Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13712 | pollin (WordPress plugin) | The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all versions up to, and including, 1.01.1 due | medium | 4.9 | 1% |
| CVE-2024-11223 | wpforms (WordPress plugin) | The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.7 | 1% |
| CVE-2025-8995 | drupal/alogin | This module enables users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security. | unknown | 0.0 | 1% |
| CVE-2024-9518 | userplus (WordPress plugin) | The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to insufficient restrictio | critical | 9.8 | 1% |
| CVE-2026-33661 | yansongda/pay | WeChat Pay callback signature verification bypassed when Host header is localhost | high | 8.6 | 1% |
| CVE-2025-26529 | moodle/moodle | Moodle has a stored XSS risk in admin live log | high | 8.3 | 1% |
| CVE-2026-27891 | facturascripts/facturascripts | FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism | high | 7.2 | 1% |
| CVE-2021-3993 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2021-4033 | kevinpapst/kimai2 | Cross-Site Request Forgery in kimai2 | medium | 6.5 | 1% |
| CVE-2024-27499 | bagisto/bagisto | Bagist Cross-site Scripting vulnerability | medium | 6.5 | 1% |
| CVE-2022-38462 | silverstripe/framework | Reflected XSS in querystring parameters | medium | 6.1 | 1% |
| CVE-2023-2488 | stop-spammers (WordPress plugin) | The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters | medium | 6.1 | 1% |
| CVE-2023-3524 | wpcode (WordPress plugin) | The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross- | medium | 6.1 | 1% |
| CVE-2024-1379 | website-article-monetization-by-magenet (WordPress plugin) | The Website Article Monetization By MageNet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'abp_auth_key' paramet | medium | 6.1 | 1% |
| CVE-2024-2837 | wp-chat-app (WordPress plugin) | The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | 1% |
| CVE-2023-3190 | nilsteampassnet/teampass | Teampass Cross-site Scripting vulnerability | medium | 4.6 | 1% |
| CVE-2021-36849 | mashsharer (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at Word | low | 3.4 | 1% |
| CVE-2022-38703 | maxbuttons (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress | low | 3.4 | 1% |
| CVE-2026-16641 | drupal/commerce_elavon | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 1% |
| CVE-2022-3688 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to m | high | 8.8 | 1% |
| CVE-2022-38144 | wpforo (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress. | high | 8.8 | 1% |
| CVE-2024-4757 | logo-manager-for-enamad (WordPress plugin) | The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as e | high | 8.1 | 1% |
| CVE-2023-0731 | interactive-geo-maps (WordPress plugin) | The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up t | medium | 6.4 | 1% |
| CVE-2023-5613 | super-testimonial (WordPress plugin) | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versio | medium | 6.4 | 1% |
| CVE-2024-0508 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table Elementor Widget | medium | 6.4 | 1% |
| CVE-2024-1960 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.4 | 1% |
| CVE-2023-2998 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to cross-site scripting | medium | 6.0 | 1% |
| CVE-2023-2168 | simple-tags (WordPress plugin) | The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and inc | medium | 5.5 | 1% |
| CVE-2023-37692 | october/october | Stored Cross-Site Scripting October CMS | medium | 5.4 | 1% |
| CVE-2023-4269 | user-activity-log (WordPress plugin) | The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated | medium | 4.3 | 1% |
| CVE-2026-27593 | statamic/cms | Statamic is vulnerable to account takeover via password reset link injection | critical | 9.3 | 1% |
| CVE-2024-13677 | get-bookings-wp (WordPress plugin) | The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via accoun | high | 8.8 | 1% |
| CVE-2024-13533 | small-package-quotes-usps-edition (WordPress plugin) | The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up t | high | 7.5 | 1% |
| CVE-2022-3082 | discord-integration (WordPress plugin) | The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing | medium | 6.5 | 1% |
| CVE-2022-37246 | craftcms/cms | Craft CMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-5509 | mystickymenu (WordPress plugin) | The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the act | medium | 5.4 | 1% |
| CVE-2023-5799 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and abov | medium | 5.4 | 1% |
| CVE-2024-1110 | podlove-podcasting-plugin-for-wordpress (WordPress plugin) | The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 5.3 | 1% |
| CVE-2023-5126 | delete-me (WordPress plugin) | The Delete Me plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'plugin_delete_me' shortcode in versions up to, and incl | medium | 4.9 | 1% |
| CVE-2022-36282 | search-exclude (WordPress plugin) | Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress. | medium | 4.8 | 1% |
| CVE-2024-2931 | wpfront-user-role-editor (WordPress plugin) | The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2. | medium | 4.3 | 1% |
| CVE-2025-2214 | microweber/microweber | Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler | low | 3.5 | 1% |
| CVE-2022-40215 | vc-tabs (WordPress plugin) | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress. | low | 3.4 | 1% |
| CVE-2021-41176 | pterodactyl/panel | pterodactyl/panel CSRF allowing an external page to trigger a user logout event | low | 0.0 | 1% |
| CVE-2024-12296 | superio (WordPress plugin) | The Apus Framework plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a mi | high | 8.8 | 1% |
| CVE-2024-13653 | zoxpress (WordPress theme) | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to p | high | 8.8 | 1% |
| CVE-2024-6316 | generate-pdf-using-contact-form-7 (WordPress plugin) | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions | high | 8.8 | 1% |
| CVE-2024-36082 | music-store (WordPress plugin) | SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an adm | medium | 6.5 | 1% |
| CVE-2023-4599 | email-encoder-bundle (WordPress plugin) | The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and in | medium | 6.4 | 1% |
| CVE-2023-5164 | bellows-accordion-menu (WordPress plugin) | The Bellows Accordion Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including | medium | 6.4 | 1% |