Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-9394 | pwgrandom (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the PWGRandom plugin 1.11 and earlier for WordPress allow remote attackers to | medium | 6.8 | 1% |
| CVE-2015-9304 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. | medium | 6.1 | 1% |
| CVE-2016-10872 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form. | medium | 6.1 | 1% |
| CVE-2016-10969 | supportflow (WordPress plugin) | The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title. | medium | 6.1 | 1% |
| CVE-2019-15112 | wp-slimstat (WordPress plugin) | The wp-slimstat plugin before 4.8.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-7490 | moodle/moodle | Moodle Unauthorized searching of arbitrary blogs by typing full url | medium | 5.3 | 1% |
| CVE-2023-30838 | prestashop/prestashop | Possible XSS injection through Validate::isCleanHTML method | high | 8.0 | 1% |
| CVE-2026-40176 | composer/composer | Composer has a command injection via malicious perforce repository | high | 7.8 | 1% |
| CVE-2018-6943 | ultimatemember (WordPress plugin) | core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails | medium | 6.1 | 1% |
| CVE-2021-36568 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2023-4460 | uploading-svg\,-webp-and-ico-files (WordPress plugin) | The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a ro | medium | 5.4 | 1% |
| CVE-2017-9436 | nilsteampassnet/teampass | TeamPass SQL injection in users.queries.php | critical | 9.8 | 1% |
| CVE-2015-9397 | gocodes (WordPress plugin) | The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS. | medium | 5.4 | 1% |
| CVE-2015-9423 | plugnedit (WordPress plugin) | The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dia | medium | 5.4 | 1% |
| CVE-2015-9436 | dynamic-widgets (WordPress plugin) | The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id paramete | medium | 5.4 | 1% |
| CVE-2015-9438 | display-widgets (WordPress plugin) | The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, o | medium | 5.4 | 1% |
| CVE-2015-9426 | manual-image-crop (WordPress plugin) | The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window | medium | 4.6 | 1% |
| CVE-2022-4357 | letsrecover (WordPress plugin) | The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJ | critical | 9.8 | 1% |
| CVE-2008-3226 | joomla/joomla-platform | Joomla! allows attackers to access cached pages | medium | 0.0 | 1% |
| CVE-2020-12075 | data-tables-generator (WordPress plugin) | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions. | high | 8.8 | 1% |
| CVE-2017-7271 | yiisoft/yii2 | Yii Framework Reflected XSS | medium | 6.1 | 1% |
| CVE-2019-7939 | magento/community-edition, magento/product-community-edition | Magento Reflected cross-site scripting on customer cart page | medium | 6.1 | 1% |
| CVE-2020-9003 | modula-best-grid-gallery (WordPress plugin) | A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerabili | medium | 5.4 | 1% |
| CVE-2010-1649 | joomla/joomla-cms | Joomla! vulnerable to Cross-site Scripting | medium | 0.0 | 1% |
| CVE-2025-0493 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclu | critical | 9.8 | 1% |
| CVE-2024-9461 | boldgrid-backup (WordPress plugin) | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in | high | 7.2 | 1% |
| CVE-2017-15867 | user-login-history (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to i | medium | 6.1 | 1% |
| CVE-2018-0587 | ultimate-member (WordPress plugin) | Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to u | medium | 4.3 | 1% |
| CVE-2023-49508 | yetiforce/yetiforce-crm | YetiForceCRM Directory Traversal vulnerability | medium | 6.5 | 1% |
| CVE-2023-6697 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in al | medium | 6.1 | 1% |
| CVE-2019-14948 | woocommerce-product-addon (WordPress plugin) | The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure. | medium | 5.4 | 1% |
| CVE-2023-5434 | superb-slideshow-gallery (WordPress plugin) | The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including | high | 8.8 | 1% |
| CVE-2023-5435 | up-down-image-slideshow-gallery (WordPress plugin) | The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and in | high | 8.8 | 1% |
| CVE-2023-5436 | vertical-marquee-plugin (WordPress plugin) | The Vertical marquee plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 7.1 du | high | 8.8 | 1% |
| CVE-2023-5437 | wp-fade-in-text-news (WordPress plugin) | The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12 | high | 8.8 | 1% |
| CVE-2023-5438 | wp-image-slideshow (WordPress plugin) | The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 | high | 8.8 | 1% |
| CVE-2023-5439 | wp-photo-text-slider-50 (WordPress plugin) | The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, | high | 8.8 | 1% |
| CVE-2023-5464 | jquery-accordion-slideshow (WordPress plugin) | The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and includi | high | 8.8 | 1% |
| CVE-2021-24739 | logo-carousel (WordPress plugin) | The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts | high | 8.1 | 1% |
| CVE-2020-26216 | typo3fluid/fluid | Cross-Site Scripting through Fluid view helper arguments | high | 8.0 | 1% |
| CVE-2022-3249 | wp-csv-exporter (WordPress plugin) | The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement | high | 7.2 | 1% |
| CVE-2022-3578 | profilegrid (WordPress plugin) | The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a R | medium | 6.1 | 1% |
| CVE-2019-15778 | woo-variation-gallery (WordPress plugin) | The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS. | medium | 5.4 | 1% |
| CVE-2023-41592 | froala/wysiwyg-editor | Froala Editor Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-38134 | customer-reviews-woocommerce (WordPress plugin) | Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. | medium | 4.3 | 1% |
| CVE-2022-4383 | cbx-petition-for-wordpress (WordPress plugin) | The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via | critical | 9.8 | 1% |
| CVE-2023-2315 | opencart/opencart | OpenCart Path Traversal vulnerability | high | 8.1 | 1% |
| CVE-2025-3294 | wp-editor (WordPress plugin) | The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and inc | high | 7.2 | 1% |
| CVE-2018-20965 | ultimate-member (WordPress plugin) | The ultimate-member plugin before 2.0.4 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2021-39329 | jobboardwp (WordPress plugin) | The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via sever | medium | 5.5 | 1% |