Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-41887 | flarum/core | Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) | medium | 4.9 | 0% |
| CVE-2023-2225 | seo-alert (WordPress plugin) | The SEO ALert WordPress plugin through 1.59 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2023-2470 | add-to-feedly (WordPress plugin) | The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to | medium | 4.8 | 0% |
| CVE-2023-1756 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via HTML export | medium | 4.7 | 0% |
| CVE-2020-36740 | radio-buttons-for-taxonomies (WordPress plugin) | The Radio Buttons for Taxonomies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. T | medium | 4.3 | 0% |
| CVE-2019-14671 | grumpydictator/firefly-iii | Improper Input Validation in Firefly III | low | 3.3 | 0% |
| CVE-2024-13279 | drupal/tfa | This module enables you to allow and/or require users to use a second authentication method in addition to password auth | unknown | 0.0 | 0% |
| CVE-2025-48883 | chrome-php/chrome | Chrome PHP is missing encoding in `CssSelector` | medium | 0.0 | 0% |
| CVE-2026-25492 | craftcms/craft | Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host | medium | 0.0 | 0% |
| CVE-2026-32276 | opensource-workshop/connect-cms | Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin | high | 8.8 | 0% |
| CVE-2023-4196 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | high | 8.3 | 0% |
| CVE-2022-0141 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or | high | 8.1 | 0% |
| CVE-2023-6696 | popup-builder (WordPress plugin) | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of | high | 8.1 | 0% |
| CVE-2024-13890 | allow-php-execute (WordPress plugin) | The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to all | high | 7.2 | 0% |
| CVE-2024-8761 | share-this-image (WordPress plugin) | The Share This Image plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.03. This is due to insuffic | high | 7.2 | 0% |
| CVE-2026-39389 | ci4-cms-erp/ci4ms | CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files | medium | 6.7 | 0% |
| CVE-2021-4116 | yetiforce/yetiforce-crm | yetiforcecrm is vulnerable to Cross-site Scripting | medium | 6.6 | 0% |
| CVE-2024-2122 | foogallery (WordPress plugin) | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom UR | medium | 6.4 | 0% |
| CVE-2023-5325 | woocommerce-vietnam-checkout (WordPress plugin) | The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading | medium | 6.1 | 0% |
| CVE-2023-5750 | embedpress (WordPress plugin) | The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a spe | medium | 6.1 | 0% |
| CVE-2023-5951 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 0% |
| CVE-2024-0665 | customer-area (WordPress plugin) | The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and | medium | 6.1 | 0% |
| CVE-2024-8662 | koko-analytics (WordPress plugin) | The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate | medium | 6.1 | 0% |
| CVE-2024-8738 | seriously-simple-stats (WordPress plugin) | The Seriously Simple Stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appr | medium | 6.1 | 0% |
| CVE-2021-36788 | yoast-seo-for-typo3/yoast_seo | Cross-site Scripting in the yoast_seo TYPO3 extension | medium | 5.4 | 0% |
| CVE-2022-4622 | login-logout-menu (WordPress plugin) | The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2022-4654 | pricing-tables (WordPress plugin) | The Pricing Tables WordPress Plugin WordPress plugin before 3.2.3 does not validate and escape one of its shortcode attributes, which could | medium | 5.4 | 0% |
| CVE-2022-4661 | widgets-for-woocommerce-products-on-elementor (WordPress plugin) | The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attribute | medium | 5.4 | 0% |
| CVE-2022-4666 | markup-\(json-ld\)-structured-in-schema.org (WordPress plugin) | The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes b | medium | 5.4 | 0% |
| CVE-2022-4671 | pixcodes (WordPress plugin) | The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the | medium | 5.4 | 0% |
| CVE-2022-4749 | posts-list-designer (WordPress plugin) | The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputt | medium | 5.4 | 0% |
| CVE-2022-4750 | wp-responsive-testimonials-slider-and-widget (WordPress plugin) | The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes | medium | 5.4 | 0% |
| CVE-2022-4752 | opening-hours (WordPress plugin) | The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2022-4754 | easy-social-box (WordPress plugin) | The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before output | medium | 5.4 | 0% |
| CVE-2022-4763 | icon-widget (WordPress plugin) | The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in t | medium | 5.4 | 0% |
| CVE-2022-4777 | bootstrap-shortcodes (WordPress plugin) | The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2022-4781 | accordion-shortcodes (WordPress plugin) | The Accordion Shortcodes WordPress plugin through 2.4.2 does not validate and escape one of its shortcode attributes, which could allow user | medium | 5.4 | 0% |
| CVE-2022-4784 | hueman-addons (WordPress plugin) | The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2022-4785 | video-sidebar-widgets (WordPress plugin) | The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2022-4786 | video.js (WordPress plugin) | The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2022-4791 | product-slider-and-carousel-with-category-with-woocommerce (WordPress plugin) | The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode | medium | 5.4 | 0% |
| CVE-2022-4827 | wp-tiles (WordPress plugin) | The WP Tiles WordPress plugin through 1.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2022-4835 | social-sharing-toolkit (WordPress plugin) | The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2023-0033 | pdf-viewer (WordPress plugin) | The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a ro | medium | 5.4 | 0% |
| CVE-2023-0059 | youzify (WordPress plugin) | The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a pag | medium | 5.4 | 0% |
| CVE-2023-0063 | wordpress-shortcodes (WordPress plugin) | The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting the | medium | 5.4 | 0% |
| CVE-2023-0064 | evision-responsive-column-layout-shortcodes (WordPress plugin) | The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes b | medium | 5.4 | 0% |
| CVE-2023-0065 | i2-pros-\&-cons (WordPress plugin) | The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2023-0067 | timed-content (WordPress plugin) | The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2023-0068 | product-gtin-\(ean\,-upc\,-isbn\)-for-woocommerce (WordPress plugin) | The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attribut | medium | 5.4 | 0% |