Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4673 | rate-my-post (WordPress plugin) | The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a | medium | 5.4 | 0% |
| CVE-2022-4675 | mongoose-page-plugin (WordPress plugin) | The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users | medium | 5.4 | 0% |
| CVE-2022-4706 | genesis-columns-advanced (WordPress plugin) | The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting t | medium | 5.4 | 0% |
| CVE-2022-4715 | structured-content (WordPress plugin) | The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2022-4716 | wp-popups (WordPress plugin) | The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in t | medium | 5.4 | 0% |
| CVE-2022-4718 | landing-page-builder (WordPress plugin) | The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting the | medium | 5.4 | 0% |
| CVE-2022-4751 | word-balloon (WordPress plugin) | The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2022-4753 | print-o-matic (WordPress plugin) | The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2022-4758 | map-builder-for-google-maps (WordPress plugin) | The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2022-4760 | oneclick-chat-to-order (WordPress plugin) | The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting t | medium | 5.4 | 0% |
| CVE-2022-4775 | geodirectory (WordPress plugin) | The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2022-4789 | wpzoom-portfolio (WordPress plugin) | The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users wit | medium | 5.4 | 0% |
| CVE-2022-4790 | auto-publish-for-google-my-business (WordPress plugin) | The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could | medium | 5.4 | 0% |
| CVE-2022-4832 | store-locator (WordPress plugin) | The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2023-1761 | thorsten/phpmyfaq | phpMyFAQ Code Injection vulnerability | medium | 5.4 | 0% |
| CVE-2023-1875 | thorsten/phpmyfaq | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | 0% |
| CVE-2023-23937 | pimcore/pimcore | Pimcore contains Unrestricted Upload of File with Dangerous Type | medium | 5.4 | 0% |
| CVE-2024-9189 | eu-vat-for-woocommerce (WordPress plugin) | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch | medium | 5.3 | 0% |
| CVE-2019-25218 | wp-responsive-photo-gallery (WordPress plugin) | The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versio | medium | 4.9 | 0% |
| CVE-2022-2885 | yetiforce/yetiforce-crm | Cross site scripting in yetiforce/yetiforce-crm | medium | 4.8 | 0% |
| CVE-2020-36738 | cool-timeline (WordPress plugin) | The Cool Timeline (Horizontal & Vertical Timeline) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 0% |
| CVE-2020-36739 | feed-them-social (WordPress plugin) | The Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions u | medium | 4.3 | 0% |
| CVE-2020-36751 | coupon-creator (WordPress plugin) | The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to mi | medium | 4.3 | 0% |
| CVE-2020-36753 | hueman (WordPress theme) | The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing o | medium | 4.3 | 0% |
| CVE-2020-36754 | paid-memberships-pro (WordPress plugin) | The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.2. This is | medium | 4.3 | 0% |
| CVE-2020-36755 | customizr (WordPress theme) | The Customizr theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.0. This is due to missin | medium | 4.3 | 0% |
| CVE-2020-36758 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This | medium | 4.3 | 0% |
| CVE-2020-36759 | insert-php (WordPress plugin) | The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is du | medium | 4.3 | 0% |
| CVE-2021-4391 | woo-gift-cards-lite (WordPress plugin) | The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2 | medium | 4.3 | 0% |
| CVE-2021-4392 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 0% |
| CVE-2021-4393 | ecommerce-product-catalog (WordPress plugin) | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i | medium | 4.3 | 0% |
| CVE-2021-4418 | custom-css-js-php (WordPress plugin) | The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is d | medium | 4.3 | 0% |
| CVE-2022-36422 | wp-postratings (WordPress plugin) | Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress. | medium | 4.3 | 0% |
| CVE-2023-5387 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2023-5415 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2023-5416 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_d | medium | 4.3 | 0% |
| CVE-2026-1196 | mineadmin/mineadmin | MineAdmin May Expose Sensitive Information to an Unauthorized Actor | low | 3.1 | 0% |
| CVE-2026-32271 | craftcms/commerce | Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget | high | 0.0 | 0% |
| CVE-2026-80196 | kimai/kimai | Kimai Password Reset Link Remains Valid After Password Change | low | 0.0 | 0% |
| CVE-2026-45697 | verbb/formie | Formie: Pre-authenticated server-side template injection in Hidden fields | critical | 9.8 | 0% |
| CVE-2025-31481 | api-platform/core, api-platform/graphql | GraphQL query operations security can be bypassed | high | 7.5 | 0% |
| CVE-2021-3730 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 6.5 | 0% |
| CVE-2024-3489 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Countdown Expired Title in a | medium | 6.4 | 0% |
| CVE-2024-0251 | advanced-woo-search (WordPress plugin) | The Advanced Woo Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search parameter in all versions up to, | medium | 6.1 | 0% |
| CVE-2024-5729 | simple-al-slider (WordPress plugin) | The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 0% |
| CVE-2023-2103 | alextselegidis/easyappointments | alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting | medium | 5.4 | 0% |
| CVE-2024-5728 | animated-al-list (WordPress plugin) | The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 5.4 | 0% |
| CVE-2022-2658 | wpspellcheck (WordPress plugin) | The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perfo | medium | 4.8 | 0% |
| CVE-2022-3811 | eu-cookie-law (WordPress plugin) | The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high pri | medium | 4.8 | 0% |
| CVE-2022-4196 | multi-step-form (WordPress plugin) | The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege use | medium | 4.8 | 0% |