Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-39343 | mpl-publisher (WordPress plugin) | The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via se | medium | 5.5 | 1% |
| CVE-2022-0569 | snipe/snipe-it | Exposure of Sensitive Information in snipe/snipe-it | medium | 4.3 | 1% |
| CVE-2019-18857 | enshrined/svg-sanitize | XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes | high | 7.5 | 1% |
| CVE-2022-0560 | microweber/microweber | Open redirect in microweber | medium | 6.1 | 1% |
| CVE-2023-0994 | francoisjacquet/rosariosis | RosarioSIS Improper Access Control vulnerability | high | 7.5 | 1% |
| CVE-2024-13485 | ltl-freight-quotes-abf-freight-edition (WordPress plugin) | The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' pa | high | 7.5 | 1% |
| CVE-2019-14787 | newsletters-lite (WordPress plugin) | The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor c | medium | 5.4 | 1% |
| CVE-2019-14796 | mq-woocommerce-products-price-bulk-edit (WordPress plugin) | The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/ | medium | 5.4 | 1% |
| CVE-2022-36387 | about-me (WordPress plugin) | Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress. | high | 7.6 | 1% |
| CVE-2023-6295 | siteorigin-widgets-bundle (WordPress plugin) | The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to includ | high | 7.2 | 1% |
| CVE-2016-10891 | aryo-activity-log (WordPress plugin) | The aryo-activity-log plugin before 2.3.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2020-7790 | spatie/browsershot | browsershot local file inclusion vulnerability | medium | 5.3 | 1% |
| CVE-2019-14795 | toggle-the-title (WordPress plugin) | The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isA | medium | 4.8 | 1% |
| CVE-2022-24784 | statamic/cms | Discoverability of user password hash in Statamic CMS | low | 3.7 | 1% |
| CVE-2022-3856 | comic-book-management-system (WordPress plugin) | The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, | high | 7.2 | 1% |
| CVE-2022-3925 | buddybadges (WordPress plugin) | The buddybadges WordPress plugin through 1.0.0 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL | high | 7.2 | 1% |
| CVE-2007-3498 | ezyang/htmlpurifier | HTML Purifier Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2021-32473 | moodle/moodle | Moodle Information Disclosure vulnerability | medium | 5.3 | 1% |
| CVE-2015-9401 | websimon-tables (WordPress plugin) | The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS. | medium | 4.8 | 1% |
| CVE-2019-16522 | eu-cookie-law (WordPress plugin) | The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of sev | medium | 4.8 | 1% |
| CVE-2008-3032 | mehrwert/phpmyadmin | phpMyAdmin extension for TYPO3 has Cross-site Scripting vulnerability | medium | 0.0 | 1% |
| CVE-2024-9939 | wp-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_do | high | 7.5 | 1% |
| CVE-2021-4377 | doneren-met-mollie (WordPress plugin) | The Doneren met Mollie plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.8.5 via the dmm_exp | medium | 6.5 | 1% |
| CVE-2021-27312 | gleez/cms | Gleez Cms Server Side Request Forgery (SSRF) vulnerability | critical | 9.0 | 1% |
| CVE-2015-10099 | cp-appointment-calendar (WordPress plugin) | A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function | medium | 6.3 | 1% |
| CVE-2021-43564 | hov/jobfair | Unrestricted access to predictable file paths in hov/jobfair | high | 7.5 | 1% |
| CVE-2026-43871 | apache/thrift | Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop | high | 7.5 | 1% |
| CVE-2025-13645 | modula-best-grid-gallery (WordPress plugin) | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax | high | 7.2 | 1% |
| CVE-2022-22111 | bottelet/flarepoint | Missing Authorization in DayByDay CRM | high | 8.8 | 1% |
| CVE-2024-0761 | wp-file-manager (WordPress plugin) | The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to ins | high | 8.1 | 1% |
| CVE-2024-13359 | product-input-fields-for-woocommerce (WordPress plugin) | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validati | high | 8.1 | 1% |
| CVE-2020-11056 | barrelstrength/sprout-base-email, barrelstrength/sprout-forms | Potential Code Injection in Sprout Forms | high | 7.4 | 1% |
| CVE-2020-15273 | baserproject/basercms | Edit feed settings and others, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0 | high | 7.3 | 1% |
| CVE-2019-17205 | nilsteampassnet/teampass | TeamPass Stored Cross-site Scripting | medium | 6.1 | 1% |
| CVE-2019-10909 | drupal/core, drupal/drupal, symfony/framework-bundle +1 more | Symfony Cross-site Scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2024-20759 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Cross-Site Scripting (XSS) | high | 8.1 | 1% |
| CVE-2021-24845 | improved-include-page (WordPress plugin) | The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to | medium | 6.5 | 1% |
| CVE-2021-24872 | get-custom-field-values (WordPress plugin) | The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata withou | medium | 6.5 | 1% |
| CVE-2019-16289 | insert-php (WordPress plugin) | The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter. | medium | 5.4 | 1% |
| CVE-2017-16758 | ultimate-instagram-feed (WordPress plugin) | Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for | medium | 4.8 | 1% |
| CVE-2018-6194 | wp-splashing-images (WordPress plugin) | A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-ima | medium | 4.8 | 1% |
| CVE-2016-9866 | phpmyadmin/phpmyadmin | phpMyAdmin CSRF Vulnerability | critical | 9.8 | 1% |
| CVE-2024-4936 | canto (WordPress plugin) | The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. | critical | 9.8 | 1% |
| CVE-2021-24655 | wp-user-manager (WordPress plugin) | The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key give | high | 7.5 | 1% |
| CVE-2022-29446 | counter-box (WordPress plugin) | Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPr | medium | 6.8 | 1% |
| CVE-2022-29447 | hover-effects (WordPress plugin) | Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at W | medium | 6.8 | 1% |
| CVE-2022-29448 | mwp-herd-effect (WordPress plugin) | Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress. | medium | 6.8 | 1% |
| CVE-2023-4536 | my-account-page-editor (WordPress plugin) | The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated us | high | 8.8 | 1% |
| CVE-2023-5428 | image-vertical-reel-scroll-slideshow (WordPress plugin) | The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, a | high | 8.8 | 1% |
| CVE-2023-5429 | information-reel (WordPress plugin) | The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 10.0 d | high | 8.8 | 1% |