Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-21641 | flarum/core, flarum/framework | Flarum's logout Route allows open redirects | medium | 6.5 | 1% |
| CVE-2023-1890 | tablesome (WordPress plugin) | The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices a | medium | 6.1 | 1% |
| CVE-2019-12346 | saml-sp-single-sign-on (WordPress plugin) | In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially cr | medium | 6.1 | 1% |
| CVE-2020-12742 | iubenda-cookie-law-solution (WordPress plugin) | The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols. | medium | 6.1 | 1% |
| CVE-2024-21908 | tinymce/tinymce | Cross-site scripting vulnerability in TinyMCE | medium | 6.1 | 1% |
| CVE-2020-6165 | silverstripe/graphql, silverstripe/recipe-cms | Silverstripe has Incorrect Default Permissions | medium | 5.3 | 1% |
| CVE-2021-24154 | theme-editor (WordPress plugin) | The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allo | medium | 4.9 | 1% |
| CVE-2011-2715 | drupal/core | Drupal SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2018-19969 | phpmyadmin/phpmyadmin | phpMyAdmin CSRF Vulnerability | high | 8.8 | 1% |
| CVE-2021-3992 | kevinpapst/kimai2 | kimai2 is vulnerable to Improper Access Control | medium | 6.5 | 1% |
| CVE-2021-3678 | showdoc/showdoc | Use of Cryptographically Weak Pseudo-Random Number Generator in showdoc | medium | 5.9 | 1% |
| CVE-2018-0589 | ultimate-member (WordPress plugin) | Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new | medium | 4.3 | 1% |
| CVE-2018-0590 | ultimate-member (WordPress plugin) | Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the | medium | 4.3 | 1% |
| CVE-2021-33988 | microweber/microweber | Cross Site Scripting in Microweber | medium | 0.0 | 1% |
| CVE-2023-6996 | shortcode-to-display-post-and-user-data (WordPress plugin) | The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin | high | 8.8 | 1% |
| CVE-2024-3499 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via | high | 8.8 | 1% |
| CVE-2024-3500 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Men | high | 8.8 | 1% |
| CVE-2023-5863 | thorsten/phpmyfaq | phpMyFAQ Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2019-14792 | wp-google-maps (WordPress plugin) | The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter. | medium | 5.4 | 1% |
| CVE-2019-15777 | shapepress-dsgvo (WordPress plugin) | The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS. | medium | 5.4 | 1% |
| CVE-2019-15827 | onesignal-free-web-push-notifications (WordPress plugin) | The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter. | medium | 5.4 | 1% |
| CVE-2018-1136 | moodle/moodle | Moodle Cross-site Scripting | medium | 4.3 | 1% |
| CVE-2010-0329 | in2code/powermail | TYPO3 powermail Extension Vulnerable to SQL Injection via Unspecified Vectors | high | 0.0 | 1% |
| CVE-2026-67434 | squizlabs/php_codesniffer | PHP_CodeSniffer gitblame report command injection via crafted filename | high | 0.0 | 1% |
| CVE-2022-3858 | chaty (WordPress plugin) | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not pr | high | 7.2 | 1% |
| CVE-2017-15055 | nilsteampassnet/teampass | TeamPass Improper Privilege Management | high | 8.1 | 1% |
| CVE-2023-6222 | quttera-web-malware-scanner (WordPress plugin) | IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with a | high | 7.2 | 1% |
| CVE-2022-40217 | wpide (WordPress plugin) | Authenticated (admin+) Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. | medium | 6.5 | 1% |
| CVE-2024-9660 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | high | 8.8 | 1% |
| CVE-2022-1511 | snipe/snipe-it | Improper Access Control in snipe/snipe-it | medium | 6.5 | 1% |
| CVE-2017-1000038 | relevanssi (WordPress plugin) | WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affect | medium | 6.1 | 1% |
| CVE-2018-11105 | wp-live-chat-support (WordPress plugin) | There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "emai | medium | 6.1 | 1% |
| CVE-2019-15109 | the-events-calendar (WordPress plugin) | The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter. | medium | 6.1 | 1% |
| CVE-2019-3852 | moodle/moodle | Moodle context freezing | medium | 4.3 | 1% |
| CVE-2021-37702 | pimcore/pimcore | Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore | medium | 0.0 | 1% |
| CVE-2013-4144 | swfupload (WordPress plugin) | There is an object injection vulnerability in swfupload plugin for wordpress. | critical | 9.8 | 1% |
| CVE-2022-25337 | ezsystems/ezpublish-kernel | Code injection in ezsystems/ezpublish-kernel | critical | 9.8 | 1% |
| CVE-2022-24871 | shopware/core, shopware/platform | Server-Side Request Forgery (SSRF) in Shopware | high | 7.2 | 1% |
| CVE-2022-3720 | event-monster (WordPress plugin) | The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which coul | high | 7.2 | 1% |
| CVE-2023-35039 | password-reset-with-code-for-wordpress-rest-api (WordPress plugin) | Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress | critical | 9.8 | 1% |
| CVE-2019-11557 | contact-form-builder (WordPress plugin) | The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with res | high | 8.8 | 1% |
| CVE-2019-11591 | contact-form-maker (WordPress plugin) | The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant l | high | 8.8 | 1% |
| CVE-2021-25957 | dolibarr/dolibarr | Weak Password Recovery Mechanism for Forgotten Password | high | 8.8 | 1% |
| CVE-2021-37711 | shopware/core, shopware/platform | Authenticated server-side request forgery in file upload via URL. | high | 8.8 | 1% |
| CVE-2025-3642 | moodle/moodle | Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository | high | 8.8 | 1% |
| CVE-2014-7238 | contact-form-integrated-with-google-maps (WordPress plugin) | The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS | medium | 6.1 | 1% |
| CVE-2018-20838 | accelerated-mobile-pages (WordPress plugin) | ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS. | medium | 5.4 | 1% |
| CVE-2011-2935 | elgg/elgg | Elgg Reflected XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2020-29603 | mantisbt/mantisbt | MantisBT Insecure Storage in manage_proj_edit_page.php | medium | 4.3 | 1% |
| CVE-2015-10122 | wp-donate (WordPress plugin) | A vulnerability was found in wp-donate Plugin up to 1.4 on WordPress. It has been classified as critical. This affects an unknown part of th | medium | 6.3 | 1% |