Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2401 | qubot (WordPress plugin) | The QuBot WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as ad | medium | 4.8 | 0% |
| CVE-2023-2489 | stop-spammers (WordPress plugin) | The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its setting | medium | 4.8 | 0% |
| CVE-2023-2684 | file-renaming-on-upload (WordPress plugin) | The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2023-2795 | codecolorer (WordPress plugin) | The CodeColorer WordPress plugin before 0.10.1 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 0% |
| CVE-2023-2811 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users s | medium | 4.8 | 0% |
| CVE-2023-3328 | custom-field-for-wp-job-manager (WordPress plugin) | The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high pr | medium | 4.8 | 0% |
| CVE-2023-3344 | auto-location-for-wp-job-manager-via-google (WordPress plugin) | The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could a | medium | 4.8 | 0% |
| CVE-2023-3645 | contact-form-builder (WordPress plugin) | The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high | medium | 4.8 | 0% |
| CVE-2023-3667 | bit-assist (WordPress plugin) | The Bit Assist WordPress plugin before 1.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2023-4109 | ninja-forms-contact-form (WordPress plugin) | The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability. | medium | 4.8 | 0% |
| CVE-2023-5005 | autocomplete-location-field-contact-form-7 (WordPress plugin) | The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin | medium | 4.8 | 0% |
| CVE-2024-6130 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | 0% |
| CVE-2021-24825 | custom-content-shortcode (WordPress plugin) | The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contri | medium | 4.3 | 0% |
| CVE-2021-36877 | ulisting (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify u | medium | 4.3 | 0% |
| CVE-2023-5711 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info( | medium | 4.3 | 0% |
| CVE-2024-39411 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization leads to security feature bypass | medium | 4.3 | 0% |
| CVE-2024-39413 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 0% |
| CVE-2024-39414 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control Leads to Privilege escalation | medium | 4.3 | 0% |
| CVE-2024-39415 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization Leading to Security feature bypass | medium | 4.3 | 0% |
| CVE-2024-39417 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization leads to Security feature bypass | medium | 4.3 | 0% |
| CVE-2024-8483 | mas-static-content (WordPress plugin) | The MAS Static Content plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.8 via the static | medium | 4.3 | 0% |
| CVE-2026-54133 | mtdowling/jmespath.php | jmespath.php has CompilerRuntime code injection via unescaped function names | critical | 9.8 | 0% |
| CVE-2026-56828 | shopper/framework | Shopper: privilege escalation via improper Livewire admin component authorization | high | 8.8 | 0% |
| CVE-2025-1039 | lenix-elementor-leads-addon (WordPress plugin) | The Lenix Elementor Leads addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a URL form field in all versions up to | high | 7.2 | 0% |
| CVE-2022-2260 | givewp (WordPress plugin) | The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters su | medium | 6.5 | 0% |
| CVE-2024-12195 | wedevs-project-manager (WordPress plugin) | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerabl | medium | 6.5 | 0% |
| CVE-2024-1349 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for Wor | medium | 6.4 | 0% |
| CVE-2024-4624 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to S | medium | 6.4 | 0% |
| CVE-2024-41373 | icecoder/icecoder | ICEcoder Path Traversal vulnerability | medium | 6.3 | 0% |
| CVE-2022-43320 | feehi/cms | FeehiCMS is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 0% |
| CVE-2024-3548 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it b | medium | 6.1 | 0% |
| CVE-2020-25915 | thinkcmf/thinkcmf | ThinkCMF Cross-site Scripting Vulnerability | medium | 5.4 | 0% |
| CVE-2022-45149 | moodle/moodle | Cross-Site Request Forgery in Moodle | medium | 5.4 | 0% |
| CVE-2023-0424 | ms-reviews (WordPress plugin) | The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as S | medium | 5.4 | 0% |
| CVE-2023-1126 | wp-fevents-book (WordPress plugin) | The WP FEvents Book WordPress plugin through 0.46 does not sanitise and escape some parameters, which could allow any authenticated users, s | medium | 5.4 | 0% |
| CVE-2023-28664 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in | medium | 5.4 | 0% |
| CVE-2023-28666 | inpost-gallery (WordPress plugin) | The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' para | medium | 5.4 | 0% |
| CVE-2024-2666 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Wi | medium | 5.4 | 0% |
| CVE-2024-1733 | word-replacer-ultra (WordPress plugin) | The Word Replacer Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the word_ | medium | 5.3 | 0% |
| CVE-2024-3216 | print-invoices-packing-slip-labels-for-woocommerce (WordPress plugin) | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modificat | medium | 5.3 | 0% |
| CVE-2024-0902 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | 0% |
| CVE-2024-1660 | top-bar (WordPress plugin) | The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 0% |
| CVE-2023-5714 | system-dashboard (WordPress plugin) | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs( | medium | 4.3 | 0% |
| CVE-2024-1126 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca | medium | 4.3 | 0% |
| CVE-2024-1690 | woo-wallet (WordPress plugin) | The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2024-8661 | concrete5/concrete5 | Concrete CMS Stored XSS in the "Next&Previous Nav" block | low | 2.4 | 0% |
| CVE-2021-4049 | remdex/livehelperchat | Cross-Site Request Forgery in remdex/livehelperchat | low | 0.0 | 0% |
| CVE-2026-48557 | spatie/laravel-medialibrary | Spatie Laravel Media Library contains a file upload restriction bypass | high | 8.8 | 0% |
| CVE-2024-4749 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, le | high | 8.3 | 0% |
| CVE-2024-11283 | jobcareer (WordPress plugin) | The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wp_ajax | high | 7.5 | 0% |