Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1108 | plugin-groups (WordPress plugin) | The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_ini | medium | 6.5 | 0% |
| CVE-2024-13369 | tour-master (WordPress plugin) | The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter i | medium | 6.5 | 0% |
| CVE-2024-1381 | page-builder-sandwich (WordPress plugin) | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in | medium | 6.5 | 0% |
| CVE-2026-49976 | snipe/snipe-it | Snipe-IT Vulnerable to User Account Escalation via CSV Import | medium | 6.5 | 0% |
| CVE-2023-6566 | microweber/microweber | Microweber Business Logic Errors | medium | 5.9 | 0% |
| CVE-2021-36573 | feehi/feehicms | FeehiCMS Unrestricted Upload vulnerability | medium | 5.4 | 0% |
| CVE-2024-7398 | concrete5/concrete5 | Cross site scripting in Concrete CMS | medium | 5.4 | 0% |
| CVE-2021-41948 | intelliants/subrion | Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin | medium | 4.8 | 0% |
| CVE-2021-24725 | comment-link-remove-and-other-comment-tools (WordPress plugin) | The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', whic | medium | 4.3 | 0% |
| CVE-2026-27127 | craftcms/cms | Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding | high | 0.0 | 0% |
| CVE-2026-44174 | getkirby/cms | Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints | high | 0.0 | 0% |
| CVE-2024-48230 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 0% |
| CVE-2021-4450 | post-grid (WordPress plugin) | The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to in | high | 8.8 | 0% |
| CVE-2025-66300 | getgrav/grav | Grav is vulnerable to Arbitrary File Read | high | 8.5 | 0% |
| CVE-2022-40218 | advance-product-search (WordPress plugin) | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/ | medium | 6.5 | 0% |
| CVE-2022-45803 | gutenberg-forms (WordPress plugin) | Missing Authorization vulnerability in Nikolay Strikhar WordPress Form Builder Plugin – Gutenberg Forms.This issue affects WordPress Form Bu | medium | 6.5 | 0% |
| CVE-2023-4944 | awesome-weather (WordPress plugin) | The Awesome Weather Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up | medium | 6.4 | 0% |
| CVE-2024-1323 | themeisle-companion (WordPress plugin) | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Type Grid Widget Title in | medium | 6.4 | 0% |
| CVE-2024-2871 | media-library-assistant (WordPress plugin) | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and inc | medium | 6.4 | 0% |
| CVE-2024-4430 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo widget crop attr | medium | 6.4 | 0% |
| CVE-2022-2094 | yellow-yard-searchbar (WordPress plugin) | The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading | medium | 6.1 | 0% |
| CVE-2023-0442 | loan-comparison (WordPress plugin) | The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a | medium | 6.1 | 0% |
| CVE-2023-1891 | accordion-\&-faq (WordPress plugin) | The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some not | medium | 6.1 | 0% |
| CVE-2023-2398 | icegram-engage (WordPress plugin) | The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflec | medium | 6.1 | 0% |
| CVE-2023-2472 | newsletter\,-smtp\,-email-marketing-and-subscribe (WordPress plugin) | The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parame | medium | 6.1 | 0% |
| CVE-2023-2701 | gravity-forms (WordPress plugin) | The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cr | medium | 6.1 | 0% |
| CVE-2023-2743 | wp-erp (WordPress plugin) | The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leadi | medium | 6.1 | 0% |
| CVE-2023-2803 | ultimate-addons-for-contact-form-7 (WordPress plugin) | The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in | medium | 6.1 | 0% |
| CVE-2023-3182 | restrict-content (WordPress plugin) | The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 0% |
| CVE-2023-4290 | wp-matterport-shortcode (WordPress plugin) | The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, lea | medium | 6.1 | 0% |
| CVE-2023-4476 | locatoraid (WordPress plugin) | The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back | medium | 6.1 | 0% |
| CVE-2023-4819 | shared-files (WordPress plugin) | The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an | medium | 6.1 | 0% |
| CVE-2023-2169 | simple-tags (WordPress plugin) | The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and i | medium | 5.5 | 0% |
| CVE-2023-2170 | simple-tags (WordPress plugin) | The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and i | medium | 5.5 | 0% |
| CVE-2024-13231 | uber-grid (WordPress plugin) | The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 5.3 | 0% |
| CVE-2022-4385 | intuitive-custom-post-order (WordPress plugin) | The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowin | medium | 4.3 | 0% |
| CVE-2023-1027 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the checkAllCateg | medium | 4.3 | 0% |
| CVE-2023-22728 | silverstripe/framework | Missing permission check of canView in GridFieldPrintButton | medium | 4.3 | 0% |
| CVE-2025-31128 | drupal/gifplayer | Gif Player Field creates a simple file field types that allows you to upload the GIF files and configure the output for | unknown | 0.0 | 0% |
| CVE-2024-6482 | login-with-phone-number (WordPress plugin) | The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is | high | 8.8 | 0% |
| CVE-2024-8102 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to pr | high | 8.8 | 0% |
| CVE-2024-8247 | newsletters-lite (WordPress plugin) | The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the | high | 8.8 | 0% |
| CVE-2024-8428 | forumwp (WordPress plugin) | The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Referenc | high | 8.8 | 0% |
| CVE-2024-9637 | wpschoolpress (WordPress plugin) | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions | high | 8.8 | 0% |
| CVE-2024-13234 | woo-product-tables (WordPress plugin) | The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, | high | 7.5 | 0% |
| CVE-2024-13528 | emails-verification-for-woocommerce (WordPress plugin) | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and inclu | high | 7.5 | 0% |
| CVE-2023-5109 | wp-mailto-links (WordPress plugin) | The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode | medium | 6.4 | 0% |
| CVE-2023-5704 | cpo-shortcodes (WordPress plugin) | The CPO Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and | medium | 6.4 | 0% |
| CVE-2023-5708 | wp-post-columns (WordPress plugin) | The WP Post Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'column' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2022-44069 | tribalsystems/zenario | Cross-site Scripting in Zenario | medium | 5.4 | 0% |