Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-125100 | job-board (WordPress plugin) | A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown c | low | 3.5 | 1% |
| CVE-2024-13720 | wp-image-uploader (WordPress plugin) | The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_imag | high | 8.8 | 1% |
| CVE-2024-8979 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | high | 8.0 | 1% |
| CVE-2026-12198 | microweber/microweber | Microweber vulnerable to Path Traversal | high | 7.3 | 1% |
| CVE-2026-107379 | enshrined/svg-sanitize | enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash | medium | 6.5 | 1% |
| CVE-2023-5110 | bsk-pdf-manager (WordPress plugin) | The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions | medium | 6.4 | 1% |
| CVE-2023-5665 | payment-forms-for-paystack (WordPress plugin) | The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions | medium | 6.4 | 1% |
| CVE-2021-39332 | business-manager (WordPress plugin) | The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization fou | medium | 5.5 | 1% |
| CVE-2022-36341 | as-create-pinterest-pinboard-pages (WordPress plugin) | Authenticated (subscriber+) plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability in Akash soni's AS – Create Pi | medium | 5.4 | 1% |
| CVE-2024-13371 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitr | medium | 5.3 | 1% |
| CVE-2024-34717 | prestashop/prestashop | Anonymous PrestaShop customer can download other customers' invoices | medium | 5.3 | 1% |
| CVE-2024-3599 | gdpr-cookie-consent (WordPress plugin) | The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabil | medium | 5.3 | 1% |
| CVE-2024-0449 | artibot (WordPress plugin) | The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all | medium | 4.4 | 1% |
| CVE-2023-3601 | simple-author-box (WordPress plugin) | The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbit | medium | 4.3 | 1% |
| CVE-2023-6226 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, | medium | 4.3 | 1% |
| CVE-2025-7393 | drupal/mail_login | This module enables users to login by email address with the minimal configurations. The module included some protectio | unknown | 0.0 | 1% |
| CVE-2026-41228 | froxlor/froxlor | Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution | critical | 9.9 | 1% |
| CVE-2023-49006 | phpsysinfo/phpsysinfo | Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability | medium | 6.5 | 1% |
| CVE-2024-12030 | wp-meta-data-filter-and-taxonomy-filter (WordPress plugin) | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' sh | medium | 6.5 | 1% |
| CVE-2025-49138 | elmsln/haxcms | HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter | medium | 6.5 | 1% |
| CVE-2021-24950 | insight-core (WordPress plugin) | The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (avai | medium | 5.4 | 1% |
| CVE-2021-25018 | ppom-for-woocommerce (WordPress plugin) | The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX act | medium | 5.4 | 1% |
| CVE-2021-25042 | visitor-statistics (WordPress plugin) | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress | medium | 5.4 | 1% |
| CVE-2024-6835 | add-search-to-menu (WordPress plugin) | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, | medium | 5.3 | 1% |
| CVE-2022-3829 | font-awesome-4-menus (WordPress plugin) | The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 1% |
| CVE-2022-37338 | blossom-recipe-maker (WordPress plugin) | Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress | medium | 4.1 | 1% |
| CVE-2022-37339 | meet-my-team (WordPress plugin) | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress. | medium | 4.1 | 1% |
| CVE-2022-40213 | gs-testimonial (WordPress plugin) | Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPres | medium | 4.1 | 1% |
| CVE-2026-25513 | facturascripts/facturascripts | FacturaScripts has SQL Injection in API ORDER BY Clause | high | 0.0 | 1% |
| CVE-2026-25514 | facturascripts/facturascripts | FacturaScripts has SQL Injection in Autocomplete Actions | high | 0.0 | 1% |
| CVE-2026-45068 | symfony/mailer, symfony/symfony | Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address | medium | 0.0 | 1% |
| CVE-2026-53653 | getgrav/grav | Grav: Unauthenticated denial of service via unbounded image derivative dimensions | high | 0.0 | 1% |
| CVE-2025-15602 | snipe/snipe-it | Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment | high | 8.8 | 1% |
| CVE-2024-10020 | social-login (WordPress plugin) | The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. | high | 8.1 | 1% |
| CVE-2024-21627 | prestashop/prestashop | PrestaShop some attribute not escaped in Validate::isCleanHTML method | high | 8.1 | 1% |
| CVE-2025-32044 | moodle/moodle | Moodle allows unauthenticated REST API user data exposure | high | 7.5 | 1% |
| CVE-2022-1576 | wp-maintenance-mode-\&-coming-soon (WordPress plugin) | The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could all | medium | 6.5 | 1% |
| CVE-2022-1843 | mailpress (WordPress plugin) | The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in ad | medium | 6.5 | 1% |
| CVE-2022-1967 | wp-championship (WordPress plugin) | The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perfo | medium | 6.5 | 1% |
| CVE-2022-2091 | cache-images (WordPress plugin) | The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any logged user upload i | medium | 6.5 | 1% |
| CVE-2024-1287 | paid-memberships-pro (WordPress plugin) | The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' | medium | 6.5 | 1% |
| CVE-2024-3749 | sp-project-\&-document-manager (WordPress plugin) | The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and down | medium | 6.5 | 1% |
| CVE-2024-10850 | razorpay-payment-button-elementor (WordPress plugin) | The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer | medium | 6.1 | 1% |
| CVE-2024-8544 | facebook-conversion-pixel (WordPress plugin) | The Pixel Cat – Conversion Pixel Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_ar | medium | 6.1 | 1% |
| CVE-2024-8735 | mailmunch (WordPress plugin) | The MailMunch – Grow your Email List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg wi | medium | 6.1 | 1% |
| CVE-2017-20059 | elefant/cms | Cross site scripting in Elefant CMS | medium | 5.4 | 1% |
| CVE-2017-20060 | elefant/cms | Cross site scripting in Elefant CMS | medium | 5.4 | 1% |
| CVE-2022-37429 | silverstripe/framework | Stored XSS using HTMLEditor | medium | 5.4 | 1% |
| CVE-2023-1463 | nilsteampassnet/teampass | Improper Authorization in nilsteampassnet/teampass | medium | 5.4 | 1% |
| CVE-2023-2339 | pimcore/pimcore | Cross-site Scripting (XSS) in DataObject Any Getter grid operator | medium | 5.4 | 1% |