Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.1, updated 2026-11-07. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-4092 | yetiforce/yetiforce-crm | yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF) | medium | 4.3 | 0% |
| CVE-2021-4384 | photo-contest (WordPress plugin) | The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin | medium | 4.3 | 0% |
| CVE-2021-4411 | wp-easy-pay (WordPress plugin) | The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2 | medium | 4.3 | 0% |
| CVE-2024-8432 | webba-booking-lite (WordPress plugin) | The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due | medium | 4.3 | 0% |
| CVE-2023-6164 | mainwp (WordPress plugin) | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘new | low | 2.2 | 0% |
| CVE-2026-109413 | symfony/symfony, symfony/yaml | Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process | high | 0.0 | 0% |
| CVE-2023-3547 | all-in-one-b2b-for-woocommerce (WordPress plugin) | The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attac | high | 8.8 | 0% |
| CVE-2023-6966 | the-moneytizer (WordPress plugin) | The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missin | high | 8.1 | 0% |
| CVE-2023-22721 | oi-yandex.maps (WordPress plugin) | Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps for WordPress <= 3.2.7 versions. | medium | 6.5 | 0% |
| CVE-2024-1639 | license-manager-for-woocommerce (WordPress plugin) | The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t | medium | 6.5 | 0% |
| CVE-2023-4887 | intergeo-maps (WordPress plugin) | The Google Maps Plugin by Intergeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shortcode in versions up | medium | 6.4 | 0% |
| CVE-2023-5231 | magic-action-box (WordPress plugin) | The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17 | medium | 6.4 | 0% |
| CVE-2023-5334 | responsive-header-image-slider (WordPress plugin) | The WP Responsive header image slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sp_responsiveslider' shortcode | medium | 6.4 | 0% |
| CVE-2023-5337 | formforall (WordPress plugin) | The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to | medium | 6.4 | 0% |
| CVE-2023-5468 | slick-contact-forms (WordPress plugin) | The Slick Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcscf-link' shortcode in versions up to, and | medium | 6.4 | 0% |
| CVE-2025-52277 | yeswiki/yeswiki | YesWiki Cross Site Scripting vulnerability | medium | 6.1 | 0% |
| CVE-2023-25049 | ecommerce-product-catalog (WordPress plugin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.4 v | medium | 5.9 | 0% |
| CVE-2023-47833 | theater-for-wordpress (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress pl | medium | 5.9 | 0% |
| CVE-2022-29414 | subscribe-to-comments-reloaded (WordPress plugin) | Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress al | medium | 5.4 | 0% |
| CVE-2023-2416 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a mi | medium | 5.4 | 0% |
| CVE-2024-2640 | watu-quiz (WordPress plugin) | The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if | medium | 5.4 | 0% |
| CVE-2024-5416 | elementor (WordPress plugin) | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url | medium | 5.4 | 0% |
| CVE-2021-21395 | openmage/magento-lts | magento-lts Reset Password not protected against well-timed CSRF | medium | 4.3 | 0% |
| CVE-2023-5976 | microweber/microweber | Microweber Improper Access Control vulnerability | medium | 4.3 | 0% |
| CVE-2023-6741 | wp-customer-area (WordPress plugin) | The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malic | medium | 4.3 | 0% |
| CVE-2024-2972 | floating-chat-widget (WordPress plugin) | The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin bef | low | 3.8 | 0% |
| CVE-2026-107249 | drupal/block_ajax | The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user | unknown | 0.0 | 0% |
| CVE-2026-46639 | twig/twig | Twig: Sandbox property and method bypass via object-destructuring assignment | high | 0.0 | 0% |
| CVE-2025-31685 | goalgorilla/open_social | Drupal Open Social Missing Authorization vulnerability | critical | 9.1 | 0% |
| CVE-2023-36237 | bagisto/bagisto | Bagisto Cross-Site Request Forgery vulnerability | high | 8.8 | 0% |
| CVE-2024-13923 | order-import-export-for-woocommerce (WordPress plugin) | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and | high | 7.6 | 0% |
| CVE-2026-61816 | zbateson/mail-mime-parser | zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME | high | 7.5 | 0% |
| CVE-2023-49827 | soledad (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad – Multipurpose, Ne | high | 7.1 | 0% |
| CVE-2023-24003 | wp-popups (WordPress plugin) | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Timersys WP Popups – WordPress Popup plugin <= 2.1.4.8 versions. | medium | 6.5 | 0% |
| CVE-2024-5036 | sina-extension-for-elementor (WordPress plugin) | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu | medium | 6.4 | 0% |
| CVE-2024-5901 | so-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up | medium | 6.4 | 0% |
| CVE-2022-2146 | import-csv-files (WordPress plugin) | The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is | medium | 6.1 | 0% |
| CVE-2023-28851 | andrewhaine/silverstripe-form-capture, bigfork/silverstripe-form-capture | Silverstripe Form Capture vulnerable to stored cross-site-scripting | medium | 6.1 | 0% |
| CVE-2024-6334 | easy-table-of-contents (WordPress plugin) | The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privil | medium | 6.1 | 0% |
| CVE-2021-44777 | email-tracker (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress pl | medium | 5.4 | 0% |
| CVE-2024-1175 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-13316 | scratch-win-giveaways-for-website-facebook (WordPress plugin) | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vu | medium | 5.3 | 0% |
| CVE-2025-2252 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Expo | medium | 5.3 | 0% |
| CVE-2020-36756 | wd-google-analytics (WordPress plugin) | The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.8. This is due to | medium | 4.3 | 0% |
| CVE-2020-36757 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due | medium | 4.3 | 0% |
| CVE-2021-4419 | wp-backgrounds-lite (WordPress plugin) | The WP-Backgrounds Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3. This is due | medium | 4.3 | 0% |
| CVE-2021-4420 | sell-media (WordPress plugin) | The Sell Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.5. This is due to miss | medium | 4.3 | 0% |
| CVE-2021-4421 | advanced-popups (WordPress plugin) | The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to | medium | 4.3 | 0% |
| CVE-2021-4423 | rays-grid (WordPress plugin) | The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missi | medium | 4.3 | 0% |
| CVE-2021-4424 | slider-hero (WordPress plugin) | The Slider Hero plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.0. This is due to mis | medium | 4.3 | 0% |