Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-55878 | shuchkin/simplexlsx | Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx | medium | 6.8 | 0% |
| CVE-2026-32639 | winter/wn-cms-module | Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads | medium | 6.8 | 0% |
| CVE-2024-2665 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button in all versions u | medium | 6.4 | 0% |
| CVE-2020-12462 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS. | medium | 6.1 | 0% |
| CVE-2024-1978 | friends (WordPress plugin) | The Friends plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.5 via the discover_a | medium | 5.5 | 0% |
| CVE-2023-4646 | simple-posts-ticker (WordPress plugin) | The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 0% |
| CVE-2023-4798 | user-avatar-reloaded (WordPress plugin) | The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow | medium | 5.4 | 0% |
| CVE-2023-4811 | wordpress-file-upload (WordPress plugin) | The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege | medium | 5.4 | 0% |
| CVE-2023-5167 | user-activity-log (WordPress plugin) | The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, w | medium | 5.4 | 0% |
| CVE-2024-38276 | moodle/moodle | Moodle CSRF risks due to misuse of confirm_sesskey | medium | 5.4 | 0% |
| CVE-2023-4040 | stripe-payment-plugin-for-woocommerce (WordPress plugin) | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | medium | 5.3 | 0% |
| CVE-2024-12410 | front-end-only-users (WordPress plugin) | The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and inclu | medium | 4.9 | 0% |
| CVE-2024-41800 | craftcms/cms | Craft CMS Allows TOTP Token To Stay Valid After Use | medium | 4.8 | 0% |
| CVE-2015-10113 | wooframework-tweaks (WordPress plugin) | A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability i | low | 3.5 | 0% |
| CVE-2024-13285 | drupal/wkhtmltopdf | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-52837 | alextselegidis/easyappointments | Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page | medium | 0.0 | 0% |
| CVE-2026-69089 | getgrav/grav | Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images | high | 0.0 | 0% |
| CVE-2024-52431 | wordpress-video-robot (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressaholic WordPress Video Robot - Th | critical | 9.3 | 0% |
| CVE-2026-27198 | getformwork/formwork | Formwork Improperly Managed Privileges in User creation | high | 8.8 | 0% |
| CVE-2023-25453 | wordpress-tables (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ian Sadovy WordPress Tables plugin <= 1.3.9 versions. | high | 7.1 | 0% |
| CVE-2023-0588 | zoho-crm-client-portal (WordPress plugin) | The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back | medium | 6.1 | 0% |
| CVE-2023-0899 | wp-live-chat-shoutbox (WordPress plugin) | The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the S | medium | 6.1 | 0% |
| CVE-2023-0983 | stylish-cost-calculator (WordPress plugin) | The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the | medium | 6.1 | 0% |
| CVE-2023-1373 | w4-post-list (WordPress plugin) | The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Si | medium | 6.1 | 0% |
| CVE-2023-1377 | solidres (WordPress plugin) | The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to | medium | 6.1 | 0% |
| CVE-2023-1413 | wp-vr (WordPress plugin) | The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a R | medium | 6.1 | 0% |
| CVE-2023-1435 | ajax-search (WordPress plugin) | The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, lea | medium | 6.1 | 0% |
| CVE-2023-1465 | wp-easypay (WordPress plugin) | The WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, leading to Reflected Cr | medium | 6.1 | 0% |
| CVE-2023-1473 | slider\,-gallery\,-and-carousel (WordPress plugin) | The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back i | medium | 6.1 | 0% |
| CVE-2023-1805 | product-catalog-feed (WordPress plugin) | The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it | medium | 6.1 | 0% |
| CVE-2023-2320 | cf7-google-sheets-connector (WordPress plugin) | The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escap | medium | 6.1 | 0% |
| CVE-2023-2321 | wpforms-google-sheet-connector (WordPress plugin) | The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape | medium | 6.1 | 0% |
| CVE-2023-2324 | elementor-forms-google-sheet-connector (WordPress plugin) | The Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro WordPress plugin through 1 | medium | 6.1 | 0% |
| CVE-2023-2337 | convertkit---email-marketing\,-email-newsletter-and-landing-pages (WordPress plugin) | The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected C | medium | 6.1 | 0% |
| CVE-2023-2362 | bubble-menu (WordPress plugin), button-generator (WordPress plugin), calculator-builder (WordPress plugin) +9 more | The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Cal | medium | 6.1 | 0% |
| CVE-2023-2503 | 10web-social-post-feed (WordPress plugin) | The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, le | medium | 6.1 | 0% |
| CVE-2023-2568 | photo-gallery (WordPress plugin) | The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to R | medium | 6.1 | 0% |
| CVE-2023-2572 | survey-maker (WordPress plugin) | The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflect | medium | 6.1 | 0% |
| CVE-2023-2705 | gappointments (WordPress plugin) | The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2023-3041 | automatic-conversation (WordPress plugin) | The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the | medium | 6.1 | 0% |
| CVE-2023-3292 | portfolio-gallery\,-product-catalog---grid-kit-portfolio (WordPress plugin) | The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attri | medium | 6.1 | 0% |
| CVE-2023-3671 | multiparcels-shipping-for-woocommerce (WordPress plugin) | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting i | medium | 6.1 | 0% |
| CVE-2023-3954 | multiparcels-shipping-for-woocommerce (WordPress plugin) | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back | medium | 6.1 | 0% |
| CVE-2023-4270 | min-max-control (WordPress plugin) | The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a | medium | 6.1 | 0% |
| CVE-2021-24166 | ninja-forms (WordPress plugin) | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4 | medium | 5.4 | 0% |
| CVE-2024-1958 | wpb-show-core (WordPress plugin) | The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 4.8 | 0% |
| CVE-2020-36735 | erp (WordPress plugin) | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross | medium | 4.3 | 0% |
| CVE-2020-36736 | cartflows (WordPress plugin) | The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, a | medium | 4.3 | 0% |
| CVE-2020-36737 | astra-import-export (WordPress plugin) | The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1 | medium | 4.3 | 0% |
| CVE-2022-4931 | backupwordpress (WordPress plugin) | The BackupWordPress plugin for WordPress is vulnerable to information disclosure in versions up to, and including 3.12. This is due to missi | medium | 4.3 | 0% |