Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3922 | broken-link-checker (WordPress plugin) | The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2023-31045 | backdrop/backdrop | Cross-site Scripting in Backdrop CMS | medium | 4.8 | 1% |
| CVE-2024-13919 | laravel/framework | Laravel framework susceptible to reflected cross-site scripting | medium | 4.7 | 1% |
| CVE-2025-24435 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2014-125092 | maxbuttons (WordPress plugin) | A vulnerability was found in MaxButtons Plugin up to 1.26.0 on WordPress and classified as problematic. This issue affects the function maxb | low | 3.5 | 1% |
| CVE-2026-49211 | symfony/ux-autocomplete | symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil | medium | 0.0 | 1% |
| CVE-2025-4315 | cubewp-framework (WordPress plugin) | The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl | high | 8.8 | 1% |
| CVE-2022-1779 | auto-delete-posts (WordPress plugin) | The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attacke | high | 8.1 | 1% |
| CVE-2022-1791 | one-click-plugin-updater (WordPress plugin) | The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow | high | 8.1 | 1% |
| CVE-2023-50849 | e2pdf (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool f | high | 7.6 | 1% |
| CVE-2023-51547 | fluent-support (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – Wor | high | 7.6 | 1% |
| CVE-2021-48007 | pocketmine/pocketmine-mp | NaN/INF in serverbound movement packets can crash clients and servers | high | 7.5 | 1% |
| CVE-2022-51010 | pocketmine/pocketmine-mp | Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP | high | 7.5 | 1% |
| CVE-2022-51012 | pocketmine/pocketmine-mp | Insufficient type validation in pocketmine/pocketmine-mp | high | 7.5 | 1% |
| CVE-2022-51013 | pocketmine/pocketmine-mp | Improperly checked metadata on tools/armour itemstacks received from the client | high | 7.5 | 1% |
| CVE-2022-51014 | pocketmine/pocketmine-mp | Unhandled exception when decoding form response JSON | high | 7.5 | 1% |
| CVE-2023-54392 | pocketmine/pocketmine-mp | PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket | high | 7.5 | 1% |
| CVE-2023-54396 | pocketmine/pocketmine-mp | PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash | high | 7.5 | 1% |
| CVE-2024-58380 | pocketmine/pocketmine-mp | PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid | high | 7.5 | 1% |
| CVE-2023-7063 | wpforms (WordPress plugin) | The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and | high | 7.2 | 1% |
| CVE-2024-8031 | secure-downloads (WordPress plugin) | The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it pos | medium | 6.5 | 1% |
| CVE-2025-1768 | squirrly-seo (WordPress plugin) | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, a | medium | 6.5 | 1% |
| CVE-2022-33978 | fontmeister (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability FontMeister plugin <= 1.08 at WordPress. | medium | 6.1 | 1% |
| CVE-2022-2413 | slide-anything (WordPress plugin) | The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pag | medium | 5.4 | 1% |
| CVE-2022-29495 | popup-builder (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin s | medium | 5.4 | 1% |
| CVE-2023-0094 | upqode-google-maps (WordPress plugin) | The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 1% |
| CVE-2022-41839 | loginpress (WordPress plugin) | Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tr | medium | 5.3 | 1% |
| CVE-2023-6963 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it po | medium | 5.3 | 1% |
| CVE-2024-1462 | maintenance-page (WordPress plugin) | The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the RE | medium | 5.3 | 1% |
| CVE-2024-3610 | wp-child-theme-generator (WordPress plugin) | The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th | medium | 5.3 | 1% |
| CVE-2021-36401 | moodle/moodle | Moodle vulnerable to Stored Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2022-24745 | shopware/platform, shopware/storefront | Shopware guest session is shared between customers | medium | 4.8 | 1% |
| CVE-2022-23180 | contact-form-\&-lead-form-elementor-builder (WordPress plugin) | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow | medium | 4.3 | 1% |
| CVE-2022-4948 | flyingpress (WordPress plugin) | The FlyingPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions | medium | 4.3 | 1% |
| CVE-2024-1127 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca | medium | 4.3 | 1% |
| CVE-2024-45792 | mantisbt/mantisbt | MantisBT vulnerable to information disclosure with user profiles | medium | 4.3 | 1% |
| CVE-2022-35921 | fof/byobu | Byobu user preference to prevent private discussions being started are not respected | low | 3.5 | 1% |
| CVE-2020-37277 | pocketmine/pocketmine-mp | Exploitable inventory component chaining in PocketMine-MP | high | 0.0 | 1% |
| CVE-2025-54417 | craftcms/cms | Craft CMS has a theoretical bypass for CVE-2025-23209 | medium | 0.0 | 1% |
| CVE-2014-8335 | wp-dbmanager (WordPress plugin) | (1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credenti | high | 7.8 | 1% |
| CVE-2024-10247 | gallery-videos (WordPress plugin) | The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby par | high | 7.2 | 1% |
| CVE-2018-11632 | add-social-share-buttons (WordPress plugin) | An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user | medium | 6.5 | 1% |
| CVE-2018-11633 | woo-checkout-for-digital-goods (WordPress plugin) | An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visit | medium | 6.5 | 1% |
| CVE-2022-2353 | microweber/microweber | Microweber before v1.2.20 vulnerable to cross-site scripting | medium | 6.3 | 1% |
| CVE-2022-2311 | find-and-replace-all (WordPress plugin) | The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting th | medium | 6.1 | 1% |
| CVE-2024-38356 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option | medium | 6.1 | 1% |
| CVE-2024-38357 | tinymce/tinymce | TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements | medium | 6.1 | 1% |
| CVE-2025-64714 | privatebin/privatebin | PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal | medium | 5.8 | 1% |
| CVE-2023-1325 | easy-forms-for-mailchimp (WordPress plugin) | The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting t | medium | 5.4 | 1% |
| CVE-2023-1917 | powerpress (WordPress plugin) | The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and includ | medium | 5.4 | 1% |