Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-0073 | client-logo-carousel (WordPress plugin) | The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2023-0097 | smart-post-show (WordPress plugin) | The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options be | medium | 5.4 | 0% |
| CVE-2023-0145 | world-clock (WordPress plugin) | The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2023-0165 | cost-calculator (WordPress plugin) | The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 0% |
| CVE-2023-0172 | juicer (WordPress plugin) | The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/ | medium | 5.4 | 0% |
| CVE-2023-0175 | smart-logo-showcase-lite (WordPress plugin) | The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes | medium | 5.4 | 0% |
| CVE-2023-0212 | advanced-recent-posts (WordPress plugin) | The Advanced Recent Posts WordPress plugin through 0.6.14 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2023-0271 | wp-font-awesome (WordPress plugin) | The WP Font Awesome WordPress plugin before 1.7.9 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2023-0276 | weaver-xtreme-theme-support (WordPress plugin) | The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputtin | medium | 5.4 | 0% |
| CVE-2023-0364 | real.kit (WordPress plugin) | The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a pa | medium | 5.4 | 0% |
| CVE-2023-0365 | react-webcam (WordPress plugin) | The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2023-0370 | wpb-advanced-faq (WordPress plugin) | The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 0% |
| CVE-2023-0399 | image-over-image-for-wpbakery-page-builder (WordPress plugin) | The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes bef | medium | 5.4 | 0% |
| CVE-2023-1110 | yellow-yard-searchbar (WordPress plugin) | The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting the | medium | 5.4 | 0% |
| CVE-2023-4289 | wp-matterport-shortcode (WordPress plugin) | The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2023-4783 | magee-shortcodes (WordPress plugin) | The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them bac | medium | 5.4 | 0% |
| CVE-2023-4795 | testimonial-slider-shortcode (WordPress plugin) | The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputti | medium | 5.4 | 0% |
| CVE-2023-4805 | tutor-lms (WordPress plugin) | The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to | medium | 5.4 | 0% |
| CVE-2023-4820 | powerpress (WordPress plugin) | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which | medium | 5.4 | 0% |
| CVE-2024-1095 | control-block-patterns (WordPress plugin) | The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a mi | medium | 5.3 | 0% |
| CVE-2024-1122 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of da | medium | 5.3 | 0% |
| CVE-2024-11712 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access | medium | 5.3 | 0% |
| CVE-2022-0328 | simple-membership (WordPress plugin) | The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to m | medium | 4.7 | 0% |
| CVE-2021-24913 | logo-showcase-with-slick-slider (WordPress plugin) | The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, al | medium | 4.3 | 0% |
| CVE-2022-0199 | coming-soon-and-maintenance-mode (WordPress plugin) | The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowi | medium | 4.3 | 0% |
| CVE-2022-0313 | float-menu (WordPress plugin) | The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a log | medium | 4.3 | 0% |
| CVE-2023-5314 | wp-extra (WordPress plugin) | The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2024-50342 | symfony/http-client, symfony/symfony | Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient | low | 3.1 | 0% |
| CVE-2022-47406 | derhansen/fe_change_pwd, typo3/cms | TYPO3 vulnerable to Insufficient Session Expiration | critical | 9.8 | 0% |
| CVE-2024-1962 | cm-download-manager (WordPress plugin) | The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged | high | 8.8 | 0% |
| CVE-2024-13800 | convertplus (WordPress plugin) | The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missin | high | 8.1 | 0% |
| CVE-2024-3710 | image-photo-gallery-final-tiles-grid (WordPress plugin) | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before | medium | 6.8 | 0% |
| CVE-2024-1448 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode( | medium | 6.4 | 0% |
| CVE-2023-44379 | baserproject/basercms | baserCMS Cross-site Scripting vulnerability in Site search Feature | medium | 6.1 | 0% |
| CVE-2026-59944 | composer/composer | Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path | medium | 6.1 | 0% |
| CVE-2024-1905 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 5.9 | 0% |
| CVE-2022-4783 | youtube-channel-gallery (WordPress plugin) | The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting the | medium | 5.4 | 0% |
| CVE-2024-34358 | typo3/cms-core | TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController | medium | 5.3 | 0% |
| CVE-2023-0422 | article-directory (WordPress plugin) | The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the a | medium | 4.8 | 0% |
| CVE-2023-0429 | watu-quiz (WordPress plugin) | The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2023-0605 | auto-rename-media-on-upload (WordPress plugin) | The Auto Rename Media On Upload WordPress plugin before 1.1.0 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2023-1554 | quick-paypal-payments (WordPress plugin) | The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | 0% |
| CVE-2023-2113 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privi | medium | 4.8 | 0% |
| CVE-2023-2578 | buy-me-a-coffee (WordPress plugin) | The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2023-2580 | ai-engine (WordPress plugin) | The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such | medium | 4.8 | 0% |
| CVE-2023-2600 | custom-base-terms (WordPress plugin) | The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege user | medium | 4.8 | 0% |
| CVE-2023-2742 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perfo | medium | 4.8 | 0% |
| CVE-2023-2802 | ultimate-addons-for-contact-form-7 (WordPress plugin) | The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow h | medium | 4.8 | 0% |
| CVE-2023-2812 | ultimate-dashboard (WordPress plugin) | The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2023-3499 | robo-gallery (WordPress plugin) | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, whi | medium | 4.8 | 0% |