Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0166 | product-slider-for-woocommerce (WordPress plugin) | The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attribu | medium | 5.4 | 0% |
| CVE-2023-0177 | social-like-box-and-page (WordPress plugin) | The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortcode attributes before | medium | 5.4 | 0% |
| CVE-2023-0270 | yamaps (WordPress plugin) | The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attributes before outputti | medium | 5.4 | 0% |
| CVE-2024-13719 | pepro-ultimate-invoice (WordPress plugin) | The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2 | medium | 5.3 | 0% |
| CVE-2023-1166 | usm-premium (WordPress plugin) | The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such | medium | 4.8 | 0% |
| CVE-2023-3248 | my-sticky-elements (WordPress plugin) | The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2023-4254 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2022-0707 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow | medium | 4.3 | 0% |
| CVE-2023-5542 | moodle/moodle | Moodle Improper Access Control vulnerability | medium | 4.3 | 0% |
| CVE-2023-5319 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | high | 8.3 | 0% |
| CVE-2026-42606 | azuracast/azuracast | AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass | high | 8.1 | 0% |
| CVE-2024-11941 | drupal/core | The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests th | high | 7.5 | 0% |
| CVE-2024-13475 | small-package-quotes (WordPress plugin) | The Small Package Quotes – UPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to | high | 7.5 | 0% |
| CVE-2026-33485 | wwbn/avideo | AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter | high | 7.5 | 0% |
| CVE-2023-46627 | wordpress-simple-html-sitemap (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions. | high | 7.1 | 0% |
| CVE-2024-10900 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 6.5 | 0% |
| CVE-2023-1155 | nd-projects (WordPress plugin) | The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in vers | medium | 6.4 | 0% |
| CVE-2023-3051 | page-builder-by-azexo (WordPress plugin) | The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azh_post' shortcode in versions up to, and | medium | 6.4 | 0% |
| CVE-2024-0963 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode | medium | 6.4 | 0% |
| CVE-2023-1885 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via category field name parameter | medium | 6.3 | 0% |
| CVE-2023-0769 | migration-simple (WordPress plugin) | The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 0% |
| CVE-2024-3964 | product-enquiry-for-woocommerce (WordPress plugin) | The Product Enquiry for WooCommerce WordPress plugin before 3.1.8 does not sanitise and escape some of its settings, which could allow high | medium | 5.9 | 0% |
| CVE-2022-4391 | vision-interactive (WordPress plugin) | The Vision Interactive For WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as | medium | 5.4 | 0% |
| CVE-2022-4392 | ipanorama-360-wordpress-virtual-tour-builder (WordPress plugin) | The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow | medium | 5.4 | 0% |
| CVE-2022-4393 | imagelinks (WordPress plugin) | The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could a | medium | 5.4 | 0% |
| CVE-2022-4394 | ipages-flipbook (WordPress plugin) | The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as co | medium | 5.4 | 0% |
| CVE-2022-4449 | page-scroll-to-id (WordPress plugin) | The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 0% |
| CVE-2022-4451 | sassy-social-share (WordPress plugin) | The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2022-4460 | codelights-shortcodes-and-widgets (WordPress plugin) | The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputti | medium | 5.4 | 0% |
| CVE-2022-4465 | wp-video-lightbox (WordPress plugin) | The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 0% |
| CVE-2022-4467 | search-\&-filter (WordPress plugin) | The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2022-4474 | easy-social-feed (WordPress plugin) | The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2022-4478 | font-awesome (WordPress plugin) | The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2022-4482 | carousel\,-slider\,-gallery-by-wp-carousel (WordPress plugin) | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes bef | medium | 5.4 | 0% |
| CVE-2022-4484 | super-socializer (WordPress plugin) | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode | medium | 5.4 | 0% |
| CVE-2022-4485 | page-list (WordPress plugin) | The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the p | medium | 5.4 | 0% |
| CVE-2022-4491 | wp-table-reloaded (WordPress plugin) | The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them b | medium | 5.4 | 0% |
| CVE-2022-4509 | content-control (WordPress plugin) | The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them bac | medium | 5.4 | 0% |
| CVE-2022-4542 | compact-wp-audio-player (WordPress plugin) | The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2022-4545 | sitemap (WordPress plugin) | The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the pag | medium | 5.4 | 0% |
| CVE-2022-4570 | top-10 (WordPress plugin) | The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, | medium | 5.4 | 0% |
| CVE-2022-4576 | easy-bootstrap-shortcode (WordPress plugin) | The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attributes before outputting | medium | 5.4 | 0% |
| CVE-2022-4578 | video-conferencing-with-zoom (WordPress plugin) | The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputt | medium | 5.4 | 0% |
| CVE-2022-4624 | gs-logo-slider (WordPress plugin) | The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2022-4627 | shiftnav (WordPress plugin) | The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the | medium | 5.4 | 0% |
| CVE-2022-4629 | product-slider-for-woocommerce (WordPress plugin) | The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before output | medium | 5.4 | 0% |
| CVE-2022-4648 | real-testimonials (WordPress plugin) | The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 0% |
| CVE-2022-4655 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users | medium | 5.4 | 0% |
| CVE-2022-4658 | rssimport (WordPress plugin) | The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a ro | medium | 5.4 | 0% |
| CVE-2022-4668 | easy-appointments (WordPress plugin) | The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |