Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2102 | salon-booking-system (WordPress plugin) | The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' param | medium | 4.7 | 0% |
| CVE-2020-36746 | menu-swapper (WordPress plugin) | The Menu Swapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0.2. This is due to | medium | 4.3 | 0% |
| CVE-2020-36747 | sidebar-manager (WordPress plugin) | The Lightweight Sidebar Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. Th | medium | 4.3 | 0% |
| CVE-2020-36748 | dokan-lite (WordPress plugin) | The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing o | medium | 4.3 | 0% |
| CVE-2020-36749 | easy-testimonials (WordPress plugin) | The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due | medium | 4.3 | 0% |
| CVE-2021-4389 | wp-travel (WordPress plugin) | The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missi | medium | 4.3 | 0% |
| CVE-2021-4390 | contact-form-7-style (WordPress plugin) | The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due | medium | 4.3 | 0% |
| CVE-2021-4394 | locations (WordPress plugin) | The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missi | medium | 4.3 | 0% |
| CVE-2015-10128 | royal-prettyphoto (WordPress plugin) | A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the funct | low | 3.5 | 0% |
| CVE-2026-27129 | craftcms/cms | Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution | medium | 0.0 | 0% |
| CVE-2026-55791 | craftcms/cms | Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs | critical | 0.0 | 0% |
| CVE-2026-35035 | ci4-cms-erp/ci4ms | CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via Syst | critical | 9.1 | 0% |
| CVE-2021-4373 | better-search (WordPress plugin) | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it po | high | 8.8 | 0% |
| CVE-2025-1022 | spatie/browsershot | Browsershot Path Traversal | high | 8.2 | 0% |
| CVE-2026-42609 | getgrav/grav | Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic | high | 8.1 | 0% |
| CVE-2025-67853 | moodle/moodle | Moodle Affected by Improper Restriction of Excessive Authentication Attempts | high | 7.5 | 0% |
| CVE-2026-31317 | markhuot/craftql | Craftql vulnerable to Server-Side Request Forgery | high | 7.5 | 0% |
| CVE-2024-34004 | moodle/moodle | Moodle Authenticated LFI risk in some misconfigured shared hosting environments | medium | 6.5 | 0% |
| CVE-2025-68113 | altcha-org/altcha | ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay | medium | 6.5 | 0% |
| CVE-2023-5661 | add-facebook (WordPress plugin) | The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up | medium | 6.4 | 0% |
| CVE-2024-0506 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $ | medium | 6.4 | 0% |
| CVE-2024-1277 | ocean-extra (WordPress plugin) | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up to, and including, 2. | medium | 6.4 | 0% |
| CVE-2024-8515 | themesflat-addons-for-elementor (WordPress plugin) | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like 'TF E Slider | medium | 6.4 | 0% |
| CVE-2024-9170 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wcj_product_meta shortcode in | medium | 5.5 | 0% |
| CVE-2024-13794 | hide-my-wp (WordPress plugin) | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and | medium | 5.3 | 0% |
| CVE-2022-41643 | accessibility (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress. | medium | 4.8 | 0% |
| CVE-2024-37160 | getformwork/formwork | Cross-site scripting (XSS) vulnerability in Description metadata | medium | 4.8 | 0% |
| CVE-2024-56361 | tltneon/lgsl | lgsl Stored Cross-Site Scripting vulnerability | high | 0.0 | 0% |
| CVE-2026-108357 | phpoffice/phpspreadsheet | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | high | 0.0 | 0% |
| CVE-2026-29174 | craftcms/commerce | Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting | high | 0.0 | 0% |
| CVE-2023-3302 | admidio/admidio | Admidio Improper Neutralization of Formula Elements in a CSV File vulnerability | high | 7.3 | 0% |
| CVE-2023-3080 | wp-mail-catcher (WordPress plugin) | The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, | high | 7.2 | 0% |
| CVE-2023-3088 | wp-mail-log (WordPress plugin) | The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 | high | 7.2 | 0% |
| CVE-2023-3093 | yaysmtp (WordPress plugin) | The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due | high | 7.2 | 0% |
| CVE-2023-3122 | gd-mail-queue (WordPress plugin) | The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9 | high | 7.2 | 0% |
| CVE-2023-3135 | mailtree-log-mail (WordPress plugin) | The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and includin | high | 7.2 | 0% |
| CVE-2023-3136 | mailarchiver (WordPress plugin) | The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2. | high | 7.2 | 0% |
| CVE-2023-3166 | lana-email-logger (WordPress plugin) | The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and includin | high | 7.2 | 0% |
| CVE-2023-3168 | wp-reroute-email (WordPress plugin) | The WP Reroute Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including | high | 7.2 | 0% |
| CVE-2026-23626 | kimai/kimai | Kimai has an Authenticated Server-Side Template Injection (SSTI) | medium | 6.8 | 0% |
| CVE-2024-3553 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missin | medium | 6.5 | 0% |
| CVE-2024-2117 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-6848 | post-and-page-builder (WordPress plugin) | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via fi | medium | 6.4 | 0% |
| CVE-2024-0905 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, lea | medium | 6.3 | 0% |
| CVE-2024-8714 | slicewp (WordPress plugin) | The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of | medium | 6.1 | 0% |
| CVE-2024-9204 | 404page (WordPress plugin) | The Smart Custom 404 Error Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in all vers | medium | 6.1 | 0% |
| CVE-2023-0233 | activecampaign (WordPress plugin) | The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a pa | medium | 5.4 | 0% |
| CVE-2023-0395 | menu-shortcode (WordPress plugin) | The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page | medium | 5.4 | 0% |
| CVE-2023-0490 | f\(x\)-toc (WordPress plugin) | The f(x) TOC WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2023-1019 | help-desk-wp (WordPress plugin) | The Help Desk WP WordPress plugin through 1.2.0 does not sanitise and escape some parameters, which could allow users with a role as low as | medium | 5.4 | 0% |