Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-32280 | xo-liteslider (WordPress plugin) | Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Xakuro's XO Slider plugin <= 3.3.2 at Wor | medium | 5.4 | 1% |
| CVE-2024-9546 | wpide (WordPress plugin) | The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4. | medium | 5.3 | 1% |
| CVE-2023-1090 | smtp-mailing-queue (WordPress plugin) | The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 1% |
| CVE-2024-45121 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2024-45125 | magento/community-edition | Magento Open Source Incorrect Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2024-45129 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2024-45130 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2022-29443 | nd-booking (WordPress plugin) | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin | medium | 4.1 | 1% |
| CVE-2026-21857 | redaxo/source | Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read | high | 0.0 | 1% |
| CVE-2019-20891 | woocommerce/woocommerce | WooCommerce Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2022-1610 | seamless-donations (WordPress plugin) | The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 1% |
| CVE-2022-1630 | wp-email (WordPress plugin) | The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a l | medium | 6.5 | 1% |
| CVE-2022-1826 | cross-linker (WordPress plugin) | The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers t | medium | 6.5 | 1% |
| CVE-2022-1827 | pdf24-articles-to-pdf (WordPress plugin) | The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow atta | medium | 6.5 | 1% |
| CVE-2022-1828 | pdf24-articles-to-pdf (WordPress plugin) | The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow att | medium | 6.5 | 1% |
| CVE-2022-1829 | inline-google-maps (WordPress plugin) | The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 6.5 | 1% |
| CVE-2022-1832 | capa-protect (WordPress plugin) | The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 6.5 | 1% |
| CVE-2024-1307 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as l | medium | 6.5 | 1% |
| CVE-2021-31778 | amazing/media2click | Cross-site scripting in media2click | medium | 6.4 | 1% |
| CVE-2024-10851 | razorpay-payment-button (WordPress plugin) | The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & re | medium | 6.1 | 1% |
| CVE-2021-24660 | postx---gutenberg-blocks-for-post-grid (WordPress plugin) | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as l | medium | 5.4 | 1% |
| CVE-2022-4652 | video-background (WordPress plugin) | The Video Background WordPress plugin before 2.7.5 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2022-4699 | mediaelement.js (WordPress plugin) | The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2022-4765 | portfolio-for-elementor (WordPress plugin) | The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 1% |
| CVE-2022-4776 | cc-child-pages (WordPress plugin) | The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2022-4834 | cpt-bootstrap-carousel (WordPress plugin) | The CPT Bootstrap Carousel WordPress plugin through 1.12 does not validate and escape some of its shortcode attributes before outputting the | medium | 5.4 | 1% |
| CVE-2022-4837 | cpo-companion (WordPress plugin) | The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2023-0071 | wp-tabs (WordPress plugin) | The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a pa | medium | 5.4 | 1% |
| CVE-2023-0074 | wp-social-widget (WordPress plugin) | The WP Social Widget WordPress plugin before 2.2.4 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2023-0079 | customer-reviews-for-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before out | medium | 5.4 | 1% |
| CVE-2023-0167 | getresponse (WordPress plugin) | The GetResponse for WordPress plugin through 5.5.31 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 1% |
| CVE-2023-0231 | shoplentor (WordPress plugin) | The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/po | medium | 5.4 | 1% |
| CVE-2023-0366 | loan-comparison (WordPress plugin) | The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2023-0419 | shortcode-for-font-awesome (WordPress plugin) | The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting | medium | 5.4 | 1% |
| CVE-2023-1375 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized cache deletion in versions up to, and including, 1.1.2 due to a miss | medium | 4.3 | 1% |
| CVE-2023-4938 | woo-bulk-editor (WordPress plugin) | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability | medium | 4.3 | 1% |
| CVE-2026-45368 | getkirby/cms | Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend | high | 0.0 | 1% |
| CVE-2023-37650 | cockpit-hq/cockpit | Cockpit CMS Cross-Site Request Forgery vulnerability | high | 8.8 | 1% |
| CVE-2024-9947 | profilepress (WordPress plugin) | The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due t | high | 8.1 | 1% |
| CVE-2023-2429 | thorsten/phpmyfaq | phpMyFAQ Improper Access Control vulnerability | medium | 6.6 | 1% |
| CVE-2022-3937 | easy-video-player (WordPress plugin) | The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as | medium | 5.4 | 1% |
| CVE-2023-0787 | thorsten/phpmyfaq | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | 1% |
| CVE-2023-4977 | librenms/librenms | LibreNMS Code Injection vulnerability | medium | 5.4 | 1% |
| CVE-2024-1120 | finale (WordPress plugin), nextmove (WordPress plugin) | The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress | medium | 5.3 | 1% |
| CVE-2024-25980 | moodle/moodle | Improper Access Control in moodle | medium | 5.3 | 1% |
| CVE-2024-8291 | concrete5/concrete5 | Cross site scripting in Concrete CMS | medium | 4.8 | 1% |
| CVE-2024-0791 | bulk-editor (WordPress plugin) | The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or l | medium | 4.3 | 1% |
| CVE-2024-0829 | wp-comment-fields (WordPress plugin) | The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and incl | medium | 4.3 | 1% |
| CVE-2024-0835 | royal-elementor-kit (WordPress theme) | The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on th | medium | 4.3 | 1% |
| CVE-2024-1390 | paid-member-subscriptions (WordPress plugin) | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to u | medium | 4.3 | 1% |