Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5874 | popup-box (WordPress plugin) | The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | 0% |
| CVE-2023-5971 | save-as-pdf (WordPress plugin) | The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high p | medium | 4.8 | 0% |
| CVE-2024-6723 | ai-engine (WordPress plugin) | The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to | medium | 4.7 | 0% |
| CVE-2021-24380 | shantz-wordpress-qotd (WordPress plugin) | The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make lo | medium | 4.3 | 0% |
| CVE-2021-24668 | maz-loader (WordPress plugin) | The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary l | medium | 4.3 | 0% |
| CVE-2021-24749 | url-shortify (WordPress plugin) | The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attac | medium | 4.3 | 0% |
| CVE-2021-24776 | wp-performance-score-booster (WordPress plugin) | The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2021-24780 | single-post-exporter (WordPress plugin) | The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2021-24801 | wp-survey-plus (WordPress plugin) | The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any u | medium | 4.3 | 0% |
| CVE-2021-24818 | wp-limits (WordPress plugin) | The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin ch | medium | 4.3 | 0% |
| CVE-2021-24832 | wp-seo-redirect-301 (WordPress plugin) | The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2024-10530 | chatbot-chatgpt (WordPress plugin) | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2024-1092 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unaut | medium | 4.3 | 0% |
| CVE-2024-3606 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due | medium | 4.3 | 0% |
| CVE-2026-107376 | webonyx/graphql-php | webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input | high | 8.2 | 0% |
| CVE-2024-38275 | moodle/moodle | Moodle HTTP authorization header is preserved between "emulated redirects" | high | 7.5 | 0% |
| CVE-2023-6751 | hostinger (WordPress plugin) | The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function pu | high | 7.3 | 0% |
| CVE-2023-34023 | wordpress-social-login (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions. | high | 7.1 | 0% |
| CVE-2023-6782 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in | medium | 6.4 | 0% |
| CVE-2024-0383 | wp-recipe-maker (WordPress plugin) | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [wprm-recipe-instructions] and [wprm- | medium | 6.4 | 0% |
| CVE-2024-1073 | wp-slimstat (WordPress plugin) | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-2028 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Covid-19 Stats Widget in all ve | medium | 6.4 | 0% |
| CVE-2024-2129 | wpbits-addons-for-elementor (WordPress plugin) | The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widg | medium | 6.4 | 0% |
| CVE-2024-3197 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in the plugin's wi | medium | 6.4 | 0% |
| CVE-2021-24432 | advanced-ajax-product-filters (WordPress plugin) | The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading | medium | 6.1 | 0% |
| CVE-2021-31693 | photo-gallery (WordPress plugin) | The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_fronte | medium | 6.1 | 0% |
| CVE-2022-41132 | ezoic (WordPress plugin) | Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. | medium | 6.1 | 0% |
| CVE-2023-3933 | your-journey (WordPress theme) | The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and includin | medium | 6.1 | 0% |
| CVE-2023-3962 | winters (WordPress theme) | The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1. | medium | 6.1 | 0% |
| CVE-2023-3965 | nsc (WordPress theme) | The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 du | medium | 6.1 | 0% |
| CVE-2024-4704 | contact-form-7 (WordPress plugin) | The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL | medium | 6.1 | 0% |
| CVE-2024-47069 | oveleon/contao-cookiebar | Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar | medium | 6.1 | 0% |
| CVE-2025-0864 | profit-products-tables-for-woocommerce (WordPress plugin) | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Reflected Cross-Site Scri | medium | 6.1 | 0% |
| CVE-2022-29453 | api-key-for-google-maps (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key updat | medium | 5.4 | 0% |
| CVE-2024-3340 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri-gallery-slideshow' shor | medium | 5.4 | 0% |
| CVE-2025-24437 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 5.4 | 0% |
| CVE-2022-4973 | WordPress core | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with acce | medium | 4.9 | 0% |
| CVE-2023-5775 | backwpup (WordPress plugin) | The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4. | low | 2.2 | 0% |
| CVE-2026-42548 | flightphp/core | Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp() | high | 0.0 | 0% |
| CVE-2026-52820 | kimai/kimai | Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass | medium | 0.0 | 0% |
| CVE-2026-52825 | kimai/kimai | Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Vis | medium | 0.0 | 0% |
| CVE-2025-8264 | z-push/z-push-dev | z-push/z-push-dev SQL Injection Vulnerability | critical | 9.0 | 0% |
| CVE-2026-81892 | easycorp/easyadmin-bundle | EasyAdmin custom-action dispatcher bypasses access_control on other routes | high | 8.1 | 0% |
| CVE-2024-13562 | import-wp (WordPress plugin) | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all | high | 7.5 | 0% |
| CVE-2025-62508 | starcitizentools/citizen-skin | Citizen vulnerable to stored XSS in sticky header button messages | medium | 6.5 | 0% |
| CVE-2026-84306 | filament/filament | Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used | medium | 6.5 | 0% |
| CVE-2024-6567 | ebook-store (WordPress plugin) | The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the | medium | 5.3 | 0% |
| CVE-2019-25222 | wp-responsive-thumbnail-slider (WordPress plugin) | The Thumbnail carousel slider plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and includin | medium | 4.9 | 0% |
| CVE-2023-2995 | leyka (WordPress plugin) | The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as a | medium | 4.8 | 0% |
| CVE-2023-3226 | popup-builder (WordPress plugin) | The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |