Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-1570 | directorist (WordPress plugin) | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalatio | high | 8.1 | 0% |
| CVE-2024-4145 | search-\&-replace (WordPress plugin) | The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing adm | high | 7.2 | 0% |
| CVE-2024-1791 | wp-codemirror-block (WordPress plugin) | The CodeMirror Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Code Mirror block in all versions up to, and | medium | 6.4 | 0% |
| CVE-2023-3700 | alextselegidis/easyappointments | Easy!Appointments Improper Access Control vulnerability | medium | 6.3 | 0% |
| CVE-2023-5141 | bsk-contact-form-7-blacklist (WordPress plugin) | The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting | medium | 6.1 | 0% |
| CVE-2023-5641 | free-\&-easy-link-building (WordPress plugin) | The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before ou | medium | 6.1 | 0% |
| CVE-2022-4115 | editorial-calendar (WordPress plugin) | The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contribu | medium | 5.4 | 0% |
| CVE-2022-4623 | nd-shortcodes (WordPress plugin) | The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2022-4676 | openstreetmap (WordPress plugin) | The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as | medium | 5.4 | 0% |
| CVE-2022-4782 | clickfunnels (WordPress plugin) | The ClickFunnels WordPress plugin through 3.1.1 does not validate and escape one of its shortcode attributes, which could allow users with a | medium | 5.4 | 0% |
| CVE-2023-0066 | companion-sitemap-generator (WordPress plugin) | The Companion Sitemap Generator WordPress plugin through 4.5.1.1 does not validate and escape some of its shortcode attributes before output | medium | 5.4 | 0% |
| CVE-2023-0078 | resume-builder (WordPress plugin) | The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users wi | medium | 5.4 | 0% |
| CVE-2023-0152 | wp-multi-store-locator (WordPress plugin) | The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2023-0267 | ultimate-carousel-for-wpbakery-page-builder (WordPress plugin) | The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes b | medium | 5.4 | 0% |
| CVE-2023-0268 | mega-addons-for-wpbakery-page-builder (WordPress plugin) | The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortcode attributes before | medium | 5.4 | 0% |
| CVE-2023-0273 | custom-content-shortcode (WordPress plugin) | The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting | medium | 5.4 | 0% |
| CVE-2023-0280 | ultimate-carousel-for-elementor (WordPress plugin) | The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting | medium | 5.4 | 0% |
| CVE-2023-0363 | scheduled-announcements-widget (WordPress plugin) | The Scheduled Announcements Widget WordPress plugin before 1.0 does not validate and escape some of its shortcode attributes before outputti | medium | 5.4 | 0% |
| CVE-2023-0367 | pricing-tables-for-wpbakery-page-builder (WordPress plugin) | The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate and escape some of its | medium | 5.4 | 0% |
| CVE-2023-0368 | responsive-tabs-for-wpbakery-page-builder (WordPress plugin) | The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of i | medium | 5.4 | 0% |
| CVE-2023-0369 | gotowp (WordPress plugin) | The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a pag | medium | 5.4 | 0% |
| CVE-2023-0374 | w4-post-list (WordPress plugin) | The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/ | medium | 5.4 | 0% |
| CVE-2023-0418 | video-central (WordPress plugin) | The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them ba | medium | 5.4 | 0% |
| CVE-2023-0489 | sideonline (WordPress plugin) | The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 0% |
| CVE-2023-0526 | post-shortcode (WordPress plugin) | The Post Shortcode WordPress plugin through 2.0.9 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |
| CVE-2023-0536 | wp-d3 (WordPress plugin) | The Wp-D3 WordPress plugin through 2.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page | medium | 5.4 | 0% |
| CVE-2023-0538 | campaign-url-builder (WordPress plugin) | The Campaign URL Builder WordPress plugin before 1.8.2 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2023-0542 | custom-post-type-list-shortcode (WordPress plugin) | The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outp | medium | 5.4 | 0% |
| CVE-2023-0589 | wp-image-carousel (WordPress plugin) | The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as lo | medium | 5.4 | 0% |
| CVE-2023-0610 | wallabag/wallabag | wallabag subject to Improper Authorization via annotations | medium | 5.4 | 0% |
| CVE-2023-0764 | gallery (WordPress plugin) | The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cr | medium | 5.4 | 0% |
| CVE-2023-0891 | stagtools (WordPress plugin) | The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 0% |
| CVE-2023-1905 | wp-popups (WordPress plugin) | The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputti | medium | 5.4 | 0% |
| CVE-2023-2817 | craftcms/cms | Stored cross site scripting in Craft CMS | medium | 5.4 | 0% |
| CVE-2023-2899 | google-map-shortcode (WordPress plugin) | The Google Map Shortcode WordPress plugin through 3.1.2 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | 0% |
| CVE-2023-5323 | dolibarr/dolibarr | Dolibarr Cross-site Scripting vulnerability | medium | 5.4 | 0% |
| CVE-2023-1323 | easy-forms-for-mailchimp (WordPress plugin) | The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape some of its from parameters, which could allow high | medium | 4.8 | 0% |
| CVE-2025-69215 | devcode-it/openstamanager | OpenSTAManager has an SQL Injection in the Stampe Module | high | 0.0 | 0% |
| CVE-2026-34463 | mantisbt/mantisbt | MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form | high | 0.0 | 0% |
| CVE-2024-39323 | aimeos/ai-admin-graphql | aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account | high | 8.2 | 0% |
| CVE-2022-3119 | oauth-client-single-sign-on (WordPress plugin) | The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could a | high | 7.5 | 0% |
| CVE-2024-51496 | librenms/librenms | LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php | high | 7.5 | 0% |
| CVE-2023-3167 | mail-queue (WordPress plugin) | The Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.1 | high | 7.2 | 0% |
| CVE-2024-1282 | email-encoder-bundle (WordPress plugin) | The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | 0% |
| CVE-2024-8482 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all ve | medium | 6.4 | 0% |
| CVE-2024-8546 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video widget in all vers | medium | 6.4 | 0% |
| CVE-2021-36572 | feehi/feehicms | FeehiCMS Cross Site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2024-0587 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'disqus_name' paramet | medium | 6.1 | 0% |
| CVE-2024-1331 | team-members (WordPress plugin) | The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 6.1 | 0% |
| CVE-2024-1752 | font-farsi (WordPress plugin) | The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 6.1 | 0% |