Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-3649 | lightbox (WordPress plugin) | The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with | medium | 6.8 | 0% |
| CVE-2023-5048 | contact-form-builder (WordPress plugin) | The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versi | medium | 6.4 | 0% |
| CVE-2023-5749 | embedpress (WordPress plugin) | The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Ref | medium | 6.1 | 0% |
| CVE-2023-4915 | wp-user-control (WordPress plugin) | The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due t | medium | 5.3 | 0% |
| CVE-2026-46337 | wwbn/avideo | AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` | medium | 5.3 | 0% |
| CVE-2023-3245 | chaty (WordPress plugin) | The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2023-5955 | contact-form-email (WordPress plugin) | The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege us | medium | 4.8 | 0% |
| CVE-2024-3751 | seriously-simple-podcasting (WordPress plugin) | The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high priv | medium | 4.8 | 0% |
| CVE-2024-4090 | my-sticky-bar (WordPress plugin) | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does no | medium | 4.8 | 0% |
| CVE-2024-9768 | formidable-forms (WordPress plugin) | The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 4.8 | 0% |
| CVE-2024-1645 | mollie-forms (WordPress plugin) | The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrati | medium | 4.3 | 0% |
| CVE-2024-39404 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 0% |
| CVE-2022-45082 | accordions-or-faqs (WordPress plugin) | Multiple Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilities in Accordions plugin <= 2.0.3 on WordPress via &addons-style-name | low | 3.4 | 0% |
| CVE-2024-50343 | symfony/symfony, symfony/validator | Symfony has an incorrect response from Validator when input ends with `\n` | low | 3.1 | 0% |
| CVE-2020-36707 | nifty-coming-soon-\&-maintenance-mode-page (WordPress plugin) | The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1 | high | 8.8 | 0% |
| CVE-2024-4779 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injection via the ‘data[pos | high | 8.8 | 0% |
| CVE-2024-4845 | email-subscribers (WordPress plugin) | The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’ parameter in all versions up to, and incl | high | 8.8 | 0% |
| CVE-2024-29800 | timber/timber | timber/timber vulnerable to Deserialization of Untrusted Data | high | 8.0 | 0% |
| CVE-2024-2098 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protec | high | 7.5 | 0% |
| CVE-2023-2757 | waiting (WordPress plugin) | The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' | high | 7.4 | 0% |
| CVE-2024-0239 | contact-form-7-connector (WordPress plugin) | The Contact Form 7 Connector WordPress plugin before 1.2.3 does not sanitise and escape a parameter before outputting it back in the page, l | medium | 6.1 | 0% |
| CVE-2024-8739 | wp-recaptcha-integration (WordPress plugin) | The ReCaptcha Integration for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg | medium | 6.1 | 0% |
| CVE-2025-49558 | magento/community-edition, magento/project-community-edition | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | medium | 5.9 | 0% |
| CVE-2023-6369 | export-wp-page-to-static-html (WordPress plugin) | The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a mi | medium | 5.4 | 0% |
| CVE-2024-0708 | landing-page-cat (WordPress plugin) | The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposu | medium | 5.3 | 0% |
| CVE-2023-5525 | limit-login-attempts-reloaded (WordPress plugin) | The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing | medium | 4.3 | 0% |
| CVE-2023-5737 | backup-and-migration (WordPress plugin) | The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as S | medium | 4.3 | 0% |
| CVE-2024-3869 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2025-3475 | drupal/webt | This module enables you to translate nodes, configuration, UI strings automatically. The module doesn't sufficiently va | unknown | 0.0 | 0% |
| CVE-2026-56345 | wwbn/avideo | AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, a | high | 8.1 | 0% |
| CVE-2022-31157 | packbackbooks/lti-1-3-php-library | LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0 | high | 7.5 | 0% |
| CVE-2024-22305 | kali-forms (WordPress plugin) | Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms | high | 7.5 | 0% |
| CVE-2022-42460 | traffic-manager (WordPress plugin) | Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress. | medium | 6.5 | 0% |
| CVE-2024-3554 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2024-3665 | seo-by-rank-math (WordPress plugin) | The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's HowTo and FAQ widgets | medium | 6.4 | 0% |
| CVE-2015-10102 | freshdesk (WordPress plugin) | A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress. Affected by this issue is some unkno | medium | 6.3 | 0% |
| CVE-2022-41685 | integration-for-szamlazz.hu-\&-woocommerce (WordPress plugin), package-points-and-shipping-labels-for-woocommerce (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and | medium | 5.4 | 0% |
| CVE-2023-52185 | everest-backup (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration | medium | 5.3 | 0% |
| CVE-2024-0236 | eventon (WordPress plugin) | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unaut | medium | 5.3 | 0% |
| CVE-2024-47913 | mediawiki/abuse-filter | Improper permissions handling in MediaWiki AbuseFilter | medium | 5.3 | 0% |
| CVE-2024-1564 | schema (WordPress plugin) | The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any po | medium | 4.3 | 0% |
| CVE-2024-5489 | custom-font-uploader (WordPress plugin) | The Wbcom Designs – Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check o | medium | 4.3 | 0% |
| CVE-2024-1246 | concrete5/concrete5 | Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature | low | 2.0 | 0% |
| CVE-2025-67746 | composer/composer | Composer is vulnerable to ANSI sequence injection | low | 0.0 | 0% |
| CVE-2025-69213 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint) | high | 0.0 | 0% |
| CVE-2024-12876 | golo (WordPress plugin) | The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions | critical | 9.8 | 0% |
| CVE-2024-1315 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all | high | 8.8 | 0% |
| CVE-2024-13435 | ebook-downloader (WordPress plugin) | The Ebook Downloader plugin for WordPress is vulnerable to SQL Injection via the 'download' parameter in all versions up to, and including, | high | 7.5 | 0% |
| CVE-2024-13476 | ltl-freight-quotes (WordPress plugin) | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtz_wd_save_dropship' AJAX endpo | high | 7.5 | 0% |
| CVE-2024-13532 | small-package-quotes-purolator-edition (WordPress plugin) | The Small Package Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' pa | high | 7.5 | 0% |