Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-4452 | google-language-translator (WordPress plugin) | The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up t | high | 7.1 | 1% |
| CVE-2022-4477 | smash-balloon-social-post-feed (WordPress plugin) | The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outpu | medium | 5.4 | 1% |
| CVE-2024-45962 | october/october | October allows an admin account to upload PDF containing malicious JavaScript | medium | 4.8 | 1% |
| CVE-2025-12019 | featured-image (WordPress plugin) | The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including | medium | 4.4 | 1% |
| CVE-2023-2084 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the get fu | medium | 4.3 | 1% |
| CVE-2024-10671 | button-block (WordPress plugin) | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versi | medium | 4.3 | 1% |
| CVE-2024-6353 | woo-wallet (WordPress plugin) | The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'search[value]' parameter in all versions up to, and | high | 8.8 | 1% |
| CVE-2026-52771 | yeswiki/yeswiki | YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`) | high | 8.3 | 1% |
| CVE-2024-13925 | klarna-checkout-for-woocommerce (WordPress plugin) | The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attac | high | 7.5 | 1% |
| CVE-2022-0231 | remdex/livehelperchat | Cross-Site Request Forgery (CSRF) in livehelperchat | medium | 6.5 | 1% |
| CVE-2022-44590 | simple-video-embedder (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2 on WordPress. | medium | 6.4 | 1% |
| CVE-2024-0448 | addons-for-elementor (WordPress plugin) | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget URL parameters in | medium | 6.4 | 1% |
| CVE-2024-1296 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block upload in all versions up | medium | 6.4 | 1% |
| CVE-2024-1894 | burst-statistics (WordPress plugin) | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'b | medium | 6.4 | 1% |
| CVE-2022-40206 | wpforo (WordPress plugin) | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or | medium | 6.3 | 1% |
| CVE-2023-28604 | sitegeist/fluid-components | Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting | medium | 6.1 | 1% |
| CVE-2023-6832 | microweber/microweber | Business Logic Errors in microweber/microweber | medium | 6.0 | 1% |
| CVE-2023-5745 | reusable-text-blocks (WordPress plugin) | The Reusable Text Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text-blocks' shortcode in versions up to, an | medium | 5.5 | 1% |
| CVE-2020-36395 | lavalite/cms | Stored XSS in LavaLite 5.8.0 | medium | 5.4 | 1% |
| CVE-2022-2933 | 0mk-shortener (WordPress plugin) | The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to mis | medium | 5.4 | 1% |
| CVE-2022-44380 | snipe/snipe-it | Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets | medium | 5.4 | 1% |
| CVE-2021-36830 | comment-guestbook (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress. | medium | 4.8 | 1% |
| CVE-2021-36839 | social-media-buttons-toolbar (WordPress plugin) | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress. | medium | 4.8 | 1% |
| CVE-2022-26375 | ab-press-optimizer-lite (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology AB Press Optimizer plugin <= 1.1.1 on WordPress. | medium | 4.8 | 1% |
| CVE-2024-3060 | enl-newsletter (WordPress plugin) | The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admi | medium | 4.5 | 1% |
| CVE-2024-0602 | yet-another-related-posts-plugin (WordPress plugin) | The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ver | medium | 4.4 | 1% |
| CVE-2023-0405 | gpt-ai-power (WordPress plugin) | The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does | medium | 4.3 | 1% |
| CVE-2026-28783 | craftcms/cms | Craft CMS has Twig Function Blocklist Bypass | medium | 0.0 | 1% |
| CVE-2026-55795 | craftcms/commerce | Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass | medium | 0.0 | 1% |
| CVE-2024-50496 | ar (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to | critical | 10.0 | 1% |
| CVE-2026-48019 | laravel/framework, illuminate/mail | Laravel Framework: CRLF injection in default email rule | high | 8.9 | 1% |
| CVE-2022-4265 | replyable (WordPress plugin) | The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the p | high | 8.8 | 1% |
| CVE-2024-4318 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and includin | high | 8.8 | 1% |
| CVE-2026-34570 | ci4-cms-erp/ci4ms | CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | high | 8.8 | 1% |
| CVE-2026-34572 | ci4-cms-erp/ci4ms | CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | high | 8.8 | 1% |
| CVE-2024-13622 | woo-addon-uploads (WordPress plugin) | The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | high | 7.5 | 1% |
| CVE-2022-23501 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Weak Authentication in Frontend Login | medium | 5.9 | 1% |
| CVE-2022-4408 | thorsten/phpmyfaq | phpMyFAQ vulnerable to Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-4864 | froxlor/froxlor | Froxlor vulnerable to Argument Injection | medium | 5.4 | 1% |
| CVE-2023-44381 | october/system | October CMS safe mode bypass using Page template injection | medium | 4.9 | 1% |
| CVE-2022-3601 | image-hover-effects-css3 (WordPress plugin) | The Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 1% |
| CVE-2022-4004 | donation-button (WordPress plugin) | The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_se | medium | 4.3 | 1% |
| CVE-2024-47836 | admidio/admidio | Admidio Vulnerable to HTML Injection In The Messages Section | low | 3.5 | 1% |
| CVE-2024-38516 | aimeos/ai-client-html | Aimeos HTML client may potentially reveal sensitive information in error log | high | 8.8 | 1% |
| CVE-2026-76086 | verbb/formie | Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials | high | 8.5 | 1% |
| CVE-2023-2433 | yet-another-related-posts-plugin (WordPress plugin) | The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30 | medium | 6.4 | 1% |
| CVE-2023-4283 | embedpress (WordPress plugin) | The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpress_calendar' shortcode in versions up to, | medium | 6.4 | 1% |
| CVE-2024-6169 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 1% |
| CVE-2022-4267 | bulk-delete-users-by-email (WordPress plugin) | The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 1% |
| CVE-2022-4369 | wp-lister-lite-for-amazon (WordPress plugin) | The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, | medium | 6.1 | 1% |