Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-7888 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Information Disclosure | medium | 6.5 | 1% |
| CVE-2022-3907 | clerk.io (WordPress plugin) | The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage o | high | 7.5 | 1% |
| CVE-2021-39203 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | medium | 6.8 | 1% |
| CVE-2017-5605 | movim/moxl | XMPP Clients User Impersonation Vulnerability in Movim Moxl | medium | 5.9 | 1% |
| CVE-2023-5254 | chatbot (WordPress plugin) | The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_cha | medium | 5.3 | 1% |
| CVE-2020-15151 | openmage/magento-lts | Observable Timing Discrepancy in OpenMage LTS | high | 8.0 | 1% |
| CVE-2017-1000247 | codeigniter4/framework | CodeIgniter HTTP Header Injection | high | 7.5 | 1% |
| CVE-2022-0083 | remdex/livehelperchat | User enumeration in livehelperchat | medium | 0.0 | 1% |
| CVE-2019-7852 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Path Disclosure | medium | 5.3 | 1% |
| CVE-2019-7898 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Information Disclosure | medium | 5.3 | 1% |
| CVE-2019-7899 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Information Disclosure | medium | 5.3 | 1% |
| CVE-2022-23794 | joomla/filesystem | Path Disclosure within joomla/filesystem class | medium | 5.3 | 1% |
| CVE-2009-5158 | google-analyticator (WordPress plugin) | The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text. | medium | 6.1 | 1% |
| CVE-2020-5301 | simplesamlphp/simplesamlphp | Information disclosure of source code in SimpleSAMLphp | low | 3.0 | 1% |
| CVE-2017-18574 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. | medium | 6.1 | 1% |
| CVE-2022-40194 | customer-reviews-woocommerce (WordPress plugin) | Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress | medium | 5.3 | 1% |
| CVE-2022-41623 | dropshipping-and-fulfillment-for-aliexpress-and-woocommerce (WordPress plugin) | Sensitive Data Exposure in Villatheme ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 on WordPress. | high | 7.5 | 1% |
| CVE-2017-7531 | moodle/moodle | Moodle Information Disclosure | medium | 4.3 | 1% |
| CVE-2023-0557 | contentstudio (WordPress plugin) | The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could a | high | 7.5 | 1% |
| CVE-2026-42878 | facturascripts/facturascripts | FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint | medium | 5.3 | 1% |
| CVE-2021-25110 | futurio-extra (WordPress plugin) | The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address. | medium | 4.3 | 1% |
| CVE-2021-37707 | shopware/core, shopware/platform | Manipulation of product reviews via API | medium | 6.5 | 1% |
| CVE-2021-24164 | ninja-forms (WordPress plugin) | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ | medium | 4.3 | 1% |
| CVE-2023-5576 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and includi | high | 8.0 | 1% |
| CVE-2023-38218 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | high | 8.8 | 1% |
| CVE-2021-32720 | sylius/sylius | List of order ids, number, items total and token value exposed for unauthorized uses via new API | medium | 5.3 | 1% |
| CVE-2017-12870 | simplesamlphp/simplesamlphp | SimpleSAMLphp Unauthenticated encryption in CBC mode | medium | 5.9 | 1% |
| CVE-2022-2939 | wp-cerber (WordPress plugin) | The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes use | medium | 5.3 | 1% |
| CVE-2014-8607 | xcloner (WordPress plugin) | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows loca | low | 2.1 | 1% |
| CVE-2014-125093 | ad-blocking-detector (WordPress plugin) | A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability aff | medium | 4.3 | 1% |
| CVE-2023-39530 | prestashop/prestashop | PrestaShop file deletion via CustomerMessage | medium | 6.5 | 1% |
| CVE-2021-40695 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2023-5256 | drupal/core | In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause se | critical | 0.0 | 1% |
| CVE-2022-24953 | pear/crypt_gpg | Crypt_GPG does not prevent additional options in GPG calls | medium | 5.3 | 1% |
| CVE-2015-10012 | sumocoders/framework-user-bundle | FrameworkUserBundle Generates Error Message Containing Sensitive Information | high | 7.5 | 1% |
| CVE-2024-45117 | magento/community-edition | Magento Open Source Improper Input Validation vulnerability | high | 7.6 | 1% |
| CVE-2023-48122 | microweber/microweber | Microweber allows a remote attacker to obtain sensitive information via the HTTP GET method | high | 7.5 | 1% |
| CVE-2024-47823 | livewire/livewire | Livewire Remote Code Execution on File Uploads | high | 7.5 | 1% |
| CVE-2023-2446 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and includ | medium | 6.5 | 1% |
| CVE-2012-3529 | typo3/cms | Typo3 Backend Configuration XSS Vulnerability | low | 0.0 | 1% |
| CVE-2024-5657 | born05/craft-twofactorauthentication | Password hash exposed in CraftCMS two factor authentication plugin | low | 3.7 | 1% |
| CVE-2023-3553 | nilsteampassnet/teampass | TeamPass information exposure vulnerability | high | 7.5 | 1% |
| CVE-2022-24742 | sylius/sylius | Sensitive Information Exposure in Sylius | medium | 5.0 | 1% |
| CVE-2020-25768 | contao/contao, contao/core-bundle | Contao Insert tag injection in forms | medium | 5.3 | 1% |
| CVE-2025-51586 | prestashop/prestashop | Presta Shop vulnerable to email enumeration | medium | 4.2 | 1% |
| CVE-2023-5359 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google O | low | 3.7 | 1% |
| CVE-2024-2106 | masterstudy-lms-learning-management-system (WordPress plugin) | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versio | medium | 5.3 | 1% |
| CVE-2023-26367 | magento/community-edition, magento/project-community-edition | Magento Open Source has Improper Input Validation Vulnerability | medium | 4.9 | 1% |
| CVE-2026-1194 | mineadmin/mineadmin | MineAdmin May Expose Sensitive Information to an Unauthorized Actor | medium | 5.3 | 1% |
| CVE-2023-38871 | gugoan/economizzer | Economizzer user enumeration vulnerability | medium | 5.3 | 1% |