Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-4972 | download-monitor (WordPress plugin) | The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes | high | 7.5 | 0% |
| CVE-2026-52770 | yeswiki/yeswiki | YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters | high | 7.5 | 0% |
| CVE-2024-9519 | userplus (WordPress plugin) | The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabo | high | 7.2 | 0% |
| CVE-2024-9927 | woocommerce-order-proposal (WordPress plugin) | The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and inclu | high | 7.2 | 0% |
| CVE-2024-13236 | tainacan (WordPress plugin) | The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collection_id' parameter in all versions up to, and including, 0.2 | medium | 6.5 | 0% |
| CVE-2024-5940 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 6.5 | 0% |
| CVE-2023-5565 | shortcode-menu (WordPress plugin) | The Shortcode Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortmenu' shortcode in versions up to, and includ | medium | 6.4 | 0% |
| CVE-2024-13227 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | 0% |
| CVE-2024-3210 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 0% |
| CVE-2023-7015 | file-manager-pro (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and | medium | 6.1 | 0% |
| CVE-2024-1365 | yml-for-yandex-market (WordPress plugin) | The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the feed_id parameter in all versions up | medium | 6.1 | 0% |
| CVE-2024-1691 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO plugin for WordPress is vulnerable to Stored Cross-Site Scr | medium | 6.1 | 0% |
| CVE-2024-8716 | xt-woo-ajax-add-to-cart (WordPress plugin) | The XT Ajax Add To Cart for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg | medium | 6.1 | 0% |
| CVE-2022-36373 | mp3-jplayer (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-4795 | galleries-by-angie-makes (WordPress plugin) | The Galleries by Angie Makes WordPress plugin through 1.67 does not validate and escape some of its shortcode attributes before outputting t | medium | 5.4 | 0% |
| CVE-2023-0535 | donation-block-for-paypal (WordPress plugin) | The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting | medium | 5.4 | 0% |
| CVE-2024-13364 | adthrive-ads (WordPress plugin) | The Raptive Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the site_ads_files_reset() an | medium | 5.3 | 0% |
| CVE-2024-11710 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via t | medium | 4.9 | 0% |
| CVE-2024-11713 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via t | medium | 4.9 | 0% |
| CVE-2024-11714 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via t | medium | 4.9 | 0% |
| CVE-2023-3501 | formcraft (WordPress plugin) | The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2023-4060 | wp-adminify (WordPress plugin) | The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2023-4298 | 123.chat (WordPress plugin) | The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2024-11715 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access | medium | 4.8 | 0% |
| CVE-2023-2275 | wcfm-marketplace-rest-api (WordPress plugin) | The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data du | medium | 4.3 | 0% |
| CVE-2023-5385 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_c | medium | 4.3 | 0% |
| CVE-2023-5411 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2023-5417 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_u | medium | 4.3 | 0% |
| CVE-2023-5419 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | 0% |
| CVE-2024-10591 | makewebbetter-hubspot-for-woocommerce (WordPress plugin) | The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable | high | 8.8 | 0% |
| CVE-2022-4022 | svg-support (WordPress plugin) | The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are n | medium | 6.4 | 0% |
| CVE-2024-2603 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege | medium | 6.3 | 0% |
| CVE-2024-1136 | responsive-coming-soon (WordPress plugin) | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented U | medium | 5.3 | 0% |
| CVE-2026-2894 | funadmin/funadmin | funadmin exposes sensitive information via getMember function | medium | 5.3 | 0% |
| CVE-2023-0543 | arigato-autoresponder-and-newsletter (WordPress plugin) | The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allo | medium | 4.8 | 0% |
| CVE-2020-15249 | october/backend | Stored XSS by authenticated backend user with access to upload files | low | 2.8 | 0% |
| CVE-2026-52822 | kimai/kimai | Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation | medium | 0.0 | 0% |
| CVE-2026-52828 | kimai/kimai | Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access | medium | 0.0 | 0% |
| CVE-2022-1578 | my-wpdb (WordPress plugin) | The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin | high | 8.8 | 0% |
| CVE-2024-53860 | spencer14420/sp-php-email-handler | SPEmailHandler-PHP has Potential Abuse for Sending Arbitrary Emails | high | 8.6 | 0% |
| CVE-2022-4541 | nm-visitors (WordPress plugin) | The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, | high | 7.2 | 0% |
| CVE-2023-1172 | bookly-responsive-appointment-booking-tool (WordPress plugin) | The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 | high | 7.2 | 0% |
| CVE-2024-7301 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and | high | 7.2 | 0% |
| CVE-2026-38751 | devcode-it/openstamanager | OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality | high | 7.2 | 0% |
| CVE-2024-1295 | the-events-calendar (WordPress plugin) | The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at | medium | 6.5 | 0% |
| CVE-2023-5211 | fattura24 (WordPress plugin) | The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2022-40698 | quiz-and-survey-master (WordPress plugin) | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. | medium | 5.4 | 0% |
| CVE-2023-43884 | intelliants/subrion | Subrion CMS Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2023-6889 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2023-6890 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | medium | 5.4 | 0% |