Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-29437 | baslider (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress. | medium | 5.4 | 0% |
| CVE-2022-45375 | ifeature-slider (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress. | medium | 5.4 | 0% |
| CVE-2024-1584 | wp-analytify (WordPress plugin) | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized modifi | medium | 5.3 | 0% |
| CVE-2024-8794 | ba-book-everything (WordPress plugin) | The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is | medium | 5.3 | 0% |
| CVE-2024-5575 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users | medium | 4.7 | 0% |
| CVE-2024-6879 | quiz-and-survey-master (WordPress plugin) | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a | medium | 4.7 | 0% |
| CVE-2021-24805 | dw-question-\&-answer (WordPress plugin) | The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to | medium | 4.3 | 0% |
| CVE-2022-0616 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a l | medium | 4.3 | 0% |
| CVE-2022-1594 | hc-custom-wp-admin-url (WordPress plugin) | The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow atta | medium | 4.3 | 0% |
| CVE-2022-1695 | wp-simple-adsense-insertion (WordPress plugin) | The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker | medium | 4.3 | 0% |
| CVE-2022-1709 | throws-spam-away (WordPress plugin) | The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), | medium | 4.3 | 0% |
| CVE-2022-1712 | livesync (WordPress plugin) | The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to m | medium | 4.3 | 0% |
| CVE-2022-1793 | private-files (WordPress plugin) | The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a l | medium | 4.3 | 0% |
| CVE-2023-4947 | woocommerce-ean-payment-gateway (WordPress plugin) | The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 4.3 | 0% |
| CVE-2024-3628 | easyevent (WordPress plugin) | The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such | low | 3.8 | 0% |
| CVE-2025-31681 | drupal/alogin | This module allows a site to setup two factor authentication via QR code using authenticator applications on mobile devi | critical | 9.8 | 0% |
| CVE-2025-31691 | drupal/oauth2_server | Provides OAuth2 server functionality based on the oauth2-server-php library. The module does not consistently enforce a | critical | 9.8 | 0% |
| CVE-2024-3748 | sp-project-\&-document-manager (WordPress plugin) | The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate | medium | 6.5 | 0% |
| CVE-2024-1428 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter G | medium | 6.4 | 0% |
| CVE-2024-1507 | bdthemes-prime-slider-lite (WordPress plugin) | The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tags' attribute of | medium | 6.4 | 0% |
| CVE-2024-2503 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid Widget in all version | medium | 6.4 | 0% |
| CVE-2024-5189 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2024-9682 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder wid | medium | 6.4 | 0% |
| CVE-2024-9221 | tainacan (WordPress plugin) | The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapi | medium | 6.1 | 0% |
| CVE-2022-38079 | backup-scheduler (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress. | medium | 5.4 | 0% |
| CVE-2024-0903 | userfeedback-lite (WordPress plugin) | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross- | medium | 5.4 | 0% |
| CVE-2023-1081 | microweber/microweber | Microweber Cross-site Scripting vulnerability | medium | 4.8 | 0% |
| CVE-2022-0226 | remdex/livehelperchat | Cross-Site Request Forgery (CSRF) in livehelperchat | medium | 4.3 | 0% |
| CVE-2023-2555 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 4.3 | 0% |
| CVE-2023-2556 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 4.3 | 0% |
| CVE-2026-33238 | wwbn/avideo | AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration | medium | 4.3 | 0% |
| CVE-2026-5394 | pimcore/pimcore | Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save | high | 0.0 | 0% |
| CVE-2025-62617 | admidio/admidio | Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality | high | 7.2 | 0% |
| CVE-2022-40209 | wp-smart-import (WordPress plugin) | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress. | medium | 6.1 | 0% |
| CVE-2022-4227 | booster-elite-for-woocommerce (WordPress plugin), booster-for-woocommerce (WordPress plugin), booster-plus-for-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 5.6.3, Booster Plus for WooCommerce WordPress plugin before 6.0.0, Booster Elite for Woo | medium | 6.1 | 0% |
| CVE-2022-45848 | contest-gallery (WordPress plugin) | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress. | medium | 6.1 | 0% |
| CVE-2023-1978 | shiftcontroller (WordPress plugin) | The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in v | medium | 6.1 | 0% |
| CVE-2023-2184 | responsive-horizontal-vertical-and-accordion-tabs (WordPress plugin) | The WP Responsive Tabs horizontal vertical and accordion Tabs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the s | medium | 6.1 | 0% |
| CVE-2023-2289 | wp-vertical-image-slider (WordPress plugin) | The wordpress vertical image slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in | medium | 6.1 | 0% |
| CVE-2023-2402 | wp-responsive-photo-gallery (WordPress plugin) | The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term | medium | 6.1 | 0% |
| CVE-2023-2604 | team-circle-image-slider-with-lightbox (WordPress plugin) | The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parame | medium | 6.1 | 0% |
| CVE-2023-4067 | bus-ticket-booking-with-seat-reservation (WordPress plugin) | The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'ta | medium | 6.1 | 0% |
| CVE-2023-5946 | digirisk (WordPress plugin) | The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 du | medium | 6.1 | 0% |
| CVE-2024-8715 | simple-ldap-login (WordPress plugin) | The Simple LDAP Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria | medium | 6.1 | 0% |
| CVE-2024-8788 | eu-vat-for-woocommerce (WordPress plugin) | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg w | medium | 6.1 | 0% |
| CVE-2024-8872 | order-hours-scheduler-for-woocommerce (WordPress plugin) | The Store Hours for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without | medium | 6.1 | 0% |
| CVE-2024-9378 | yml-for-yandex-market (WordPress plugin) | The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up t | medium | 6.1 | 0% |
| CVE-2024-2296 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file up | medium | 5.5 | 0% |
| CVE-2022-4946 | frontend-post-wordpress-plugin (WordPress plugin) | The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow | medium | 5.4 | 0% |
| CVE-2023-4035 | simple-blog-card (WordPress plugin) | The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 0% |