Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.31.2, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-25044 | cryptocurrency-pricing-list-and-ticker (WordPress plugin) | The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outpu | medium | 6.1 | 1% |
| CVE-2022-2654 | classified-listing (WordPress plugin), classified-listing-store-\&-membership (WordPress plugin), classima (WordPress plugin) +1 more | The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before | medium | 6.1 | 1% |
| CVE-2022-2669 | wp-taxonomy-import (WordPress plugin) | The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leadin | medium | 6.1 | 1% |
| CVE-2022-3209 | soledad (WordPress plugin) | The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX a | medium | 6.1 | 1% |
| CVE-2020-14146 | kumbiaphp/kumbiapp | KumbiaPHP Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-24665 | wp-video-lightbox (WordPress plugin) | The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as c | medium | 5.4 | 1% |
| CVE-2021-42361 | contact-form-to-email (WordPress plugin) | The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via t | medium | 4.8 | 1% |
| CVE-2024-12878 | lazy-blocks (WordPress plugin) | The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, lead | high | 7.1 | 1% |
| CVE-2018-16327 | intelliants/subrion | Subrion Cross-site Scripting (XSS) | medium | 4.8 | 1% |
| CVE-2021-24296 | wp-customer-reviews (WordPress plugin) | The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administr | medium | 4.8 | 1% |
| CVE-2021-24327 | seo-redirection-plugin (WordPress plugin) | The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when | medium | 4.8 | 1% |
| CVE-2021-24378 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Setti | medium | 4.8 | 1% |
| CVE-2021-24381 | contact-form (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, w | medium | 4.8 | 1% |
| CVE-2021-24440 | sign-up-sheets (WordPress plugin) | The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high pri | medium | 4.8 | 1% |
| CVE-2021-24485 | wp-special-textboxes (WordPress plugin) | The Special Text Boxes WordPress plugin before 5.9.110 does not sanitise or escape some of its settings, which could allow high privilege us | medium | 4.8 | 1% |
| CVE-2021-24514 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin | medium | 4.8 | 1% |
| CVE-2021-24515 | video-gallery (WordPress plugin) | The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them | medium | 4.8 | 1% |
| CVE-2021-24524 | givewp (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donati | medium | 4.8 | 1% |
| CVE-2021-24530 | alojapro-widget (WordPress plugin) | The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perf | medium | 4.8 | 1% |
| CVE-2021-24533 | maintenance (WordPress plugin) | The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin t | medium | 4.8 | 1% |
| CVE-2021-24569 | cookie-notice-\&-compliance-for-gdpr-\/-ccpa (WordPress plugin) | The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outpu | medium | 4.8 | 1% |
| CVE-2021-24592 | sitewide-notice (WordPress plugin) | The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing | medium | 4.8 | 1% |
| CVE-2021-24600 | wp-dialog (WordPress plugin) | The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing h | medium | 4.8 | 1% |
| CVE-2021-24604 | availability-calendar (WordPress plugin) | The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post w | medium | 4.8 | 1% |
| CVE-2021-24607 | storefront-footer-text (WordPress plugin) | The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing hig | medium | 4.8 | 1% |
| CVE-2021-24609 | wp-mapa-politico-espana (WordPress plugin) | The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attribu | medium | 4.8 | 1% |
| CVE-2021-24613 | post-views-counter (WordPress plugin) | The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privi | medium | 4.8 | 1% |
| CVE-2021-24614 | book-appointment-online (WordPress plugin) | The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which | medium | 4.8 | 1% |
| CVE-2021-24619 | per-page-add-to-head (WordPress plugin) | The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserte | medium | 4.8 | 1% |
| CVE-2021-24621 | wp-courses-lms (WordPress plugin) | The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by hi | medium | 4.8 | 1% |
| CVE-2021-24623 | wordpress-advanced-ticket-system (WordPress plugin) | The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before s | medium | 4.8 | 1% |
| CVE-2021-24645 | booking.com-product-helper (WordPress plugin) | The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, whic | medium | 4.8 | 1% |
| CVE-2021-24646 | booking.com-banner-creator (WordPress plugin) | The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high | medium | 4.8 | 1% |
| CVE-2021-24653 | cookie-bar (WordPress plugin) | The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege user | medium | 4.8 | 1% |
| CVE-2021-24656 | simple-social-buttons (WordPress plugin) | The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the fro | medium | 4.8 | 1% |
| CVE-2021-24673 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege user | medium | 4.8 | 1% |
| CVE-2021-24687 | modern-events-calendar-lite (WordPress plugin) | The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, al | medium | 4.8 | 1% |
| CVE-2021-24700 | forminator (WordPress plugin) | The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to | medium | 4.8 | 1% |
| CVE-2021-24701 | quiz-tool-lite (WordPress plugin) | The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managing quizzes and in oth | medium | 4.8 | 1% |
| CVE-2021-24706 | qwizcards (WordPress plugin) | The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allow | medium | 4.8 | 1% |
| CVE-2021-24708 | wp-all-export (WordPress plugin) | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Expo | medium | 4.8 | 1% |
| CVE-2021-24709 | weather-effect (WordPress plugin) | The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf | medium | 4.8 | 1% |
| CVE-2021-24713 | video-lessons-manager (WordPress plugin) | The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize | medium | 4.8 | 1% |
| CVE-2021-24714 | wp-all-import (WordPress plugin) | The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outpu | medium | 4.8 | 1% |
| CVE-2021-24718 | contact-form\,-survey-\&-popup-form-plugin-for-wordpress---arforms-form-builder (WordPress plugin) | The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high p | medium | 4.8 | 1% |
| CVE-2021-24737 | wpdiscuz (WordPress plugin) | The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputti | medium | 4.8 | 1% |
| CVE-2021-24744 | contact-forms (WordPress plugin) | The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in so | medium | 4.8 | 1% |
| CVE-2021-24768 | wp-rss-aggregator (WordPress plugin) | The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HT | medium | 4.8 | 1% |
| CVE-2021-24771 | inspirational-quote-rotator (WordPress plugin) | The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a q | medium | 4.8 | 1% |
| CVE-2021-24782 | flex-local-fonts (WordPress plugin) | The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privile | medium | 4.8 | 1% |