Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5243 | login-screen-manager (WordPress plugin) | The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege | medium | 4.8 | 0% |
| CVE-2024-6393 | nextgen-gallery (WordPress plugin) | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which co | medium | 4.8 | 0% |
| CVE-2024-7056 | wpforms (WordPress plugin) | The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such | low | 3.5 | 0% |
| CVE-2026-112238 | ameos/ameos_filemanager | TYPO3-EXT-SA-2026-034: SQL Injection in extension "File manager" (ameos_filemanager) | unknown | 0.0 | 0% |
| CVE-2026-56722 | dompdf/dompdf | Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI | medium | 0.0 | 0% |
| CVE-2025-26525 | moodle/moodle | Moodle has an arbitrary file read risk through pdfTeX | high | 8.6 | 0% |
| CVE-2024-6021 | donation-block-for-paypal (WordPress plugin) | The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site s | medium | 6.8 | 0% |
| CVE-2018-19621 | showdoc/showdoc | Showdoc CSRF Vulnerability | medium | 6.5 | 0% |
| CVE-2024-9586 | linkz-ai (WordPress plugin) | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_auth' a | medium | 6.5 | 0% |
| CVE-2023-2104 | alextselegidis/easyappointments | alextselegidis/easyappointments Improper Access Control vulnerability | medium | 5.4 | 0% |
| CVE-2023-5114 | idbbee (WordPress plugin) | The idbbee plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idbbee' shortcode in versions up to, and incl | medium | 5.4 | 0% |
| CVE-2024-4655 | ultimate-blocks (WordPress plugin) | The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2026-54543 | froxlor/froxlor | Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields | medium | 5.4 | 0% |
| CVE-2026-33501 | wwbn/avideo | AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin | medium | 5.3 | 0% |
| CVE-2023-1884 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to cross-site scripting (XSS) via stopword parameter | medium | 4.7 | 0% |
| CVE-2025-2205 | gdpr-cookie-compliance (WordPress plugin) | The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored C | medium | 4.4 | 0% |
| CVE-2021-24853 | qr-redirector (WordPress plugin) | The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_sa | medium | 4.3 | 0% |
| CVE-2026-29172 | craftcms/commerce | Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting | high | 0.0 | 0% |
| CVE-2026-40598 | mantisbt/mantisbt | MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page | medium | 0.0 | 0% |
| CVE-2024-48229 | funadmin/funadmin | SQL injection in funadmin | critical | 9.8 | 0% |
| CVE-2024-45592 | damienharper/auditor-bundle | auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped | high | 8.2 | 0% |
| CVE-2024-10311 | external-database-based-actions (WordPress plugin) | The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This | high | 7.5 | 0% |
| CVE-2024-0678 | order-delivery-date (WordPress plugin) | The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' para | medium | 6.5 | 0% |
| CVE-2024-13525 | emails-verification-for-woocommerce (WordPress plugin) | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 6.5 | 0% |
| CVE-2023-6561 | featured-image-from-url (WordPress plugin) | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all | medium | 6.4 | 0% |
| CVE-2024-1276 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-2423 | userswp (WordPress plugin) | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnera | medium | 6.4 | 0% |
| CVE-2024-2623 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2023-4315 | woo-custom-emails (WordPress plugin) | The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemails_edit' parameter in versions up to, and | medium | 6.1 | 0% |
| CVE-2024-6487 | inline-related-posts (WordPress plugin) | The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 5.9 | 0% |
| CVE-2023-4821 | drag-and-drop-multiple-file-uploader (WordPress plugin) | The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensio | medium | 5.4 | 0% |
| CVE-2023-4823 | wp-meta-and-date-remover (WordPress plugin) | The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has | medium | 5.4 | 0% |
| CVE-2024-2369 | coblocks (WordPress plugin) | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting the | medium | 5.4 | 0% |
| CVE-2022-45816 | gd-bbpress-attachments (WordPress plugin) | Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress. | medium | 4.8 | 0% |
| CVE-2020-15400 | cakephp/cakephp | Cross-Site Request Forgery in CakePHP | medium | 4.3 | 0% |
| CVE-2021-4399 | edwiser-bridge (WordPress plugin) | The Edwiser Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,2.0.6. This is due to m | medium | 4.3 | 0% |
| CVE-2025-1986 | gutentor (WordPress plugin) | The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to | medium | 4.1 | 0% |
| CVE-2026-33716 | wwbn/avideo | AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php | critical | 9.4 | 0% |
| CVE-2022-3999 | woocommerce-shipping (WordPress plugin) | The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authent | high | 8.1 | 0% |
| CVE-2023-6961 | wp-meta-seo (WordPress plugin) | The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and includ | high | 7.2 | 0% |
| CVE-2022-25777 | mautic/core | Mautic: MST-48 Server-Side Request Forgery in Asset section | medium | 6.5 | 0% |
| CVE-2024-11069 | wordpress-gdpr (WordPress plugin) | The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_ | medium | 6.5 | 0% |
| CVE-2023-5413 | image-horizontal-reel-scroll-slideshow (WordPress plugin) | The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode i | medium | 6.4 | 0% |
| CVE-2024-1370 | maintenance-page (WordPress plugin) | The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_do | medium | 5.3 | 0% |
| CVE-2025-1402 | event-tickets (WordPress plugin) | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the | medium | 5.3 | 0% |
| CVE-2023-34013 | poll-maker (WordPress plugin) | Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker – Best WordPress Poll Plugin.This issue affects Poll Maker – | medium | 4.4 | 0% |
| CVE-2024-10868 | enteraddons (WordPress plugin) | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, | medium | 4.3 | 0% |
| CVE-2026-45754 | symfony/lox24-notifier, symfony/mailjet-mailer, symfony/symfony | Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection | medium | 0.0 | 0% |
| CVE-2026-54768 | wp-graphql/wp-graphql | WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeratio | medium | 0.0 | 0% |
| CVE-2025-0959 | eventer (WordPress plugin) | The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all v | high | 8.8 | 0% |