Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.07.2, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-55072 | pimcore/pimcore | Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name | high | 8.5 | 0% |
| CVE-2026-76087 | verbb/formie | Formie: Unauthenticated users can overwrite incomplete submissions via submit action | high | 8.2 | 0% |
| CVE-2022-2762 | adminpad (WordPress plugin) | The AdminPad WordPress plugin before 2.2 does not have CSRF check when updating admin's note, allowing attackers to make a logged in admin u | medium | 6.5 | 0% |
| CVE-2022-4107 | smsa-shipping-for-woocommerce (WordPress plugin) | The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not vali | medium | 6.5 | 0% |
| CVE-2023-47839 | ecommerce-product-catalog (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Pl | medium | 6.5 | 0% |
| CVE-2024-10717 | styler-for-ninja-forms-lite (WordPress plugin) | The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due | medium | 6.5 | 0% |
| CVE-2025-49579 | starcitizentools/citizen-skin | starcitizentools/citizen-skin allows stored XSS in menu heading message | medium | 6.5 | 0% |
| CVE-2026-72698 | getgrav/grav | Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths | medium | 6.5 | 0% |
| CVE-2025-24530 | phpmyadmin/phpmyadmin | phpMyAdmin XSS when checking tables | medium | 6.4 | 0% |
| CVE-2024-2325 | link-library (WordPress plugin) | The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchll parameter in all versions up to, and | medium | 6.1 | 0% |
| CVE-2024-6843 | chatbot-with-chatgpt (WordPress plugin) | The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to | medium | 6.1 | 0% |
| CVE-2024-3189 | kadence-blocks (WordPress plugin) | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu | medium | 5.4 | 0% |
| CVE-2024-39418 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability | medium | 5.4 | 0% |
| CVE-2024-1044 | customer-reviews-for-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che | medium | 5.3 | 0% |
| CVE-2024-12041 | directorist (WordPress plugin) | The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Informati | medium | 5.3 | 0% |
| CVE-2026-35545 | roundcube/roundcubemail | Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message | medium | 5.3 | 0% |
| CVE-2023-2557 | currency-switcher (WordPress plugin) | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing | medium | 4.3 | 0% |
| CVE-2023-2561 | gallery-metabox (WordPress plugin) | The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove | medium | 4.3 | 0% |
| CVE-2024-13450 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | low | 3.8 | 0% |
| CVE-2026-41890 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess | medium | 0.0 | 0% |
| CVE-2025-67510 | neuron-core/neuron-ai | Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”) | critical | 9.4 | 0% |
| CVE-2020-36669 | jetbackup (WordPress plugin) | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includi | high | 8.8 | 0% |
| CVE-2024-13370 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 6.5 | 0% |
| CVE-2024-4616 | widget-bundle (WordPress plugin) | The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to | medium | 6.1 | 0% |
| CVE-2024-4857 | fs-product-inquiry (WordPress plugin) | The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape some form submissions, which could allow unauthenticated | medium | 6.1 | 0% |
| CVE-2024-13821 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, | medium | 5.3 | 0% |
| CVE-2026-24422 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Public API endpoints expose emails and invisible questions | medium | 5.3 | 0% |
| CVE-2021-4402 | multiple-roles (WordPress plugin) | The Multiple Roles plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to | medium | 4.3 | 0% |
| CVE-2022-1251 | ask-me (WordPress plugin) | The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an at | medium | 4.3 | 0% |
| CVE-2024-33851 | mdanter/ecc, paragonie/ecc | mdanter/ecc affected by timing vulnerability in cryptographic side-channels | medium | 4.3 | 0% |
| CVE-2023-4916 | login-with-phone-number (WordPress plugin) | The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This i | high | 8.8 | 0% |
| CVE-2024-5685 | snipe/snipe-it | Snipe-IT allows users to promote or demote themselves or other users | high | 8.1 | 0% |
| CVE-2024-7425 | wp-all-export (WordPress plugin) | The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to i | medium | 6.8 | 0% |
| CVE-2022-3419 | automatic-user-roles-switcher (WordPress plugin) | The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticat | medium | 6.5 | 0% |
| CVE-2024-11895 | paypal-payment-button-by-vcita (WordPress plugin) | The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin | medium | 6.4 | 0% |
| CVE-2024-7082 | easy-table-of-contents (WordPress plugin) | The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role | medium | 6.1 | 0% |
| CVE-2024-8656 | wpcodefactory-helper (WordPress plugin) | The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriat | medium | 6.1 | 0% |
| CVE-2022-38093 | all-in-one-seo (WordPress plugin) | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress. | medium | 5.4 | 0% |
| CVE-2025-30150 | shopware/core, shopware/platform | Shopware 6 allows attackers to check for registered accounts through the store-api | medium | 5.3 | 0% |
| CVE-2024-8899 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via t | medium | 4.3 | 0% |
| CVE-2025-12558 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 4.3 | 0% |
| CVE-2026-48808 | twig/twig | Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` | medium | 0.0 | 0% |
| CVE-2026-96356 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2023-2629 | pimcore/customer-management-framework-bundle | Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection | high | 7.8 | 0% |
| CVE-2024-1385 | wp-stateless (WordPress plugin) | The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on | high | 7.1 | 0% |
| CVE-2024-4566 | woolentor-addons (WordPress plugin) | The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss | high | 7.1 | 0% |
| CVE-2026-114508 | laravel/framework | Laravel relationship inclusion can trigger unauthorized data destruction | medium | 6.5 | 0% |
| CVE-2024-0897 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in | medium | 6.4 | 0% |
| CVE-2024-1080 | beaver-builder-lite-version (WordPress plugin) | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via the heading tag in | medium | 6.4 | 0% |
| CVE-2024-1242 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all v | medium | 6.4 | 0% |