Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5430 | jquery-news-ticker (WordPress plugin) | The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 | high | 8.8 | 1% |
| CVE-2023-5431 | left-right-image-slideshow-gallery (WordPress plugin) | The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and | high | 8.8 | 1% |
| CVE-2023-5433 | message-ticker (WordPress plugin) | The Message ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.2 due | high | 8.8 | 1% |
| CVE-2026-49970 | plank/laravel-mediable | Laravel-Mediable: path traversal vulnerability in the File::sanitizePath() | high | 8.8 | 1% |
| CVE-2018-0579 | wonderm00ns-simple-facebook-open-graph-tags (WordPress plugin) | Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress a | medium | 6.1 | 1% |
| CVE-2020-29315 | zoujingli/thinkadmin | Cross-site scripting in ThinkAdmin | medium | 5.4 | 1% |
| CVE-2024-10625 | woocommerce-support-ticket-system (WordPress plugin) | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation | critical | 9.8 | 1% |
| CVE-2024-7777 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | critical | 9.0 | 1% |
| CVE-2024-4397 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th | high | 8.8 | 1% |
| CVE-2024-7149 | wp-event-solution (WordPress plugin) | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versi | high | 8.8 | 1% |
| CVE-2020-28707 | stockdio-historical-chart (WordPress plugin) | The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.j | medium | 6.1 | 1% |
| CVE-2025-25286 | islandora/crayfish | Crayfish allows Remote Code Execution via Homarus Authorization header | critical | 9.8 | 1% |
| CVE-2018-5361 | wpglobus (WordPress plugin), wpglobus/wpglobus | The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php. | high | 8.8 | 1% |
| CVE-2014-3850 | member-approval (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the aut | medium | 6.8 | 1% |
| CVE-2019-1000011 | api-platform/core | Incorrect Access Control vulnerability in api-platform/core | medium | 6.5 | 1% |
| CVE-2022-25810 | transposh-wordpress-translation (WordPress plugin) | The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utili | medium | 6.5 | 1% |
| CVE-2020-9459 | modern-events-calendar-lite (WordPress plugin) | Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allo | medium | 5.4 | 1% |
| CVE-2019-16524 | easy-fancybox (WordPress plugin) | The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfan | medium | 4.8 | 1% |
| CVE-2022-0414 | dolibarr/dolibarr | Dolibarr vulnerable to Improper Validation of Specified Quantity in Input | medium | 4.3 | 1% |
| CVE-2023-1337 | unusedcss (WordPress plugin) | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the | medium | 4.3 | 1% |
| CVE-2019-3849 | moodle/moodle | Moodle Users could elevate their role when accessing the LTI tool on a provider site | high | 8.8 | 1% |
| CVE-2021-37627 | contao/contao, contao/core-bundle | Privilege escalation via form generator | high | 8.0 | 1% |
| CVE-2023-5860 | icons-font-loader (WordPress plugin) | The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload functio | high | 7.2 | 1% |
| CVE-2024-6459 | news-element (WordPress plugin) | The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. Thi | critical | 9.8 | 1% |
| CVE-2023-47621 | doublethreedigital/guest-entries, duncanmcclean/guest-entries | Guest Entries Remote code execution via file uploads | high | 8.8 | 1% |
| CVE-2022-3762 | booster-for-woocommerce (WordPress plugin) | The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for Woo | medium | 6.5 | 1% |
| CVE-2018-18460 | wp-live-chat-support (WordPress plugin) | XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivech | medium | 6.1 | 1% |
| CVE-2018-9020 | events-manager (WordPress plugin) | The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature. | medium | 5.4 | 1% |
| CVE-2024-5709 | page-builder (WordPress plugin) | The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'l | high | 8.8 | 1% |
| CVE-2026-32756 | admidio/admidio | File Upload(RCE) Vulnerability in admidio | high | 8.8 | 1% |
| CVE-2026-45793 | composer/composer | Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs | high | 7.5 | 1% |
| CVE-2023-3155 | nextgen-gallery (WordPress plugin) | The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter v | high | 7.2 | 1% |
| CVE-2018-18017 | slideshow-gallery (WordPress plugin) | XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gal | medium | 6.1 | 1% |
| CVE-2018-18019 | slideshow-gallery (WordPress plugin) | XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[ | medium | 6.1 | 1% |
| CVE-2022-0587 | librenms/librenms | Improper Authorization in librenms | high | 7.1 | 1% |
| CVE-2015-9447 | unite-gallery-lite (WordPress plugin) | The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters. | medium | 6.5 | 1% |
| CVE-2015-9386 | mtouch-quiz (WordPress plugin) | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation. | medium | 6.1 | 1% |
| CVE-2015-9416 | sitepress-multilingual-cms (WordPress plugin) | The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header. | medium | 6.1 | 1% |
| CVE-2015-9459 | searchterms-tagging-2 (WordPress plugin) | The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter. | medium | 6.1 | 1% |
| CVE-2016-10957 | akal (WordPress theme) | The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter. | medium | 6.1 | 1% |
| CVE-2016-10961 | colorway (WordPress theme) | The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter. | medium | 6.1 | 1% |
| CVE-2016-10964 | dwnldr (WordPress plugin) | The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header. | medium | 6.1 | 1% |
| CVE-2016-10967 | real3d-flipbook-lite (WordPress plugin) | The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter | medium | 6.1 | 1% |
| CVE-2016-11005 | instalinker (WordPress plugin) | The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS. | medium | 6.1 | 1% |
| CVE-2019-14774 | woo-variation-swatches (WordPress plugin) | The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=w | medium | 6.1 | 1% |
| CVE-2018-5212 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit | medium | 5.4 | 1% |
| CVE-2018-5213 | simple-download-monitor (WordPress plugin) | The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action | medium | 5.4 | 1% |
| CVE-2017-6928 | drupal/core, drupal/drupal | Drupal access bypass vulnerability | medium | 5.3 | 1% |
| CVE-2021-32645 | hyn/multi-tenant | Open Redirect | medium | 4.3 | 1% |
| CVE-2022-3827 | centreon/centreon | Centreon vulnerable to SQL Injection | critical | 9.8 | 1% |