2022-2597 | visual-portfolio\,-photo-gallery-\&-post-grid (WordPress plugin) | The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST | medium | 5.4 | 1% |
| CVE-2022-29426 | 2j-slideshow (WordPress plugin) | Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image S | medium | 5.4 | 1% |