Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5639 | team-showcase (WordPress plugin) | The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all version | medium | 6.4 | 1% |
| CVE-2023-0937 | vk-all-in-one-expansion-unit (WordPress plugin) | The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it | medium | 6.1 | 1% |
| CVE-2023-1804 | product-catalog-feed (WordPress plugin) | The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it | medium | 6.1 | 1% |
| CVE-2022-4472 | simple-sitemap (WordPress plugin) | The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 1% |
| CVE-2023-0608 | microweber/microweber | Microweber contains Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2024-12006 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several func | medium | 5.3 | 1% |
| CVE-2024-1322 | directorist (WordPress plugin) | The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modifi | medium | 5.3 | 1% |
| CVE-2024-1389 | paid-member-subscriptions (WordPress plugin) | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to u | medium | 5.3 | 1% |
| CVE-2021-37502 | automad/automad | Cross site scripting in automad/automad | medium | 4.8 | 1% |
| CVE-2025-24980 | pimcore/admin-ui-classic-bundle | Pimcore Admin Classic Bundle allows user enumeration | medium | 0.0 | 1% |
| CVE-2024-6636 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | critical | 9.8 | 1% |
| CVE-2024-3594 | idonate (WordPress plugin) | The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such a | high | 8.7 | 1% |
| CVE-2022-2987 | ldap-wp-login-\/-active-directory-integration (WordPress plugin) | The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating | high | 7.5 | 1% |
| CVE-2023-2302 | lead-capturing-call-to-actions-by-vcita (WordPress plugin) | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in | medium | 6.4 | 1% |
| CVE-2023-6701 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions u | medium | 6.4 | 1% |
| CVE-2023-6808 | ameliabooking (WordPress plugin) | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 1% |
| CVE-2024-0255 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-recipe-text-share' shortcode in | medium | 6.4 | 1% |
| CVE-2022-2271 | wp-database-backup (WordPress plugin) | The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admi | medium | 4.8 | 1% |
| CVE-2022-3823 | beautiful-cookie-consent-banner (WordPress plugin) | The Beautiful Cookie Consent Banner WordPress plugin before 2.9.1 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 1% |
| CVE-2017-7491 | moodle/moodle | Moodle Cross-Site Request Forgery (CSRF) | medium | 4.3 | 1% |
| CVE-2024-24807 | sulu/sulu | Sulu HTML Injection via Autocomplete Suggestion | low | 0.0 | 1% |
| CVE-2026-33767 | wwbn/avideo | AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query | high | 0.0 | 1% |
| CVE-2024-4223 | tutor-lms (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capabil | critical | 9.8 | 1% |
| CVE-2026-33352 | wwbn/avideo | AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) | critical | 9.8 | 1% |
| CVE-2024-11711 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via t | high | 7.5 | 1% |
| CVE-2024-5599 | fileorganizer (WordPress plugin) | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions | high | 7.5 | 1% |
| CVE-2026-104827 | react/http | react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS | high | 7.5 | 1% |
| CVE-2020-36714 | brizy (WordPress plugin) | The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function | high | 7.4 | 1% |
| CVE-2023-5577 | wp-bitly (WordPress plugin) | The Bitly's plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode in all versions up to, an | medium | 6.4 | 1% |
| CVE-2024-2343 | avada (WordPress theme) | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up | medium | 6.4 | 1% |
| CVE-2023-4913 | cecil/cecil | Cecil Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2023-27580 | codeigniter4/shield | Password Shucking Vulnerability | medium | 5.9 | 1% |
| CVE-2025-2939 | ninja-tables (WordPress plugin) | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, | medium | 5.6 | 1% |
| CVE-2020-36397 | lavalite/cms | LavaLite Stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-4431 | fox---currency-switcher-professional-for-woocommerce (WordPress plugin) | The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the p | medium | 5.4 | 1% |
| CVE-2023-6582 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 1% |
| CVE-2024-0975 | wordpress-access-control (WordPress plugin) | The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0. | medium | 5.3 | 1% |
| CVE-2019-8227 | magento/core | Magento XSS Vulnerability | medium | 4.8 | 1% |
| CVE-2026-39394 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller | high | 8.1 | 1% |
| CVE-2024-13752 | wedevs-project-manager (WordPress plugin) | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerabl | medium | 6.5 | 1% |
| CVE-2024-2734 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's AI features all versions up to, and | medium | 6.4 | 1% |
| CVE-2024-2735 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, | medium | 6.4 | 1% |
| CVE-2024-2736 | bold-page-builder (WordPress plugin) | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including, | medium | 6.4 | 1% |
| CVE-2023-0479 | print-invoice-\&-delivery-notes-for-woocommerce (WordPress plugin) | The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an | medium | 6.1 | 1% |
| CVE-2024-21504 | livewire/livewire | Cross-site Scripting in livewire/livewire | medium | 6.1 | 1% |
| CVE-2024-57601 | alextselegidis/easyappointments | Remote code execution in alextselegidis/easyappointments | medium | 6.1 | 1% |
| CVE-2022-47599 | file-manager (WordPress plugin) | Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin | medium | 5.5 | 1% |
| CVE-2017-1000442 | passbolt/passbolt_api | Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar | medium | 5.4 | 1% |
| CVE-2020-20695 | gilacms/gila | Cross-site Scripting in GilaCMS | medium | 5.4 | 1% |
| CVE-2020-28124 | lavalite/cms | Cross Site Scripting (XSS) in LavaLite 5.8.0 | medium | 5.4 | 1% |