Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-1603 | mail-subscribe-list (WordPress plugin) | The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow at | medium | 4.3 | 0% |
| CVE-2022-1627 | my-private-site (WordPress plugin) | The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2022-1653 | social-share-buttons (WordPress plugin) | The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, all | medium | 4.3 | 0% |
| CVE-2022-1842 | openbook-book-data (WordPress plugin) | The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attack | medium | 4.3 | 0% |
| CVE-2022-1844 | wp-sentry (WordPress plugin) | The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make | medium | 4.3 | 0% |
| CVE-2022-1845 | wp-post-styling (WordPress plugin) | The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged | medium | 4.3 | 0% |
| CVE-2022-1846 | tiny-contact-form (WordPress plugin) | The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2022-1847 | rotating-posts (WordPress plugin) | The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 4.3 | 0% |
| CVE-2022-1885 | cimy-header-image-rotator (WordPress plugin) | The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow | medium | 4.3 | 0% |
| CVE-2022-1895 | underconstruction (WordPress plugin) | The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could al | medium | 4.3 | 0% |
| CVE-2022-1913 | add-post-url (WordPress plugin) | The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2022-1914 | clean-contact (WordPress plugin) | The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2022-1957 | comment-license (WordPress plugin) | The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2022-1960 | mycss (WordPress plugin) | The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a l | medium | 4.3 | 0% |
| CVE-2022-2144 | jquery-validation-for-contact-form-7 (WordPress plugin) | The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which cou | medium | 4.3 | 0% |
| CVE-2024-0595 | awesome-support (WordPress plugin) | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capabil | medium | 4.3 | 0% |
| CVE-2024-10356 | element-ready-lite (WordPress plugin) | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | medium | 4.3 | 0% |
| CVE-2024-38273 | moodle/moodle | Moodle BigBlueButton web service leaks meeting joining information | medium | 4.3 | 0% |
| CVE-2024-39405 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 0% |
| CVE-2024-39407 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 0% |
| CVE-2024-39412 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 4.3 | 0% |
| CVE-2024-39419 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control Leads to Privilege escalation | medium | 4.3 | 0% |
| CVE-2026-45075 | symfony/http-kernel, symfony/security-http, symfony/symfony | Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] | high | 0.0 | 0% |
| CVE-2026-50281 | craftcms/cms | Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements | high | 0.0 | 0% |
| CVE-2024-51736 | symfony/process, symfony/symfony | Symfony vulnerable to command execution hijack on Windows with Process class | high | 8.4 | 0% |
| CVE-2026-39369 | wwbn/avideo | WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs | high | 7.6 | 0% |
| CVE-2020-36769 | widget-settings-importer\/exporter (WordPress plugin) | The Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_datap | high | 7.4 | 0% |
| CVE-2024-1596 | ninja-forms-file-uploads (WordPress plugin) | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all | high | 7.2 | 0% |
| CVE-2020-13868 | verbb/comments | Comments plugin Cross-Site Request Forgery (CSRF) | medium | 6.5 | 0% |
| CVE-2023-47191 | youzify (WordPress plugin) | Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & M | medium | 6.5 | 0% |
| CVE-2024-1447 | sydney-toolbox (WordPress plugin) | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aThemes Slider button element in all v | medium | 6.4 | 0% |
| CVE-2024-3990 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widg | medium | 6.4 | 0% |
| CVE-2023-6525 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar element attributes i | medium | 5.5 | 0% |
| CVE-2024-5977 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions | medium | 5.4 | 0% |
| CVE-2024-1562 | wc-gsheetconnector (WordPress plugin) | The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.3 | 0% |
| CVE-2025-0466 | sensei-lms (WordPress plugin) | The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak | medium | 5.3 | 0% |
| CVE-2024-56199 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ Vulnerable to Stored HTML Injection at FAQ | medium | 5.2 | 0% |
| CVE-2022-39314 | getkirby/cms | Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms | medium | 4.8 | 0% |
| CVE-2023-1286 | pimcore/pimcore | Cross-site Scripting (XSS) in pimcore/pimcore | medium | 4.8 | 0% |
| CVE-2024-1089 | imagerecycle-pdf-image-compression (WordPress plugin) | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability | medium | 4.3 | 0% |
| CVE-2024-39324 | aimeos/ai-admin-graphql | aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services | low | 3.8 | 0% |
| CVE-2024-10562 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege | low | 2.7 | 0% |
| CVE-2026-22243 | egroupware/egroupware | EGroupware has SQL Injection in Nextmatch Filter Processing | high | 0.0 | 0% |
| CVE-2026-27697 | baserproject/basercms | baserCMS has an SQL injection vulnerability in its blog post functionality | medium | 0.0 | 0% |
| CVE-2026-30885 | wwbn/avideo | AVideo has Unauthenticated IDOR - Playlist Information Disclosure | medium | 0.0 | 0% |
| CVE-2026-33182 | saloonphp/saloon | Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL | medium | 0.0 | 0% |
| CVE-2026-23493 | pimcore/pimcore | Pimcore ENV Variables and Cookie Informations are exposed in http_error_log | high | 8.6 | 0% |
| CVE-2024-1285 | page-builder-sandwich (WordPress plugin) | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to unauthorized modification of data | medium | 6.5 | 0% |
| CVE-2024-13500 | wedevs-project-manager (WordPress plugin) | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerabl | medium | 6.5 | 0% |
| CVE-2024-13713 | wpexperts-square-for-give (WordPress plugin) | The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and incl | medium | 6.5 | 0% |