Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2562 | gallery-metabox (WordPress plugin) | The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox func | medium | 4.3 | 0% |
| CVE-2023-6120 | usc-e-shop (WordPress plugin) | The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_ | medium | 4.1 | 0% |
| CVE-2022-48366 | ezsystems/ezplatform-kernel, ezsystems/ezpublish-kernel | Timing attack in eZ Platform Ibexa | low | 3.7 | 0% |
| CVE-2015-10127 | pluscaptcha (WordPress plugin) | A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unkno | low | 3.5 | 0% |
| CVE-2021-27913 | mautic/core | Use of a Broken or Risky Cryptographic Algorithm | low | 3.5 | 0% |
| CVE-2026-45073 | symfony/cache, symfony/symfony | Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix | medium | 0.0 | 0% |
| CVE-2026-85400 | typo3/cms-lowlevel | TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands | unknown | 0.0 | 0% |
| CVE-2024-3200 | wpforo-forum (WordPress plugin) | The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode in all versions up t | critical | 9.9 | 0% |
| CVE-2024-4743 | lifterlms (WordPress plugin) | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lift | high | 8.8 | 0% |
| CVE-2024-10028 | everest-backup (WordPress plugin) | The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information | high | 7.5 | 0% |
| CVE-2026-49287 | statamic/cms | Statamic CMS's unsafe method invocation via collection sorting allows data destruction | high | 7.4 | 0% |
| CVE-2023-7231 | illi-link-party\! (WordPress plugin) | The illi Link Party! WordPress plugin through 1.0 lacks proper access controls, allowing unauthenticated visitors to delete links. | high | 7.3 | 0% |
| CVE-2026-48009 | shopware/core, shopware/platform | Shopware: Admin Account Takeover via User Recovery Hash Exposure | medium | 6.8 | 0% |
| CVE-2026-24420 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) | medium | 6.5 | 0% |
| CVE-2024-34067 | pterodactyl/panel | Pterodactyl panel's admin area vulnerable to Cross-site Scripting | medium | 6.1 | 0% |
| CVE-2025-5062 | woocommerce (WordPress plugin) | The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions | medium | 6.1 | 0% |
| CVE-2022-4714 | wp-dark-mode (WordPress plugin) | The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a | medium | 5.4 | 0% |
| CVE-2023-0285 | real-media-library (WordPress plugin) | The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with t | medium | 5.4 | 0% |
| CVE-2023-0371 | embedsocial (WordPress plugin) | The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2023-0372 | embedstories (WordPress plugin) | The EmbedStories WordPress plugin before 0.7.5 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2023-0380 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them bac | medium | 5.4 | 0% |
| CVE-2023-0492 | gs-products-slider (WordPress plugin) | The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before ou | medium | 5.4 | 0% |
| CVE-2023-0540 | gs-filterable-portfolio (WordPress plugin) | The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2023-0559 | gs-portfolio-for-envato (WordPress plugin) | The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | 0% |
| CVE-2023-0823 | cookie-notice-\&-compliance-for-gdpr-\/-ccpa (WordPress plugin) | The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes b | medium | 5.4 | 0% |
| CVE-2023-1703 | pimcore/pimcore | pimcore is vulnerable to cross-site scripting in Composite indices key field | medium | 5.4 | 0% |
| CVE-2024-0820 | jobs-for-wordpress (WordPress plugin) | The Jobs for WordPress plugin before 2.7.4 does not sanitise and escape some parameters, which could allow users with a role as low as contr | medium | 5.4 | 0% |
| CVE-2024-5541 | ibtana-visual-editor (WordPress plugin) | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.3 | 0% |
| CVE-2023-37785 | impresscms/impresscms | ImpressCMS Cross-site Scripting vulnerability | medium | 4.8 | 0% |
| CVE-2024-9878 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin setti | medium | 4.4 | 0% |
| CVE-2024-0766 | envo-elementor-for-woocommerce (WordPress plugin) | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi | medium | 4.3 | 0% |
| CVE-2023-6250 | like-\&-share (WordPress plugin) | The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a | high | 7.5 | 0% |
| CVE-2025-47940 | typo3/cms-core | TYPO3 Allows Privilege Escalation to System Maintainer | high | 7.2 | 0% |
| CVE-2020-13674 | drupal/core | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under som | medium | 6.5 | 0% |
| CVE-2024-11179 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' par | medium | 6.5 | 0% |
| CVE-2024-13680 | cp-easy-form-builder (WordPress plugin) | The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortc | medium | 6.5 | 0% |
| CVE-2024-34899 | wwbn/avideo | AVideo cross-site scripting vulnerability in the view/about.php page | medium | 6.1 | 0% |
| CVE-2024-4924 | sassy-social-share (WordPress plugin) | The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privileg | medium | 6.1 | 0% |
| CVE-2024-1172 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 5.4 | 0% |
| CVE-2023-6496 | manage-notification-emails (WordPress plugin) | The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via | medium | 5.3 | 0% |
| CVE-2023-7233 | gigpress (WordPress plugin) | The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2020-36534 | noumo/easyii | Cross-Site Request Forgery in easyii CMS | medium | 4.3 | 0% |
| CVE-2024-1319 | event-tickets (WordPress plugin) | The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees l | medium | 4.3 | 0% |
| CVE-2025-8151 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 | medium | 4.3 | 0% |
| CVE-2026-2895 | funadmin/funadmin | funadmin has Weak Password Recovery Mechanism for Forgotten Password | low | 3.7 | 0% |
| CVE-2026-42550 | flightphp/core | Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete | high | 8.8 | 0% |
| CVE-2025-14844 | restrict-content (WordPress plugin) | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, | high | 8.2 | 0% |
| CVE-2020-13241 | microweber/microweber | Microweber allows Unrestricted File Upload | high | 7.8 | 0% |
| CVE-2023-0564 | froxlor/froxlor | Froxlor contains Weak Password Requirements | high | 7.5 | 0% |
| CVE-2026-39850 | yiisoft/yii2 | Yii 2: Local file inclusion via view parameter name collision | high | 7.4 | 0% |