Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-0672 | pz-linkcard (WordPress plugin) | The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a | high | 7.1 | 0% |
| CVE-2023-7225 | mappress-google-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all | medium | 6.4 | 0% |
| CVE-2024-8549 | google-calendar-events (WordPress plugin) | The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer | medium | 6.1 | 0% |
| CVE-2023-32065 | oro/commerce | OroCommerce get-totals-for-checkout API endpoint returns unwanted data | medium | 5.8 | 0% |
| CVE-2024-8978 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 5.7 | 0% |
| CVE-2022-3194 | dokan (WordPress plugin) | The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored | medium | 5.4 | 0% |
| CVE-2022-3935 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users | medium | 5.4 | 0% |
| CVE-2024-13426 | wp-polls (WordPress plugin) | The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient | medium | 5.4 | 0% |
| CVE-2022-4036 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to t | medium | 5.3 | 0% |
| CVE-2024-0621 | simple-share-buttons-adder (WordPress plugin) | The Simple Share Buttons Adder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, a | medium | 4.4 | 0% |
| CVE-2024-39408 | magento/community-edition | Magento Open Source Cross-Site Request Forgery vulnerability | medium | 4.3 | 0% |
| CVE-2024-39409 | magento/community-edition | Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2024-39410 | magento/community-edition | Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability | medium | 4.3 | 0% |
| CVE-2026-55590 | cakephp/authentication | CakePHP Authentication: Open redirect weakness via backslash bypass | medium | 0.0 | 0% |
| CVE-2017-12871 | simplesamlphp/simplesamlphp | SimpleSAMLphp Incorrect IV generation for encryption | medium | 5.9 | 0% |
| CVE-2022-40223 | searchwp (WordPress plugin) | Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change. | medium | 5.4 | 0% |
| CVE-2022-4651 | justified-gallery (WordPress plugin) | The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users wi | medium | 5.4 | 0% |
| CVE-2022-4757 | list-pages-shortcode (WordPress plugin) | The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2022-4788 | embed-pdf (WordPress plugin) | The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a | medium | 5.4 | 0% |
| CVE-2022-4829 | show-hide-\/-collapse-expand (WordPress plugin) | The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputtin | medium | 5.4 | 0% |
| CVE-2023-0168 | olevmedia-shortcodes (WordPress plugin) | The Olevmedia Shortcodes WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2023-0333 | templatesnext-toolkit (WordPress plugin) | The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an | medium | 5.4 | 0% |
| CVE-2023-5057 | activitypub (WordPress plugin) | The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with | medium | 5.4 | 0% |
| CVE-2024-0617 | woo-product-category-discount (WordPress plugin) | The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check | medium | 5.3 | 0% |
| CVE-2023-43340 | evolutioncms/evolution | Evolution CMS Cross-site Scripting vulnerability | medium | 5.2 | 0% |
| CVE-2023-48650 | concrete5/concrete5 | Concrete CMS Stored XSS in Layout Preset Name | medium | 4.8 | 0% |
| CVE-2024-21665 | pimcore/ecommerce-framework-bundle | Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list | medium | 4.3 | 0% |
| CVE-2023-6599 | microweber/microweber | Microweber missing standardized error handling mechanism | low | 3.1 | 0% |
| CVE-2026-81525 | mongodb/mongodb | mongodb: Reject "." and NUL bytes in database and collection names | high | 8.1 | 0% |
| CVE-2024-13613 | wise-chat (WordPress plugin) | The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uplo | high | 7.5 | 0% |
| CVE-2024-52526 | librenms/librenms | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php | high | 7.5 | 0% |
| CVE-2026-33204 | kelvinmo/simplejwt | SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering | high | 7.5 | 0% |
| CVE-2024-3591 | geo-controller (WordPress plugin) | The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow | medium | 6.5 | 0% |
| CVE-2024-4268 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in a | medium | 6.4 | 0% |
| CVE-2025-0968 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 0% |
| CVE-2023-0892 | bizlibrary (WordPress plugin) | The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2024-5032 | sully (WordPress plugin) | The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect | medium | 4.7 | 0% |
| CVE-2025-25226 | joomla/database | Joomla Framework Database Package Vulnerable to SQL Injection | medium | 0.0 | 0% |
| CVE-2022-43693 | concrete5/concrete5 | Concrete CMS vulnerable to Cross-site Request Forgery | high | 8.8 | 0% |
| CVE-2024-58382 | league/commonmark | league/commonmark's quadratic complexity bugs may lead to a denial of service | high | 7.5 | 0% |
| CVE-2026-34731 | wwbn/avideo | AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php | high | 7.5 | 0% |
| CVE-2023-45829 | newsletter-\&-bulk-email-sender (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in HappyBox Newsletter & Bulk Email Sender – Email Newsletter Plugin fo | medium | 6.5 | 0% |
| CVE-2021-4378 | wp-quick-frontend-editor (WordPress plugin) | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5 due to | medium | 6.4 | 0% |
| CVE-2023-2031 | locatoraid (WordPress plugin) | The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up | medium | 5.4 | 0% |
| CVE-2015-10116 | favicon-by-realfavicongenerator (WordPress plugin) | A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the | medium | 4.3 | 0% |
| CVE-2022-3923 | activecampaign-for-woocommerce (WordPress plugin) | The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJ | medium | 4.3 | 0% |
| CVE-2026-45074 | symfony/security-http, symfony/symfony | Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay | medium | 0.0 | 0% |
| CVE-2023-6878 | slick-social-share-buttons (WordPress plugin) | The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | high | 8.8 | 0% |
| CVE-2026-52769 | yeswiki/yeswiki | YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId` | high | 8.3 | 0% |
| CVE-2025-6744 | woodmart (WordPress theme) | The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due | high | 7.3 | 0% |