Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-25876 | enhavo/enhavo-app | Enhavo Cross-site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2021-36876 | ulisting (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugi | medium | 5.4 | 0% |
| CVE-2021-3921 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 5.4 | 0% |
| CVE-2023-0736 | wallabag/wallabag | Cross-site Scripting (XSS) in wallabag/wallabag | medium | 5.4 | 0% |
| CVE-2024-1500 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Logo Widget in all versio | medium | 5.4 | 0% |
| CVE-2023-49162 | bigcommerce (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BigCommerce BigCommerce For WordPress.This issue affects BigComm | medium | 5.3 | 0% |
| CVE-2024-0972 | buddypress-members-only (WordPress plugin) | The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 | medium | 5.3 | 0% |
| CVE-2015-10108 | inline-google-spreadsheet-viewer (WordPress plugin) | A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic. Affected | medium | 4.3 | 0% |
| CVE-2015-10109 | video-and-media-plug-in (WordPress plugin) | A vulnerability was found in Video Playlist and Gallery Plugin up to 1.136 on WordPress. It has been rated as problematic. Affected by this | medium | 4.3 | 0% |
| CVE-2015-10125 | import-all-pages\,-post-types\,-products\,-orders\,-and-users-as-xml-\&-csv (WordPress plugin) | A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part | medium | 4.3 | 0% |
| CVE-2021-3931 | snipe/snipe-it | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2021-4005 | grumpydictator/firefly-iii | Cross Site Request Forgery in firefly-iii | medium | 4.3 | 0% |
| CVE-2021-4015 | grumpydictator/firefly-iii | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2021-4082 | pimcore/pimcore | pimcore is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2026-50188 | getkirby/cms | Kirby: Request header injection in `Http\Remote` | medium | 0.0 | 0% |
| CVE-2025-5953 | hrm (WordPress plugin) | The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_ | high | 8.8 | 0% |
| CVE-2026-57995 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold | high | 8.8 | 0% |
| CVE-2025-55741 | unopim/unopim | UnoPim has Broken Access Control | high | 8.1 | 0% |
| CVE-2026-56396 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards | high | 8.1 | 0% |
| CVE-2024-13480 | ltl-freight-quotes-fedex-freight-edition (WordPress plugin) | The LTL Freight Quotes – For Customers of FedEx Freight plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_ | high | 7.5 | 0% |
| CVE-2024-13490 | ltl-freight-quotes (WordPress plugin) | The LTL Freight Quotes – XPO Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters | high | 7.5 | 0% |
| CVE-2024-13531 | shipengine-shipping-quotes (WordPress plugin) | The ShipEngine Shipping Quotes plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and in | high | 7.5 | 0% |
| CVE-2025-11924 | ninja-forms (WordPress plugin) | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in ver | high | 7.5 | 0% |
| CVE-2026-23498 | shopware/core, shopware/shopware | Shopware Has Improper Control of Generation of Code in Twig rendered views | high | 7.2 | 0% |
| CVE-2023-1092 | oauth-single-sign-on (WordPress plugin) | The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sig | medium | 6.5 | 0% |
| CVE-2023-6555 | email-subscription-popup (WordPress plugin) | The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, | medium | 6.1 | 0% |
| CVE-2023-6629 | post-smtp (WordPress plugin) | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Refl | medium | 6.1 | 0% |
| CVE-2024-1273 | starbox (WordPress plugin) | The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contri | medium | 6.1 | 0% |
| CVE-2024-3692 | gutenverse (WordPress plugin) | The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a pa | medium | 6.1 | 0% |
| CVE-2023-34172 | wordpress-social-login (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions. | medium | 5.9 | 0% |
| CVE-2023-2547 | feather-login-page (WordPress plugin) | The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' | medium | 5.4 | 0% |
| CVE-2024-0561 | ultimate-posts-widget (WordPress plugin) | The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back | medium | 5.4 | 0% |
| CVE-2024-1746 | testimonial-slider-and-showcase (WordPress plugin) | The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege use | medium | 5.4 | 0% |
| CVE-2024-5595 | essential-blocks (WordPress plugin) | The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a | medium | 5.4 | 0% |
| CVE-2024-13796 | post-grid (WordPress plugin) | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 5.3 | 0% |
| CVE-2023-0423 | wordpress-amazon-s3 (WordPress plugin) | The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, l | medium | 4.8 | 0% |
| CVE-2023-0544 | wp-login-box (WordPress plugin) | The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2023-0545 | hostel (WordPress plugin) | The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2023-0844 | namaste\!-lms (WordPress plugin) | The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such | medium | 4.8 | 0% |
| CVE-2023-0874 | klavio (WordPress plugin) | The Klaviyo WordPress plugin before 3.0.10 does not sanitize and escape some of its settings, which could allow high-privilege users such as | medium | 4.8 | 0% |
| CVE-2023-0893 | time-sheets (WordPress plugin) | The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-0894 | pickup-\|-delivery-\|-dine-in-date-time (WordPress plugin) | The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allo | medium | 4.8 | 0% |
| CVE-2023-1021 | amr-ical-events-list (WordPress plugin) | The amr ical events lists WordPress plugin through 6.6 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.8 | 0% |
| CVE-2023-1025 | simple-file-list (WordPress plugin) | The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2023-1120 | simple-giveaways (WordPress plugin) | The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2023-1121 | simple-giveaways (WordPress plugin) | The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | 0% |
| CVE-2023-1122 | simple-giveaways (WordPress plugin) | The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privi | medium | 4.8 | 0% |
| CVE-2023-1649 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2023-1982 | front-editor (WordPress plugin) | The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege use | medium | 4.8 | 0% |
| CVE-2023-2254 | ko-fi-button (WordPress plugin) | The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Sto | medium | 4.8 | 0% |