Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-44070 | tribalsystems/zenario | Cross-site Scripting in Zenario | medium | 5.4 | 0% |
| CVE-2022-44071 | tribalsystems/zenario | Cross-site Scripting in Zenario | medium | 5.4 | 0% |
| CVE-2022-44073 | tribalsystems/zenario | Cross-site Scripting in Zenario | medium | 5.4 | 0% |
| CVE-2023-3372 | lana-shortcodes (WordPress plugin) | The Lana Shortcodes WordPress plugin before 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2024-39319 | aimeos/ai-controller-frontend | IDOR vulnerability in account profile page | medium | 5.3 | 0% |
| CVE-2024-47047 | in2code/powermail | powermail TYPO3 extension has Insecure Direct Object Reference | medium | 5.3 | 0% |
| CVE-2026-48015 | shopware/core, shopware/platform | Shopware: Stored XSS via SVG file upload — no SVG sanitization | medium | 4.9 | 0% |
| CVE-2023-4253 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-24751 | derhansen/sf_event_mgt | derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module | medium | 4.3 | 0% |
| CVE-2022-24744 | shopware/core, shopware/platform | Shopware user session is not logged out if the password is reset via password recovery | low | 2.6 | 0% |
| CVE-2020-13458 | verbb/image-resizer | Image Resizer Cross-Site Request Forgery (CSRF) | high | 8.8 | 0% |
| CVE-2024-5325 | form-vibes (WordPress plugin) | The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fv_export_data’ parameter in all versions up to, and including, | high | 8.8 | 0% |
| CVE-2026-55691 | starcitizenwiki/embedvideo | StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template | high | 8.6 | 0% |
| CVE-2022-40192 | wpforo-forum (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. | high | 7.1 | 0% |
| CVE-2022-4649 | wp-extended-search (WordPress plugin) | The WP Extended Search WordPress plugin before 2.1.2 does not validate and escape one of its shortcode attributes, which could allow users w | medium | 5.4 | 0% |
| CVE-2023-2414 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due | medium | 5.4 | 0% |
| CVE-2023-5087 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicio | medium | 5.4 | 0% |
| CVE-2023-2014 | microweber/microweber | Microweber vulnerable to cross-site scripting (XSS) | medium | 4.8 | 0% |
| CVE-2024-1712 | carousel-slider (WordPress plugin) | The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.7 | 0% |
| CVE-2024-10050 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6 | medium | 4.3 | 0% |
| CVE-2026-49274 | getkirby/cms | Kirby: `pages.access` permission is not checked in the pages picker for parent pages | medium | 0.0 | 0% |
| CVE-2026-55474 | snipe/snipe-it | Snipe-IT vulnerable to directory traversal in displaySig | high | 0.0 | 0% |
| CVE-2024-3592 | quiz-master-next (WordPress plugin) | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'qu | critical | 9.9 | 0% |
| CVE-2024-8436 | wp-easy-gallery (WordPress plugin) | The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'edit_imageId' and 'edit_imageDel | critical | 9.9 | 0% |
| CVE-2026-52775 | yeswiki/yeswiki | YesWiki has Authenticated SQL Injection via ReactionManager | high | 8.8 | 0% |
| CVE-2026-35672 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Default Empty API Token Authentication Bypass | high | 7.5 | 0% |
| CVE-2023-2999 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to cross-site scripting | medium | 6.7 | 0% |
| CVE-2023-6824 | wp-customer-area (WordPress plugin) | The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any u | medium | 6.5 | 0% |
| CVE-2024-1570 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2024-2210 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via | medium | 6.4 | 0% |
| CVE-2024-41109 | pimcore/admin-ui-classic-bundle | Pimcore vulnerable to disclosure of system and database information behind /admin firewall | medium | 6.3 | 0% |
| CVE-2024-6524 | shopxo/shopxo | ShopXO Server-Side Request Forgery Vulnerability | medium | 5.5 | 0% |
| CVE-2020-36667 | backup (WordPress plugin) | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, | medium | 5.4 | 0% |
| CVE-2021-36905 | quiz-master-next (WordPress plugin) | Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-37297 | woocommerce (WordPress plugin), woocommerce/woocommerce | WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site sc | medium | 5.4 | 0% |
| CVE-2022-43691 | concrete5/concrete5 | Concrete CMS vulnerable to Cleartext Transmission of Sensitive Information | medium | 5.3 | 0% |
| CVE-2023-3869 | wpdiscuz (WordPress plugin) | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComme | medium | 5.3 | 0% |
| CVE-2023-3998 | wpdiscuz (WordPress plugin) | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate fu | medium | 5.3 | 0% |
| CVE-2020-36752 | nifty-coming-soon-and-under-construction-page (WordPress plugin) | The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1 | medium | 4.3 | 0% |
| CVE-2021-24431 | language-bar-flags (WordPress plugin) | The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escap | medium | 4.3 | 0% |
| CVE-2021-24586 | per-page-add-to-head (WordPress plugin) | The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2021-24806 | wpdiscuz (WordPress plugin) | The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to mak | medium | 4.3 | 0% |
| CVE-2023-4023 | all-users-messenger (WordPress plugin) | The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users mes | medium | 4.3 | 0% |
| CVE-2023-43664 | prestashop/prestashop | PrestaShop allows employee without any access rights to list all installed modules | medium | 4.3 | 0% |
| CVE-2026-48805 | twig/twig | Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` | low | 0.0 | 0% |
| CVE-2024-8624 | wp-meta-data-filter-and-taxonomy-filter (WordPress plugin) | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attribute of the 'mdf_sele | critical | 9.9 | 0% |
| CVE-2023-5316 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | critical | 9.1 | 0% |
| CVE-2024-9522 | wp-users-masquerade (WordPress plugin) | The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to | high | 8.8 | 0% |
| CVE-2024-9687 | two-factor-login-telegram (WordPress plugin) | The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to i | high | 8.8 | 0% |
| CVE-2026-28562 | wpforo (WordPress plugin) | wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffectiv | high | 8.2 | 0% |