Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-35129 | mautic/core | Mautic stored Cross-site Scripting (XSS) | critical | 9.0 | 1% |
| CVE-2017-18260 | dolibarr/dolibarr | Dolibarr SQL injection vulnerability | high | 8.8 | 1% |
| CVE-2017-9839 | dolibarr/dolibarr | Dolibarr SQL injection via type parameter in product/stats/card.php | high | 8.8 | 1% |
| CVE-2019-15830 | icegram (WordPress plugin) | The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS. | medium | 5.4 | 1% |
| CVE-2022-1850 | filegator/filegator | Path Traversal in FileGator | medium | 5.4 | 1% |
| CVE-2022-25601 | contact-form-x (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4). | medium | 4.7 | 1% |
| CVE-2023-5466 | wp-anything-slider (WordPress plugin) | The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 | high | 8.8 | 1% |
| CVE-2023-22248 | magento/community-edition, magento/project-community-edition | Magento Open Source affected by Improper Input Validation | high | 7.5 | 1% |
| CVE-2017-16815 | duplicator (WordPress plugin) | installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values | medium | 6.1 | 1% |
| CVE-2013-7081 | typo3/cms-core | TYPO3 Improper Access Control vulnerability | medium | 0.0 | 1% |
| CVE-2014-0122 | moodle/moodle | Moodle allows bypass of intended access restrictions | medium | 0.0 | 1% |
| CVE-2014-3553 | moodle/moodle | Moodle does not enforce the moodle/site:accessallgroups capability requirement | medium | 0.0 | 1% |
| CVE-2023-28447 | smarty/smarty | smarty Cross-site Scripting vulnerability in Javascript escaping | high | 7.1 | 1% |
| CVE-2016-11085 | quiz-and-survey-master (WordPress plugin) | php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the | medium | 6.5 | 1% |
| CVE-2019-19980 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber | medium | 4.3 | 1% |
| CVE-2014-5274 | phpmyadmin/phpmyadmin | phpMyAdmin cross-site scripting vulnerability in crafted view name | low | 0.0 | 1% |
| CVE-2014-9335 | dandyid-services (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attac | medium | 6.8 | 1% |
| CVE-2014-9336 | itwitter (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the iTwitter plugin 0.04 and earlier for WordPress allow remote attackers to h | medium | 6.8 | 1% |
| CVE-2014-9393 | post-to-twitter (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attacker | medium | 6.8 | 1% |
| CVE-2014-9396 | simpleflickr (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleFlickr plugin 3.0.3 and earlier for WordPress allow remote attackers | medium | 6.8 | 1% |
| CVE-2014-9397 | twimp-wp (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the twimp-wp plugin for WordPress allows remote attackers to hijack the authentication of | medium | 6.8 | 1% |
| CVE-2014-9400 | wp-unique-article-header-image (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow | medium | 6.8 | 1% |
| CVE-2014-9401 | wp-limit-posts-automatically (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attac | medium | 6.8 | 1% |
| CVE-2014-9437 | sliding-social-icons (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to h | medium | 6.8 | 1% |
| CVE-2014-9441 | lightbox-photo-gallery (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to | medium | 6.8 | 1% |
| CVE-2022-23494 | tinymce/tinymce | Cross-site scripting vulnerability in TinyMCE alerts | medium | 5.4 | 1% |
| CVE-2017-2576 | moodle/moodle | Moodle Incorrect sanitation of attributes in forums | medium | 5.3 | 1% |
| CVE-2013-4662 | civicrm/civicrm-core | CiviCRM SQL injection vulnerability via Quick Search API | medium | 0.0 | 1% |
| CVE-2024-4351 | tutor-lms (WordPress plugin) | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing cap | high | 8.8 | 1% |
| CVE-2021-43515 | kevinpapst/kimai2 | Improper Neutralization of Formula Elements in a CSV File in Kimai 2 | high | 7.8 | 1% |
| CVE-2014-2838 | gd-star-rating (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2023-1970 | yuan1994/tpadmin | yuan1994 tpAdmin Unrestricted Upload of File with Dangerous Type vulnerability | high | 7.2 | 1% |
| CVE-2021-36793 | lms/routes | CSRF token exposure in TYPO3 extension | medium | 6.8 | 1% |
| CVE-2023-29293 | magento/community-edition, magento/project-community-edition | Magento Open Source affected by Improper Input Validation | low | 2.7 | 1% |
| CVE-2015-9233 | cp-contact-form-with-paypal (WordPress plugin) | The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to | high | 8.8 | 1% |
| CVE-2022-0991 | admidio/admidio | Insufficient Session Expiration in Admidio | high | 8.2 | 1% |
| CVE-2023-4800 | dologin-security (WordPress plugin) | The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privi | medium | 6.5 | 1% |
| CVE-2017-5870 | opensolutions/vimbadmin | ViMbAdmin Cross-site Scripting Vulnerabilities | medium | 5.4 | 1% |
| CVE-2021-24371 | rsvpmaker (WordPress plugin) | The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and | low | 2.7 | 1% |
| CVE-2014-4036 | impresscms/impresscms | ImpressCMS Cross-site scripting Vulnerability | medium | 0.0 | 1% |
| CVE-2020-11825 | dolibarr/dolibarr | Dolibarr Cross-Site Request Forgery Vulnerability | high | 8.8 | 1% |
| CVE-2020-15154 | baserproject/basercms | Cross Site Scripting in baserCMS | high | 7.3 | 1% |
| CVE-2022-4352 | qe-seo-handyman (WordPress plugin) | The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leadi | high | 7.2 | 1% |
| CVE-2022-4358 | wp-rss-by-publishers (WordPress plugin) | The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, | high | 7.2 | 1% |
| CVE-2022-4359 | wp-rss-by-publishers (WordPress plugin) | The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, | high | 7.2 | 1% |
| CVE-2022-4370 | multimedial-images (WordPress plugin) | The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, l | high | 7.2 | 1% |
| CVE-2022-4371 | web-invoice (WordPress plugin) | The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading | high | 7.2 | 1% |
| CVE-2022-4372 | web-invoice (WordPress plugin) | The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading | high | 7.2 | 1% |
| CVE-2022-0731 | dolibarr/dolibarr | Improper Authorization in dolibarr/dolibarr | medium | 6.5 | 1% |
| CVE-2015-9495 | syndication-links (WordPress plugin) | The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier. | medium | 6.1 | 1% |