Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4862 | wpbits-addons-for-elementor (WordPress plugin) | The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all ve | medium | 6.4 | 0% |
| CVE-2025-6736 | juzaweb/cms | JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing certain components | medium | 6.3 | 0% |
| CVE-2023-1420 | ajax-search (WordPress plugin) | The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter | medium | 6.1 | 0% |
| CVE-2023-2296 | loginizer (WordPress plugin) | The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross- | medium | 6.1 | 0% |
| CVE-2023-2654 | conditional-menus (WordPress plugin) | The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Refl | medium | 6.1 | 0% |
| CVE-2023-3992 | postx (WordPress plugin) | The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect | medium | 6.1 | 0% |
| CVE-2020-20696 | gilacms/gila | Cross-site Scripting in GilaCMS | medium | 5.4 | 0% |
| CVE-2026-79773 | winter/wn-system-module | Winter: Local File Inclusion through =include directives in JavaScript asset compilation | medium | 4.9 | 0% |
| CVE-2022-3830 | wp-page-builder (WordPress plugin) | The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2022-3832 | external-media (WordPress plugin) | The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2022-3837 | uji-countdown (WordPress plugin) | The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2022-3838 | wpupper-share-buttons (WordPress plugin) | The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2022-3862 | addons-for-elementor (WordPress plugin) | The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high pr | medium | 4.8 | 0% |
| CVE-2022-3919 | jetpack-crm (WordPress plugin) | The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perf | medium | 4.8 | 0% |
| CVE-2022-4000 | woocommerce-shipping (WordPress plugin) | The WooCommerce Shipping WordPress plugin through 1.2.11 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2022-4042 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could a | medium | 4.8 | 0% |
| CVE-2022-4119 | image-optimizer\,-resizer-and-cdn (WordPress plugin) | The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2022-4142 | wordpress-filter-gallery (WordPress plugin) | The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters aja | medium | 4.8 | 0% |
| CVE-2022-4256 | all-in-one-addons-for-elementor (WordPress plugin) | The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2023-5424 | ws-form (WordPress plugin) | The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated | medium | 4.7 | 0% |
| CVE-2023-6737 | enable-media-replace (WordPress plugin) | The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all vers | medium | 4.7 | 0% |
| CVE-2022-3343 | wpqa-builder (WordPress plugin) | The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tr | low | 3.5 | 0% |
| CVE-2026-28696 | craftcms/cms | Craft CMS has IDOR via GraphQL @parseRefs | high | 0.0 | 0% |
| CVE-2026-56394 | craftcms/cms | Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read | low | 0.0 | 0% |
| CVE-2026-77635 | cakephp/cakephp, cakephp/database | CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver | critical | 0.0 | 0% |
| CVE-2024-12860 | carspot (WordPress plugin) | The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all ve | critical | 9.8 | 0% |
| CVE-2025-65854 | mineadmin/mineadmin | MineAdmin has an insecure default password | critical | 9.8 | 0% |
| CVE-2023-1597 | cloud-library (WordPress plugin) | The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticat | high | 8.8 | 0% |
| CVE-2023-4007 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | high | 8.8 | 0% |
| CVE-2021-38342 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_pos | high | 8.1 | 0% |
| CVE-2026-55690 | starcitizenwiki/embedvideo | StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text | high | 7.5 | 0% |
| CVE-2026-55692 | starcitizenwiki/embedvideo | StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled | high | 7.5 | 0% |
| CVE-2023-5527 | business-directory-plugin (WordPress plugin) | The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv- | high | 7.4 | 0% |
| CVE-2023-3092 | smtp-mail (WordPress plugin) | The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.4 | high | 7.2 | 0% |
| CVE-2023-50714 | yiisoft/yii2-authclient | yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable | medium | 6.8 | 0% |
| CVE-2023-5050 | leaflet-map (WordPress plugin) | The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due | medium | 6.4 | 0% |
| CVE-2023-4250 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading t | medium | 6.1 | 0% |
| CVE-2023-5238 | eventprime (WordPress plugin) | The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an H | medium | 6.1 | 0% |
| CVE-2024-1664 | responsive-gallery-grid (WordPress plugin) | The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privile | medium | 6.1 | 0% |
| CVE-2023-1883 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to improper access control | medium | 5.4 | 0% |
| CVE-2024-3026 | maxbuttons (WordPress plugin) | The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users w | medium | 5.4 | 0% |
| CVE-2024-2966 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 5.3 | 0% |
| CVE-2022-30545 | 5-anker-connect (WordPress plugin) | Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress. | medium | 4.8 | 0% |
| CVE-2022-32776 | advanced-ads (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 on | medium | 4.8 | 0% |
| CVE-2022-41980 | mantenimiento-web (WordPress plugin) | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin <= 0.13 on WordPress. | medium | 4.8 | 0% |
| CVE-2024-45127 | magento/community-edition | Magento Open Source stored Cross-Site Scripting (XSS) vulnerability | medium | 4.8 | 0% |
| CVE-2023-4160 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, | medium | 4.4 | 0% |
| CVE-2023-5381 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and inc | medium | 4.4 | 0% |
| CVE-2024-4350 | concrete5/concrete5 | Concrete CMS Stored Cross-site Scripting vulnerability | low | 3.0 | 0% |
| CVE-2026-22850 | koko-analytics (WordPress plugin) | Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through u | high | 8.3 | 0% |