Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5153 | startklar-elmentor-forms-extwidgets (WordPress plugin) | The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via th | critical | 9.1 | 1% |
| CVE-2019-8130 | magento/community-edition, magento/product-community-edition | Magento SQL injection vulnerability | high | 8.8 | 1% |
| CVE-2019-8134 | magento/community-edition, magento/product-community-edition | Magento SQL injection via marketing account with access to email templates variables | high | 8.8 | 1% |
| CVE-2020-15276 | baserproject/basercms | Blog comment posting, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0 | high | 7.7 | 1% |
| CVE-2024-11465 | yikes-inc-easy-custom-woocommerce-product-tabs (WordPress plugin) | The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 | high | 7.2 | 1% |
| CVE-2022-21715 | codeigniter4/framework | Cross-site Scripting Vulnerability in CodeIgniter4 | medium | 5.4 | 1% |
| CVE-2020-5299 | october/backend | Potential CSV Injection vector in OctoberCMS | medium | 4.0 | 1% |
| CVE-2025-3641 | moodle/moodle | Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository | high | 8.8 | 1% |
| CVE-2014-9337 | mikiurl-wordpress-eklentisi (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Mikiurl Wordpress Eklentisi plugin 2.0 and earlier for WordPress allow rem | medium | 6.8 | 1% |
| CVE-2014-9338 | o2tweet (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the O2Tweet plugin 0.0.4 and earlier for WordPress allow remote attackers to h | medium | 6.8 | 1% |
| CVE-2014-9339 | spnbabble (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow remote attackers to | medium | 6.8 | 1% |
| CVE-2014-9340 | wpcommenttwit (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers | medium | 6.8 | 1% |
| CVE-2014-9368 | twitterdash (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack th | medium | 6.8 | 1% |
| CVE-2014-9391 | gslideshow (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the gSlideShow plugin 0.1 and earlier for WordPress allow remote attackers to | medium | 6.8 | 1% |
| CVE-2014-9392 | pictobrowser (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows rem | medium | 6.8 | 1% |
| CVE-2014-9395 | simplelife (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Simplelife plugin 1.2 and earlier for WordPress allow remote attackers to | medium | 6.8 | 1% |
| CVE-2014-9398 | twitter-liveblog (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hi | medium | 6.8 | 1% |
| CVE-2014-9399 | tweetscribe (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the TweetScribe plugin 1.1 and earlier for WordPress allows remote attackers to hijack th | medium | 6.8 | 1% |
| CVE-2014-9523 | our-team-showcase (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1.3 for WordPress allo | medium | 6.8 | 1% |
| CVE-2015-1580 | redirection (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2015-1581 | mobile-domain (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2022-0079 | showdoc/showdoc | showdoc is vulnerable to Generation of Error Message Containing Sensitive Information | medium | 5.3 | 1% |
| CVE-2009-4803 | svewap/a21glossary, wapplersystems/a21glossary | Accessibility Glossary (a21glossary) SQL injection vulnerability | high | 0.0 | 1% |
| CVE-2015-9305 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions. | medium | 6.1 | 1% |
| CVE-2021-24954 | user-registration\,-login-form\,-user-profile-\&-membership (WordPress plugin) | The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data p | medium | 6.1 | 1% |
| CVE-2021-24955 | user-registration\,-login-form\,-user-profile-\&-membership (WordPress plugin) | The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_ | medium | 6.1 | 1% |
| CVE-2023-30852 | pimcore/pimcore | Arbitrary File Read in Admin JS CSS files | medium | 4.4 | 1% |
| CVE-2021-43822 | jackalope/jackalope-doctrine-dbal | SQL injection in jackalope/jackalope-doctrine-dbal | high | 8.5 | 1% |
| CVE-2022-40700 | admin-css-mu (WordPress plugin), amo-for-wp---membership-management (WordPress plugin), amp-toolbox (WordPress plugin) +12 more | Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership | high | 8.2 | 1% |
| CVE-2024-13481 | ltl-freight-quotes (WordPress plugin) | The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' p | high | 7.5 | 1% |
| CVE-2022-0085 | dompdf/dompdf | Server-Side Request Forgery in dompdf/dompdf | medium | 5.3 | 1% |
| CVE-2024-0379 | custom-twitter-feeds (WordPress plugin) | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | 1% |
| CVE-2022-30120 | concrete5/core | Cross site scripting in Concrete CMS | low | 3.1 | 1% |
| CVE-2023-3392 | read-more-\&-accordion (WordPress plugin) | The Read More & Accordion WordPress plugin before 3.2.7 unserializes user input provided via the settings, which could allow high-privilege | high | 7.2 | 1% |
| CVE-2022-2515 | simple-banner (WordPress plugin) | The Simple Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `pro_version_activation_code` parameter in versi | medium | 6.4 | 1% |
| CVE-2018-17876 | web-feet/coastercms | Coaster CMS Stored Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2022-0576 | librenms/librenms | Cross-site Scripting in librenms | medium | 6.1 | 1% |
| CVE-2023-1780 | companion-sitemap-generator (WordPress plugin) | The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pa | medium | 6.1 | 1% |
| CVE-2024-23646 | pimcore/admin-ui-classic-bundle | SQL Injection in Admin download files as zip | high | 8.8 | 1% |
| CVE-2022-1202 | wp-crm (WordPress plugin) | The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV inject | high | 7.8 | 1% |
| CVE-2020-23355 | codiad/codiad | Codiad Vulnerable to PHP Magic Hash Vulnerability | high | 7.5 | 1% |
| CVE-2021-24366 | admin-columns (WordPress plugin) | The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label setti | medium | 5.4 | 1% |
| CVE-2024-8514 | google-website-translator (WordPress plugin) | The Prisna GWT – Google Website Translator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, | critical | 9.1 | 1% |
| CVE-2021-36786 | miniorange/miniorange-saml | Sensitive Data Exposure in miniorange_saml | high | 7.5 | 1% |
| CVE-2020-24145 | cm-download-manager (WordPress plugin) | Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attac | medium | 6.1 | 1% |
| CVE-2021-20279 | moodle/moodle | Moodle contains Stored XSS via ID number user profile field | medium | 5.4 | 1% |
| CVE-2023-31506 | getgrav/grav | Cross-site scripting (XSS) vulnerability in Grav | medium | 5.4 | 1% |
| CVE-2021-38302 | ecodev/newsletter | SQL injection in TYPO3 extension | medium | 4.0 | 1% |
| CVE-2024-40624 | torrentpier/torrentpier | TorrentPier Deserialization of Untrusted Data vulnerability | critical | 9.8 | 1% |
| CVE-2023-5465 | popup-with-fancybox (WordPress plugin) | The Popup with fancybox plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.5 | high | 8.8 | 1% |