Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-1000013 | phpmyadmin/phpmyadmin | phpMyAdmin Open Redirect | medium | 6.1 | 1% |
| CVE-2016-5013 | moodle/moodle | Moodle Does Not Escape Characters In Email Headers | medium | 5.4 | 1% |
| CVE-2009-0816 | typo3/cms | Typo3 Backend XSS Vulnerability | medium | 0.0 | 1% |
| CVE-2010-3715 | typo3/cms-backend | TYPO3 cross-site scripting (XSS) vulnerability in the RemoveXSS function and the backend | medium | 0.0 | 1% |
| CVE-2021-30130 | phpseclib/phpseclib | Improper Certificate Validation in phpseclib | high | 7.5 | 1% |
| CVE-2023-28104 | silverstripe/graphql | DDOS attack on graphql endpoints | high | 7.5 | 1% |
| CVE-2013-4729 | phpmyadmin/phpmyadmin | phpMyAdmin Global variables scope injection vulnerability | medium | 5.4 | 1% |
| CVE-2021-25020 | complete-analytics-optimization-suite (WordPress plugin) | The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privileg | medium | 4.9 | 1% |
| CVE-2021-25021 | optimize-my-google-fonts (WordPress plugin) | The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege u | medium | 4.9 | 1% |
| CVE-2024-8927 | PHP engine | cgi.force_redirect bypass via HTTP_PROXY-style environment variable collision | high | 7.5 | 1% |
| CVE-2022-0579 | snipe/snipe-it | Improper Privilege Management in Snipe-IT | medium | 6.5 | 1% |
| CVE-2015-10100 | dynamic-widgets (WordPress plugin) | A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects so | medium | 6.3 | 1% |
| CVE-2017-2644 | moodle/moodle | Moodle XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2017-2645 | moodle/moodle | Moodle XSS in attachments to evidence of prior learning | medium | 6.1 | 1% |
| CVE-2021-24757 | stylish-price-list (WordPress plugin) | The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to | medium | 5.3 | 1% |
| CVE-2023-4195 | cockpit-hq/cockpit | Cockpit PHP Remote File Inclusion vulnerability | critical | 9.9 | 1% |
| CVE-2022-0404 | material-design-for-contact-form-7 (WordPress plugin) | The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notic | medium | 6.5 | 1% |
| CVE-2011-4332 | joomla/joomla-cms | Joomla! vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2023-4643 | enable-media-replace (WordPress plugin) | The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ | high | 8.8 | 1% |
| CVE-2022-24872 | shopware/core, shopware/platform | Improper Access Control in Shopware | high | 8.1 | 1% |
| CVE-2013-2710 | contextual-related-posts (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to | medium | 6.8 | 1% |
| CVE-2022-1320 | sliderby10web (WordPress plugin) | The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileg | medium | 4.8 | 1% |
| CVE-2022-1394 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high | medium | 4.8 | 1% |
| CVE-2022-1564 | form-maker (WordPress plugin) | The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privil | medium | 4.8 | 1% |
| CVE-2022-35944 | october/system | October CMS Safe Mode bypass leads to authenticated Remote Code Execution | high | 7.2 | 1% |
| CVE-2010-3604 | in2code/powermail | powermail extension for TYPO3 vulnerable to SQL Injection | high | 0.0 | 1% |
| CVE-2022-4445 | fl3r-feelbox (WordPress plugin) | The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJ | critical | 9.8 | 1% |
| CVE-2024-35241 | composer/composer | Composer has a command injection via malicious git branch name | high | 8.8 | 1% |
| CVE-2025-1639 | arolax (WordPress plugin) | The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing cap | high | 8.8 | 1% |
| CVE-2021-39333 | hashthemes-demo-importer (WordPress plugin) | The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all | high | 8.1 | 1% |
| CVE-2022-29445 | popup-box (WordPress plugin) | Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPres | medium | 6.8 | 1% |
| CVE-2019-10010 | league/commonmark | Moderate severity vulnerability that affects league/commonmark | medium | 6.1 | 1% |
| CVE-2019-10134 | moodle/moodle | Moodle Private files uploaded via incoming mail processing could bypass quota restrictions | medium | 4.2 | 1% |
| CVE-2008-5656 | typo3/cms-felogin | typo3/cms-felogin Cross-site Scripting vulnerability | low | 0.0 | 1% |
| CVE-2018-11568 | gameplan-event-and-gym-fitness (WordPress theme) | Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated b | medium | 6.1 | 1% |
| CVE-2021-25065 | smash-balloon-social-post-feed (WordPress plugin) | The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin pa | medium | 5.4 | 1% |
| CVE-2022-0689 | microweber/microweber | Business Logic Errors in microweber | medium | 5.3 | 1% |
| CVE-2022-3241 | build-app-online (WordPress plugin) | The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL stateme | critical | 9.8 | 1% |
| CVE-2022-4099 | joy-of-text-lite (WordPress plugin) | The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements | critical | 9.8 | 1% |
| CVE-2025-6691 | sureforms (WordPress plugin) | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f | high | 8.1 | 1% |
| CVE-2023-5105 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download lo | medium | 6.5 | 1% |
| CVE-2025-46347 | yeswiki/yeswiki | YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution | high | 0.0 | 1% |
| CVE-2023-0340 | custom-content-shortcode (WordPress plugin) | The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a | high | 8.8 | 1% |
| CVE-2026-54718 | symbiote/silverstripe-advancedworkflow | silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template | high | 7.2 | 1% |
| CVE-2021-25096 | country-blocker (WordPress plugin) | The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL | medium | 6.5 | 1% |
| CVE-2020-11094 | rainlab/debugbar-plugin | Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar | medium | 6.1 | 1% |
| CVE-2023-3211 | wordpress-database-administrator (WordPress plugin) | The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a S | critical | 9.8 | 1% |
| CVE-2022-3425 | google-analyticator (WordPress plugin) | The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users suc | high | 7.2 | 1% |
| CVE-2022-4323 | google-analyticator (WordPress plugin) | The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high privilege users suc | high | 7.2 | 1% |
| CVE-2022-4680 | revive-old-posts (WordPress plugin) | The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege user | high | 7.2 | 1% |