Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.1, updated 2026-10-31. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2101 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, | medium | 6.4 | 1% |
| CVE-2016-4056 | typo3/cms | TYPO3 Backend component Cross-site scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2019-14882 | moodle/moodle | Moodle open redirect vulnerability | medium | 6.1 | 1% |
| CVE-2020-36696 | product-input-fields-for-woocommerce (WordPress plugin) | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the | high | 7.5 | 1% |
| CVE-2021-32752 | ether/logs | Files or Directories Accessible to External Parties in ether/logs | high | 7.2 | 1% |
| CVE-2022-0929 | microweber/microweber | Cross-site Scripting in microweber | medium | 6.8 | 1% |
| CVE-2021-39344 | kjm-admin-notices (WordPress plugin) | The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization vi | medium | 5.5 | 1% |
| CVE-2014-5034 | brute-force-login-protection (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hija | high | 8.8 | 1% |
| CVE-2015-9500 | exquisite-ultimate-newspaper (WordPress theme) | The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js. | medium | 6.1 | 1% |
| CVE-2019-16108 | phpbb/phpbb | phpBB arbitrary CSS injection | high | 7.5 | 1% |
| CVE-2023-2493 | all-in-one-redirection (WordPress plugin) | The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an S | high | 7.2 | 1% |
| CVE-2015-5337 | moodle/moodle | Moodle XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-35651 | moodle/moodle | Moodle Stored XSS and blind SSRF possible via SCORM track details | medium | 6.1 | 1% |
| CVE-2016-6625 | phpmyadmin/phpmyadmin | phpMyAdmin allows to detect if user is logged in | medium | 4.3 | 1% |
| CVE-2013-2705 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote a | medium | 6.8 | 1% |
| CVE-2014-3882 | login-rebuilder (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Login rebuilder plugin before 1.2.0 for WordPress allows remote attackers to hijack t | medium | 6.8 | 1% |
| CVE-2015-0895 | all-in-one-wp-security-and-firewall (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote att | medium | 6.8 | 1% |
| CVE-2023-50891 | zoho-forms (WordPress plugin) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Forms Form plugin for WordPress – | medium | 6.5 | 1% |
| CVE-2021-28381 | fluidtypo3/vhs | SQL injection in vhs (aka VHS: Fluid ViewHelpers) | medium | 5.4 | 1% |
| CVE-2022-29423 | countdown-builder (WordPress plugin) | Pro Features Lock Bypass vulnerability in Countdown & Clock plugin <= 2.3.2 at WordPress. | low | 3.8 | 1% |
| CVE-2017-7888 | dolibarr/dolibarr | Dolibarr ERP and CRM Insecure Encryption | critical | 9.8 | 1% |
| CVE-2024-1981 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_prefix' parameter in version 0.9 | critical | 9.8 | 1% |
| CVE-2021-21427 | openmage/magento-lts | Backport for CVE-2021-21024 Blind SQLi from Magento 2 | critical | 9.1 | 1% |
| CVE-2018-19992 | dolibarr/dolibarr | Dolibarr stored cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2022-29411 | hermit (WordPress plugin) | SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers to execute SQLi attack via (&id). | high | 8.3 | 1% |
| CVE-2021-44779 | gwa-autoresponder (WordPress plugin) | Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&lis | high | 7.3 | 1% |
| CVE-2023-1307 | froxlor/froxlor | Froxlor is vulnerable to authentication bypass | critical | 9.8 | 1% |
| CVE-2023-36260 | craftcms/cms | Craft CMS Feed-Me | high | 7.5 | 1% |
| CVE-2020-35934 | advanced-access-manager (WordPress plugin) | The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via th | medium | 4.3 | 1% |
| CVE-2022-0588 | librenms/librenms | Missing Authorization in librenms/librenms | medium | 6.5 | 1% |
| CVE-2024-6312 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af | medium | 6.5 | 1% |
| CVE-2023-38877 | gugoan/economizzer | Economizzer host header injection vulnerability | high | 8.8 | 1% |
| CVE-2013-2698 | calendar (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the auth | medium | 6.8 | 1% |
| CVE-2013-3257 | related-posts (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the | medium | 6.8 | 1% |
| CVE-2013-3258 | digg-digg (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the auth | medium | 6.8 | 1% |
| CVE-2013-3476 | wordpress-23-related-posts-plugin (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts plugin before 2.6.2 for WordPress allows remote attackers to | medium | 6.8 | 1% |
| CVE-2013-3477 | related-posts-by-zemanta (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Related Posts by Zemanta plugin before 1.3.2 for WordPress allows remote attackers to | medium | 6.8 | 1% |
| CVE-2014-3907 | wysija-newsletters (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 for WordPress allows r | medium | 6.8 | 1% |
| CVE-2020-6166 | minimal-coming-soon-maintenance-mode (WordPress plugin) | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export | medium | 5.4 | 1% |
| CVE-2015-9445 | unite-gallery-lite (WordPress plugin) | The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action | high | 8.8 | 1% |
| CVE-2015-6926 | oxid-esales/oxideshop-ce | OXID eShop user impersonation vulnerability | high | 7.5 | 1% |
| CVE-2017-6931 | drupal/core, drupal/drupal | Drupal Settings Tray access bypass | medium | 6.5 | 1% |
| CVE-2023-38207 | magento/community-edition, magento/project-community-edition | Magento Open Source allows XML Injection | medium | 5.3 | 1% |
| CVE-2023-38499 | typo3/cms-core | Information Disclosure due to Out-of-scope Site Resolution | low | 3.7 | 1% |
| CVE-2019-19306 | zoho-crm-forms (WordPress plugin) | The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName. | medium | 5.4 | 1% |
| CVE-2024-7770 | file-manager (WordPress plugin) | The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary fi | high | 8.8 | 1% |
| CVE-2021-41938 | shopxo/shopxo | Arbitrary file upload in ShopXO | high | 7.2 | 1% |
| CVE-2026-30940 | baserproject/basercms | baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API | high | 7.2 | 1% |
| CVE-2019-17106 | centreon/centreon | Centreon Sensitive Data Exposure | medium | 6.5 | 1% |
| CVE-2024-21641 | flarum/core, flarum/framework | Flarum's logout Route allows open redirects | medium | 6.5 | 1% |