Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6777 | wp-google-maps (WordPress plugin) | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and inc | medium | 5.3 | 1% |
| CVE-2022-39315 | getkirby/cms | Kirby CMS vulnerable to user enumeration in the brute force protection | medium | 6.5 | 1% |
| CVE-2024-4596 | kimai/kimai | Kimai information disclosure vulnerability | low | 3.7 | 1% |
| CVE-2022-34867 | wp-libre-form (WordPress plugin), libreform/libreform | Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and | high | 7.3 | 1% |
| CVE-2022-4032 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and in | high | 7.2 | 1% |
| CVE-2026-54182 | backpack/crud | Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) | high | 8.1 | 1% |
| CVE-2016-2562 | phpmyadmin/phpmyadmin | phpMyAdmin Improper Input Validation | medium | 6.8 | 1% |
| CVE-2021-32472 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2023-0814 | profile-builder (WordPress plugin) | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the | medium | 6.5 | 1% |
| CVE-2021-24661 | postx---gutenberg-blocks-for-post-grid (WordPress plugin) | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor | medium | 4.3 | 1% |
| CVE-2023-32075 | pimcore/customer-management-framework-bundle | Pimcore vulnerable to Business Logic Errors via Customer automation rules | medium | 4.3 | 1% |
| CVE-2023-4917 | leyka (WordPress plugin) | The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_ | medium | 5.3 | 1% |
| CVE-2013-10030 | wordpress-exit-box-lite (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue | medium | 4.3 | 1% |
| CVE-2019-16768 | sylius/sylius | Internal exception message exposure for login action in Sylius | low | 3.5 | 1% |
| CVE-2023-4796 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and i | medium | 4.3 | 1% |
| CVE-2023-1402 | moodle/moodle | Moodle may display roles to users who don't have access to them | medium | 4.3 | 1% |
| CVE-2023-28336 | moodle/moodle | Moodle may allow teachers to access the names of users they could not otherwise access | medium | 4.3 | 1% |
| CVE-2026-42845 | getgrav/grav-plugin-form | Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override | high | 0.0 | 1% |
| CVE-2023-44394 | mantisbt/mantisbt | MantisBT may disclose project names to unauthorized users | medium | 4.3 | 1% |
| CVE-2021-32477 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2022-42883 | quiz-and-survey-master (WordPress plugin) | Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress. | medium | 5.3 | 1% |
| CVE-2026-54721 | silverstripe/userforms | silverstripe/userforms vulnerable to remote code execution via userforms email subject | high | 8.8 | 1% |
| CVE-2022-4033 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, | medium | 5.3 | 1% |
| CVE-2021-4117 | yetiforce/yetiforce-crm | YetiForceCRM is vulnerable to Business Logic Errors in the weight of a product | medium | 4.3 | 1% |
| CVE-2024-22027 | quiz-maker (WordPress plugin) | Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a | medium | 6.5 | 1% |
| CVE-2026-47767 | symfony/runtime, symfony/symfony | SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch | medium | 0.0 | 1% |
| CVE-2012-10016 | simple-download-button-shortcode (WordPress plugin) | A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an | medium | 4.3 | 1% |
| CVE-2022-47410 | fixpunkt/fp-newsletter | "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data | high | 7.5 | 1% |
| CVE-2022-47411 | fixpunkt/fp-newsletter | "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data | high | 7.5 | 1% |
| CVE-2024-21519 | opencart/opencart | Arbitrary File Creation in opencart | medium | 6.6 | 1% |
| CVE-2013-10024 | exit-strategy (WordPress plugin) | A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an | low | 3.5 | 1% |
| CVE-2023-50256 | froxlor/froxlor | Froxlor username/surname AND company field Bypass | high | 7.5 | 1% |
| CVE-2023-50708 | yiisoft/yii2-authclient | yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation | low | 0.0 | 1% |
| CVE-2023-39529 | prestashop/prestashop | PrestaShop file deletion via attachment API | medium | 6.7 | 1% |
| CVE-2023-29287 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Information Exposure | medium | 5.3 | 1% |
| CVE-2024-28235 | contao/core-bundle | Contao: Possible cookie sharing with external domains while checking protected pages for broken links | high | 8.3 | 1% |
| CVE-2024-34080 | mantisbt/mantisbt | MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.3 | 1% |
| CVE-2022-36101 | shopware/shopware | Shopware contains sensitive data in backend customer module | medium | 5.4 | 1% |
| CVE-2023-48294 | librenms/librenms | LibreNMS has Broken Access control on Graphs Feature | medium | 4.3 | 1% |
| CVE-2022-44589 | google-authenticator (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Fac | high | 8.1 | 1% |
| CVE-2023-22730 | shopware/core, shopware/platform | Shopware vulnerable to Improper Input Validation of Clearance sale in cart | medium | 6.3 | 1% |
| CVE-2019-16698 | directmailteam/direct-mail | direct_mail for Typo3 sensitive data exposure | medium | 4.3 | 1% |
| CVE-2017-20178 | codiad/codiad | Codiad information disclosure vulnerability | high | 7.5 | 1% |
| CVE-2023-4139 | wp-ultimate-csv-importer (WordPress plugin) | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing rest | high | 7.5 | 1% |
| CVE-2022-41655 | phone-orders-for-woocommerce (WordPress plugin) | Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress. | medium | 4.3 | 1% |
| CVE-2024-2093 | vk-all-in-one-expansion-unit (WordPress plugin) | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 6.5 | 1% |
| CVE-2022-44381 | snipe/snipe-it | Snipe-IT allows attackers to check whether a user account exists | medium | 5.3 | 1% |
| CVE-2022-1663 | stop-spam-comments (WordPress plugin) | The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comme | medium | 6.5 | 1% |
| CVE-2023-47126 | typo3/cms-install | Information Disclosure in typo3/cms-install tool | low | 3.7 | 1% |
| CVE-2016-15015 | barzahlen/barzahlen-php | Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy | medium | 5.3 | 1% |