Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0421 | cloud-manager (WordPress plugin) | The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, | medium | 6.1 | 1% |
| CVE-2023-0733 | newsletter-popup (WordPress plugin) | The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users | medium | 6.1 | 1% |
| CVE-2023-5560 | wp-useronline (WordPress plugin) | The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on th | medium | 6.1 | 1% |
| CVE-2023-5653 | wassup-real-time-analytics (WordPress plugin) | The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them | medium | 6.1 | 1% |
| CVE-2023-5958 | post-smtp (WordPress plugin) | The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an un | medium | 6.1 | 1% |
| CVE-2023-0146 | naver-map (WordPress plugin) | The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a | medium | 5.4 | 1% |
| CVE-2023-0282 | yourchannel (WordPress plugin) | The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Su | medium | 5.4 | 1% |
| CVE-2023-1116 | pimcore/pimcore | Pimcore vulnerable to Cross Site Scripting in Email Blacklist | medium | 5.4 | 1% |
| CVE-2023-47379 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-2751 | upload-resume (WordPress plugin) | The Upload Resume WordPress plugin through 1.2.0 does not validate the captcha parameter when uploading a resume via the resume_upload_form | medium | 5.3 | 1% |
| CVE-2024-1177 | wp-club-manager (WordPress plugin) | The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 1% |
| CVE-2024-31247 | fg-drupal (WordPress plugin) | Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to Wor | medium | 5.3 | 1% |
| CVE-2022-3892 | wp-oauth-server (WordPress plugin) | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high pri | medium | 4.8 | 1% |
| CVE-2024-1754 | nps-computy (WordPress plugin) | The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.7 | 1% |
| CVE-2022-45353 | betheme (WordPress plugin) | Broken Access Control in Betheme theme <= 26.6.1 on WordPress. | medium | 4.3 | 1% |
| CVE-2021-36864 | quiz-master-next (WordPress plugin) | Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress. | low | 3.4 | 1% |
| CVE-2025-53625 | universal-omega/dynamic-page-list3 | DynamicPageList3 vulnerability exposes hidden/suppressed usernames | high | 0.0 | 1% |
| CVE-2025-62671 | mediawiki/cargo | Cargo Mediawiki Extension vulnerable to Cross-site Scripting | medium | 0.0 | 1% |
| CVE-2026-77128 | derhansen/sf_event_mgt | TYPO3-EXT-SA-2026-023: Broken Access Control in extension "Event management and registration" (sf_event_mgt) | unknown | 0.0 | 1% |
| CVE-2024-3561 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and includ | high | 8.8 | 1% |
| CVE-2024-5329 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘da | high | 8.8 | 1% |
| CVE-2024-6338 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up | high | 8.8 | 1% |
| CVE-2023-35782 | in2code/ipandlanguageredirect | ipandlanguageredirect extension vulnerable to SQL Injection | high | 8.2 | 1% |
| CVE-2023-48288 | jobwp (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.Thi | high | 7.5 | 1% |
| CVE-2024-10402 | forminator-forms (WordPress plugin) | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a m | high | 7.5 | 1% |
| CVE-2026-86434 | league/commonmark | league/commonmark: Denial of service via colliding heading slugs | high | 7.5 | 1% |
| CVE-2024-0254 | guest-author-name (WordPress plugin) | The (Simply) Guest Author Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's post meta in all versions | medium | 6.4 | 1% |
| CVE-2024-1237 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the flyout_layout attribute in a | medium | 6.4 | 1% |
| CVE-2024-1392 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button1_icon' attribute of the Dual | medium | 6.4 | 1% |
| CVE-2024-3244 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 6.4 | 1% |
| CVE-2021-43561 | pegasus/google-for-jobs | Cross-site Scripting in pegasus/google-for-jobs | medium | 5.4 | 1% |
| CVE-2023-0308 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-0309 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2026-27461 | pimcore/pimcore | Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause | medium | 0.0 | 1% |
| CVE-2026-33038 | wwbn/avideo | AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments | high | 8.1 | 1% |
| CVE-2026-53599 | redaxo/source | Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extensio | high | 7.5 | 1% |
| CVE-2023-2323 | pimcore/pimcore | Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field | medium | 6.8 | 1% |
| CVE-2022-46848 | visualizer (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin | medium | 6.5 | 1% |
| CVE-2023-1404 | show-posts (WordPress plugin) | The Weaver Show Posts Plugin for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display | medium | 6.4 | 1% |
| CVE-2023-4718 | font-awesome-4-menus (WordPress plugin) | The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in version | medium | 6.4 | 1% |
| CVE-2023-4772 | newsletter (WordPress plugin) | The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletter_form' shortcode in versions up to, and | medium | 6.4 | 1% |
| CVE-2023-5051 | callrail-phone-call-tracking (WordPress plugin) | The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in vers | medium | 6.4 | 1% |
| CVE-2023-5062 | wp-charts (WordPress plugin) | The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in versions up to, and incl | medium | 6.4 | 1% |
| CVE-2023-5063 | youtube-widget-responsive (WordPress plugin) | The Widget Responsive for Youtube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube' shortcode in versions up t | medium | 6.4 | 1% |
| CVE-2023-5252 | fareharbor (WordPress plugin) | The FareHarbor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.7 due | medium | 6.4 | 1% |
| CVE-2023-5291 | blog-filter (WordPress plugin) | The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'AWL-BlogFilter' shortcode in versions up to, and incl | medium | 6.4 | 1% |
| CVE-2023-5614 | theme-switcha (WordPress plugin) | The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'theme_switcha_list' shortcode in all v | medium | 6.4 | 1% |
| CVE-2023-5705 | vk-filter-search (WordPress plugin) | The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all | medium | 6.4 | 1% |
| CVE-2024-3167 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitter_username’ parameter in versions up to, an | medium | 6.4 | 1% |
| CVE-2021-36887 | tarteaucitronjs (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & | medium | 6.1 | 1% |