Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.07.2, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-66305 | getgrav/grav | Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter | high | 0.0 | 0% |
| CVE-2025-31686 | goalgorilla/open_social | Drupal Open Social Missing Authorization vulnerability | high | 8.1 | 0% |
| CVE-2026-31891 | cockpit-hq/cockpit | Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() | high | 7.7 | 0% |
| CVE-2026-55208 | pimcore/studio-backend-bundle | Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password h | high | 7.7 | 0% |
| CVE-2019-25215 | ari-adminer (WordPress plugin) | The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the | high | 7.3 | 0% |
| CVE-2022-3154 | integration-for-billingo-\&-gravity-forms (WordPress plugin), integration-for-szamlazz.hu-\&-gravity-forms (WordPress plugin), woo-billingo-plus (WordPress plugin) | The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration f | high | 7.1 | 0% |
| CVE-2024-1076 | ssl-zen (WordPress plugin) | The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the | medium | 6.5 | 0% |
| CVE-2023-6526 | meta-box (WordPress plugin) | The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta valu | medium | 6.4 | 0% |
| CVE-2023-6809 | beepress (WordPress plugin) | The Custom fields shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf shortcode in all versions | medium | 6.4 | 0% |
| CVE-2023-6880 | visual-composer-website-builder (WordPress plugin) | The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress i | medium | 6.4 | 0% |
| CVE-2023-6982 | shortcode-to-display-post-and-user-data (WordPress plugin) | The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting v | medium | 6.4 | 0% |
| CVE-2024-1997 | premium-addons (WordPress plugin) | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the Me | medium | 6.4 | 0% |
| CVE-2024-3558 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_title]' parameter versions up | medium | 6.4 | 0% |
| CVE-2024-4865 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up | medium | 6.4 | 0% |
| CVE-2024-9442 | element-ready-lite (WordPress plugin) | The F4 Improvements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ | medium | 6.4 | 0% |
| CVE-2024-0711 | buttons-shortcode-and-widget (WordPress plugin) | The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputti | medium | 6.1 | 0% |
| CVE-2023-0695 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped | medium | 5.4 | 0% |
| CVE-2023-6556 | woocommerce-currency-switcher (WordPress plugin) | The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via currency opti | medium | 5.4 | 0% |
| CVE-2022-35950 | oro/commerce | OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item | medium | 4.8 | 0% |
| CVE-2021-3775 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2021-3776 | showdoc/showdoc | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2022-2276 | wp-edit-menu (WordPress plugin) | The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated att | medium | 4.3 | 0% |
| CVE-2022-36346 | maxbuttons (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress. | medium | 4.3 | 0% |
| CVE-2025-10351 | melisplatform/melis-cms | Melis Platform CMS SQL Injection | critical | 0.0 | 0% |
| CVE-2026-77144 | jweiland/events2 | TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2) | unknown | 0.0 | 0% |
| CVE-2025-5835 | droip (WordPress plugin) | The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_ | high | 8.8 | 0% |
| CVE-2023-38474 | campaign-monitor (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Campaign Monitor Campaign Monitor for | high | 7.1 | 0% |
| CVE-2023-46086 | affiliate-toolkit (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SERVIT Software Solutions affiliate-to | high | 7.1 | 0% |
| CVE-2023-48322 | employee-job-application (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eDoc Intelligence eDoc Employee Job Ap | high | 7.1 | 0% |
| CVE-2024-1679 | a4-barcode-generator (WordPress plugin) | The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to Stored | medium | 6.4 | 0% |
| CVE-2021-24349 | gallery-from-files (WordPress plugin) | This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not prop | medium | 6.1 | 0% |
| CVE-2021-24410 | telugu-bible-verse-daily (WordPress plugin) | The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, and do not sanitise or | medium | 6.1 | 0% |
| CVE-2021-24411 | social-tape (WordPress plugin) | The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them | medium | 6.1 | 0% |
| CVE-2021-24434 | glass (WordPress plugin) | The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Sto | medium | 6.1 | 0% |
| CVE-2021-24466 | verse-o-matic (WordPress plugin) | The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators | medium | 6.1 | 0% |
| CVE-2021-24477 | migrate-users (WordPress plugin) | The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a | medium | 6.1 | 0% |
| CVE-2021-24535 | light-messages (WordPress plugin) | The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content | medium | 6.1 | 0% |
| CVE-2021-24536 | custom-login-redirect (WordPress plugin) | The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or | medium | 6.1 | 0% |
| CVE-2021-24543 | jquery-reply-to-comment (WordPress plugin) | The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its | medium | 6.1 | 0% |
| CVE-2023-5210 | amp-plus (WordPress plugin) | The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl | medium | 6.1 | 0% |
| CVE-2024-8732 | leira-roles (WordPress plugin) | The Roles & Capabilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without approp | medium | 6.1 | 0% |
| CVE-2024-10075 | jetpack (WordPress plugin) | The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, | medium | 5.6 | 0% |
| CVE-2021-24683 | weather-effect (WordPress plugin) | The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or esc | medium | 5.4 | 0% |
| CVE-2026-71434 | statamic/cms | Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types | medium | 5.3 | 0% |
| CVE-2024-13585 | ajax-search (WordPress plugin) | The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege use | low | 3.5 | 0% |
| CVE-2025-7030 | drupal/tfa | This module enables you to allow and/or require a second authentication method in addition to password authentication. | unknown | 0.0 | 0% |
| CVE-2026-44010 | craftcms/cms | Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure | high | 0.0 | 0% |
| CVE-2026-49208 | symfony/ux-live-component | ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor | medium | 0.0 | 0% |
| CVE-2026-55794 | craftcms/cms | Craft CMS: Potential authenticated Remote Code Execution via referrer redirect | high | 0.0 | 0% |
| CVE-2026-86197 | getgrav/grav | Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super | medium | 0.0 | 0% |