Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-10996 | optinmonster (WordPress plugin) | The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak. | medium | 5.3 | 1% |
| CVE-2023-29291 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 4.9 | 1% |
| CVE-2023-48966 | zoujingli/thinkadmin | ThinkAdmin arbitrary file upload vulnerability | high | 8.8 | 1% |
| CVE-2019-10764 | simplito/elliptic-php | Timing attacks might allow practical recovery of the long-term private key | high | 7.4 | 1% |
| CVE-2021-41126 | october/october, october/system | Deleted Admin Can Sign In to Admin Interface | high | 7.2 | 1% |
| CVE-2020-10195 | popup-builder (WordPress plugin) | The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege | medium | 6.3 | 1% |
| CVE-2021-24526 | form-maker (WordPress plugin) | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title be | medium | 5.4 | 1% |
| CVE-2021-25067 | landing-page (WordPress plugin) | The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page. | medium | 5.4 | 1% |
| CVE-2024-11642 | ajax-filter-posts (WordPress plugin) | The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builde | critical | 9.8 | 1% |
| CVE-2020-9454 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a | high | 8.8 | 1% |
| CVE-2020-24941 | laravel/framework | Improper Input Validation in Laravel | high | 7.5 | 1% |
| CVE-2013-3252 | wp-postviews (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote | medium | 6.8 | 1% |
| CVE-2023-2341 | pimcore/pimcore | Cross-site Scripting (XSS) in Admin Login too many attempts notice | medium | 6.1 | 1% |
| CVE-2019-14979 | paypal-checkout-payment-gateway (WordPress plugin) | cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amo | medium | 5.3 | 1% |
| CVE-2023-25655 | baserproject/basercms | baserCMS allows any file to be uploaded | critical | 9.8 | 1% |
| CVE-2022-2441 | imagemagick-engine (WordPress plugin) | The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and inclu | high | 8.8 | 1% |
| CVE-2023-1196 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, w | high | 8.8 | 1% |
| CVE-2024-10873 | lastudio-element-kit (WordPress plugin) | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4 | high | 8.8 | 1% |
| CVE-2024-11954 | pimcore/pimcore | Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document | high | 8.1 | 1% |
| CVE-2021-32476 | moodle/moodle | Moodle denial-of-service risk in the draft files area | high | 7.5 | 1% |
| CVE-2024-24926 | brooklyn (WordPress plugin) | Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affe | high | 7.5 | 1% |
| CVE-2020-25828 | mediawiki/core | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2022-35652 | moodle/moodle | Moodle Open redirect risk in mobile auto-login feature | medium | 6.1 | 1% |
| CVE-2021-27673 | tribalsystems/zenario | reflected XSS in tribalsystems/zenario | medium | 4.8 | 1% |
| CVE-2008-5644 | typo3/cms-backend | TYPO3 Cross-site Scripting vulnerability in the file backend module | medium | 0.0 | 1% |
| CVE-2011-2509 | joomla/joomla-cms | Joomla! vulnerable to Cross-site Scripting | medium | 0.0 | 1% |
| CVE-2019-18982 | pimcore/pimcore | Pimcore Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2021-20751 | ec-cube/ec-cube | EC-CUBE Cross-site scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-26980 | nilsteampassnet/teampass | Cross-site Scripting in teampass | medium | 6.1 | 1% |
| CVE-2019-12566 | wp-statistics (WordPress plugin) | The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an accoun | medium | 5.4 | 1% |
| CVE-2017-20192 | formidable (WordPress plugin) | The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form | high | 8.3 | 1% |
| CVE-2021-41559 | silverstripe/framework | Quadratic blowup in Convert::xml2array() | medium | 6.5 | 1% |
| CVE-2012-0797 | moodle/moodle | Moodle Users Can Bypass Deleted Status | medium | 0.0 | 1% |
| CVE-2022-0266 | remdex/livehelperchat | Authorization Bypass Through User-Controlled Key in LiveHelperChat | medium | 6.5 | 1% |
| CVE-2017-1000506 | mautic/core | Mautic Cross Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2022-4237 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX | high | 8.8 | 1% |
| CVE-2021-36898 | quiz-master-next (WordPress plugin) | Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress. | high | 7.5 | 1% |
| CVE-2021-24135 | wp-customer-reviews (WordPress plugin) | Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cr | medium | 6.1 | 1% |
| CVE-2010-4616 | impresscms/impresscms | ImpressCMS Cross-site Scripting vulnerability via quicksearch_ContentContent parameter | medium | 0.0 | 1% |
| CVE-2022-4940 | wc-multivendor-membership (WordPress plugin) | The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.1 | high | 7.3 | 1% |
| CVE-2023-1124 | wp-easycart (WordPress plugin) | The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin p | high | 7.2 | 1% |
| CVE-2018-6591 | jcbrand/converse.js | Converse.js Exposure of Sensitive Information | medium | 5.3 | 1% |
| CVE-2010-4961 | dmk/webkitpdf | Webkit PDFs for TYPO3 has SQL Injection vulnerability | high | 0.0 | 1% |
| CVE-2020-36070 | tcg/voyager | Remote code execution in Voyager | critical | 9.8 | 1% |
| CVE-2018-14020 | oxid-esales/paymorrow-module | Paymorrow Improper Input Validation vulnerability | medium | 5.3 | 1% |
| CVE-2014-8327 | co-stack/fal_sftp, vertexvaar/falsftp | fal_sftp extension for TYPO3 uses weak permissions for sFTP driver files and folders | medium | 0.0 | 1% |
| CVE-2013-2693 | wp-print (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Options in the WP-Print plugin before 2.52 for WordPress allows remote attackers to h | medium | 6.8 | 1% |
| CVE-2020-28040 | WordPress core | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. | medium | 4.3 | 1% |
| CVE-2025-0357 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_contr | critical | 9.8 | 1% |
| CVE-2022-3708 | web-stories (WordPress plugin) | The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficien | critical | 9.6 | 1% |