Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4199 | link-library (WordPress plugin) | The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2022-4299 | metricool (WordPress plugin) | The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2022-4330 | wp-attachments (WordPress plugin) | The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2022-4442 | custom-post-types-and-custom-fields-creator (WordPress plugin) | The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could | medium | 4.8 | 0% |
| CVE-2023-4376 | serial-codes-generator-and-validator-with-woocommerce-support (WordPress plugin) | The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its se | medium | 4.8 | 0% |
| CVE-2023-4390 | popup-box (WordPress plugin) | The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as a | medium | 4.8 | 0% |
| CVE-2023-5229 | e2pdf (WordPress plugin) | The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perfo | medium | 4.8 | 0% |
| CVE-2023-1879 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via updatecategory parameter | medium | 4.7 | 0% |
| CVE-2021-44111 | s-cart/s-cart | Path Traversal in S-Cart | medium | 4.4 | 0% |
| CVE-2025-2123 | geshi/geshi | GeSHi XSS possible in the get_var function of /contrib/cssgen.php | low | 3.5 | 0% |
| CVE-2025-8573 | concrete5/concrete5 | Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page | low | 0.0 | 0% |
| CVE-2026-47345 | typo3/html-sanitizer | TYPO3 HTML Sanitizer allows Cross-site Scripting | medium | 0.0 | 0% |
| CVE-2026-59931 | phpoffice/phpspreadsheet | PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist | high | 7.7 | 0% |
| CVE-2020-36947 | librenms/librenms | LibreNMS contains an authenticated SQL Injection vulnerability | high | 7.1 | 0% |
| CVE-2021-31779 | yoast-seo-for-typo3/yoast_seo | Server-Side Request Forgery in yoast_seo | medium | 6.4 | 0% |
| CVE-2024-1409 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2024-13638 | order-attachments-for-woocommerce (WordPress plugin) | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ | medium | 5.9 | 0% |
| CVE-2024-2107 | blossom-spa (WordPress theme) | The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.3 via generate | medium | 5.8 | 0% |
| CVE-2021-24133 | activecampaign (WordPress plugin) | Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make | medium | 4.3 | 0% |
| CVE-2021-24251 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request For | medium | 4.3 | 0% |
| CVE-2024-13264 | drupal/opigno_module | The Opigno module is related to Opigno LMS distribution. It implements the module entity, that is a sub-part of a traini | unknown | 0.0 | 0% |
| CVE-2026-112069 | causal/fal-protect | TYPO3-EXT-SA-2026-028: Broken Access Control in extension "FAL Protect" (fal_protect) | unknown | 0.0 | 0% |
| CVE-2024-8700 | event-calendar (WordPress plugin) | The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to dele | high | 7.5 | 0% |
| CVE-2020-18151 | thinkcmf/thinkcmf | ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability | medium | 6.5 | 0% |
| CVE-2024-6170 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | medium | 6.4 | 0% |
| CVE-2023-2427 | thorsten/phpmyfaq | Cross Site Scripting in thorsten/phpmyfaq | medium | 6.1 | 0% |
| CVE-2024-34500 | samwilson/unlinked-wikibase | MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2024-13641 | woo-refund-and-exchange-lite (WordPress plugin) | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPre | medium | 5.9 | 0% |
| CVE-2022-2839 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing | medium | 5.4 | 0% |
| CVE-2023-0389 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high pr | medium | 4.8 | 0% |
| CVE-2023-1759 | thorsten/phpmyfaq | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 4.8 | 0% |
| CVE-2023-3647 | iurny (WordPress plugin) | The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2023-4858 | simple-table-manager (WordPress plugin) | The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2024-0662 | fancybox-for-wordpress (WordPress plugin) | The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 d | medium | 4.4 | 0% |
| CVE-2024-12581 | gutenberg-blocks-with-ai (WordPress plugin) | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adm | medium | 4.4 | 0% |
| CVE-2025-68437 | craftcms/cms | Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation | medium | 0.0 | 0% |
| CVE-2026-46638 | twig/twig | Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) | medium | 0.0 | 0% |
| CVE-2022-4021 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This | high | 8.8 | 0% |
| CVE-2026-49283 | simplesamlphp/saml2, simplesamlphp/saml2-legacy | SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass | high | 8.7 | 0% |
| CVE-2024-13321 | analyticswp (WordPress plugin) | The AnalyticsWP plugin for WordPress is vulnerable to SQL Injection via the 'custom_sql' parameter in all versions up to, and including, 2.0 | high | 7.5 | 0% |
| CVE-2024-13491 | small-package-quotes-fedex-edition (WordPress plugin) | The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_i | high | 7.5 | 0% |
| CVE-2024-13534 | small-package-quotes-wwe-edition (WordPress plugin) | The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edi | high | 7.5 | 0% |
| CVE-2025-2055 | mappress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which cou | medium | 6.8 | 0% |
| CVE-2022-2777 | microweber/microweber | Microweber's title parameter in the body of POST request vulnerable to stored XSS | medium | 6.6 | 0% |
| CVE-2026-48008 | shopware/core, shopware/platform | Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass | medium | 6.5 | 0% |
| CVE-2026-48010 | shopware/core, shopware/platform | Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts | medium | 6.5 | 0% |
| CVE-2024-3637 | contact-form-\&-lead-form-elementor-builder (WordPress plugin) | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its setting | medium | 6.1 | 0% |
| CVE-2022-4231 | tribalsystems/zenario | Tribal Systems Zenario CMS vulnerable to Session Fixation | medium | 5.4 | 0% |
| CVE-2023-0323 | pimcore/pimcore | pimcore is vulnerable to cross-site scripting via "title field " in data objects | medium | 5.4 | 0% |
| CVE-2023-2354 | chp-ads-block-detector (WordPress plugin) | The CHP Ads Block Detector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings reachable though an AJAX act | medium | 4.9 | 0% |