Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-27918 | ameliabooking (WordPress plugin) | Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote | medium | 6.1 | 1% |
| CVE-2022-4114 | superio (WordPress plugin) | The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perf | medium | 5.4 | 1% |
| CVE-2023-6855 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized m | medium | 5.3 | 1% |
| CVE-2025-24013 | codeigniter4/framework | Missing validation of header name and value in codeigniter4/framework | medium | 5.3 | 1% |
| CVE-2023-38500 | typo3/html-sanitizer | By-passing Cross-Site Scripting Protection in HTML Sanitizer | medium | 4.7 | 1% |
| CVE-2024-29179 | phpmyfaq/phpmyfaq | phpMyFAQ Stored Cross-site Scripting at File Attachments | medium | 4.3 | 1% |
| CVE-2026-55555 | dompdf/dompdf | Dompdf: File existence oracle via font-face stylesheet declaration | low | 0.0 | 1% |
| CVE-2026-62996 | smarty/smarty | Smarty Security stream restriction bypass through stream: resource | medium | 0.0 | 1% |
| CVE-2024-0702 | oliver-pos (WordPress plugin) | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability check | high | 7.3 | 1% |
| CVE-2024-35226 | smarty/smarty | Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag | high | 7.3 | 1% |
| CVE-2022-36745 | librenms/librenms | LibreNMS vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-36746 | librenms/librenms | LibreNMS vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-4329 | product-list-widget-for-woocommerce (WordPress plugin) | The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in t | medium | 6.1 | 1% |
| CVE-2024-45060 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file | medium | 6.1 | 1% |
| CVE-2020-36656 | spectra (WordPress plugin) | The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to con | medium | 5.4 | 1% |
| CVE-2021-24685 | flat-preloader (WordPress plugin) | The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and es | medium | 5.4 | 1% |
| CVE-2022-4470 | widgets-for-google-reviews (WordPress plugin) | The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting t | medium | 5.4 | 1% |
| CVE-2022-4667 | rss-aggregator-by-feedzy (WordPress plugin) | The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them bac | medium | 5.4 | 1% |
| CVE-2023-0219 | fluentsmtp (WordPress plugin) | The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting | medium | 5.4 | 1% |
| CVE-2021-46876 | ezsystems/ezpublish-kernel | /user/sessions endpoint allows detecting valid accounts | medium | 5.3 | 1% |
| CVE-2024-13818 | pie-register (WordPress plugin) | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction p | medium | 5.3 | 1% |
| CVE-2025-27191 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control leads to Security feature bypass | medium | 5.3 | 1% |
| CVE-2025-51510 | moonshine/moonshine | MoonShine SQL Injection Vulnerability | medium | 4.9 | 1% |
| CVE-2015-10001 | wp-stats (WordPress plugin) | The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting | medium | 4.3 | 1% |
| CVE-2022-25769 | mautic/core | Improper regex in htaccess file | medium | 0.0 | 1% |
| CVE-2022-36379 | yookassa (WordPress plugin) | Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. | high | 8.8 | 1% |
| CVE-2024-7780 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | high | 7.2 | 1% |
| CVE-2021-4123 | remdex/livehelperchat | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 1% |
| CVE-2026-26047 | moodle/moodle | Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits | medium | 6.5 | 1% |
| CVE-2026-50157 | auth0/symfony | Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter | medium | 6.5 | 1% |
| CVE-2023-2300 | contact-form-with-a-meeting-scheduler-by-vcita (WordPress plugin) | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up | medium | 6.4 | 1% |
| CVE-2024-1398 | ultimate-bootstrap-elements-for-elementor (WordPress plugin) | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ | medium | 6.4 | 1% |
| CVE-2023-1596 | composer (WordPress plugin) | The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 1% |
| CVE-2021-24567 | simple-post (WordPress plugin) | The Simple Post WordPress plugin through 1.1 does not sanitize user input when an authenticated user Text value, then it does not escape the | medium | 5.4 | 1% |
| CVE-2021-24584 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any us | medium | 5.4 | 1% |
| CVE-2022-40408 | feehi/feehicms | FeehiCMS vulnerable to Cross-Site scripting via crafted payload | medium | 5.4 | 1% |
| CVE-2023-25715 | gamipress (WordPress plugin) | Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in Wo | medium | 5.4 | 1% |
| CVE-2025-13377 | tenweb-speed-optimizer (WordPress plugin) | The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion | critical | 9.6 | 1% |
| CVE-2024-1989 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Sassy_Soc | medium | 6.4 | 1% |
| CVE-2023-2066 | bulletin-announcements (WordPress plugin) | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to unauthorized access and modification of data due to | medium | 6.3 | 1% |
| CVE-2023-2718 | contact-form-email (WordPress plugin) | The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stor | medium | 5.4 | 1% |
| CVE-2021-36400 | moodle/moodle | Moodle has Incorrect Default Permissions | medium | 5.3 | 1% |
| CVE-2024-1204 | meta-box (WordPress plugin) | The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields as | medium | 4.3 | 1% |
| CVE-2024-7112 | booking-system (WordPress plugin) | The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter i | high | 8.8 | 1% |
| CVE-2026-21449 | bagisto/bagisto | Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users | high | 8.8 | 1% |
| CVE-2025-21612 | starcitizentools/tabber-neue | Extension:TabberNeue vulnerable to Cross-site Scripting | high | 8.6 | 1% |
| CVE-2026-56825 | shopper/framework | Shopper: Missing authorization on product removal actions in CollectionProducts component | high | 8.1 | 1% |
| CVE-2026-56827 | shopper/framework | Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of | high | 8.1 | 1% |
| CVE-2026-56829 | shopper/framework | Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component | high | 8.1 | 1% |
| CVE-2023-40033 | flarum/core, flarum/framework | Flarum vulnerable to LFI and Blind SSRF via Avatar upload | high | 7.1 | 1% |