Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-31210 | WordPress core | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plug | high | 7.6 | 1% |
| CVE-2015-9356 | wp-vipergb (WordPress plugin) | The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460. | medium | 6.1 | 1% |
| CVE-2015-9361 | related-posts (WordPress plugin) | The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2018-6891 | bookly-responsive-appointment-booking-tool (WordPress plugin) | Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js. | medium | 6.1 | 1% |
| CVE-2019-15817 | easy-property-listings (WordPress plugin) | The easy-property-listings plugin before 3.4 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2022-4160 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_id POST | medium | 6.5 | 1% |
| CVE-2024-12875 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all | medium | 4.9 | 1% |
| CVE-2015-9229 | nextgen-gallery (WordPress plugin) | In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated | medium | 4.8 | 1% |
| CVE-2013-2633 | matomo/matomo, piwik/piwik | Piwik (now Matomo) Reveals Sensitive Information by Accepting Input from `POST` Requests | medium | 0.0 | 1% |
| CVE-2015-4089 | wp-fastest-cache (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before | high | 8.8 | 1% |
| CVE-2022-2356 | user-private-files (WordPress plugin) | The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the ser | high | 8.8 | 1% |
| CVE-2022-1155 | snipe/snipe-it | Old sessions not blocked by login enable function in Snipe-IT | high | 7.4 | 1% |
| CVE-2019-8133 | magento/community-edition, magento/product-community-edition | Bypass of sitemp access restrictions | medium | 6.5 | 1% |
| CVE-2022-34257 | magento/community-edition | Magento stored Cross-Site Scripting (XSS) vulnerability | medium | 6.1 | 1% |
| CVE-2020-7228 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. | medium | 5.4 | 1% |
| CVE-2012-6146 | typo3/cms | Typo3 Backend History Module Vulnerable to XSS | medium | 0.0 | 1% |
| CVE-2022-36376 | rankmath/seo-by-rank-math, seo (WordPress plugin) | Rank Math SEO plugin vulnerable to Server-Side Request Forgery | critical | 9.8 | 1% |
| CVE-2024-1772 | play-ht (WordPress plugin) | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to PHP Object Injection in all ve | high | 8.8 | 1% |
| CVE-2024-48987 | snipe/snipe-it | Snipe-IT remote code execution | high | 7.2 | 1% |
| CVE-2023-5192 | pimcore/demo | Pimcore Demo Allows GraphQL Introspection | medium | 6.5 | 1% |
| CVE-2014-9120 | intelliants/subrion | Subrion CMS Cross-site scripting in search | medium | 0.0 | 1% |
| CVE-2024-48514 | maestroerror/php-heic-to-jpg | Remote code execution in php-heic-to-jpg | critical | 9.8 | 1% |
| CVE-2020-20634 | website-builder (WordPress plugin) | Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable al | medium | 6.5 | 1% |
| CVE-2022-1504 | microweber/microweber | Cross-site Scripting in microweber | medium | 6.3 | 1% |
| CVE-2022-23598 | laminas/laminas-form | Cross-site Scripting when rendering error messages in laminas-form | medium | 6.1 | 1% |
| CVE-2022-3484 | wpb-show-core (WordPress plugin) | The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cr | medium | 6.1 | 1% |
| CVE-2021-39355 | indeed-job-importer (WordPress plugin) | The Indeed Job Importer WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization | medium | 5.5 | 1% |
| CVE-2021-39356 | content-staging (WordPress plugin) | The Content Staging WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via seve | medium | 5.5 | 1% |
| CVE-2022-0163 | smart-forms (WordPress plugin) | The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any | medium | 6.5 | 1% |
| CVE-2023-41564 | cockpit-hq/cockpit | Cockpit CMS arbitrary file upload vulnerability | medium | 6.1 | 1% |
| CVE-2022-0622 | snipe/snipe-it | Generation of Error Message Containing Sensitive Information in Snipe-IT | medium | 5.3 | 1% |
| CVE-2023-2297 | profile-builder (WordPress plugin) | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions | critical | 9.8 | 1% |
| CVE-2022-25098 | ectouch/ectouch | Arbitrary file delete in ectouch/ectouch | critical | 9.1 | 1% |
| CVE-2023-1313 | cockpit-hq/cockpit | cockpit-hq/cockpit is vulnerable to unrestricted file uploads | high | 8.8 | 1% |
| CVE-2023-4293 | wpdm-premium-packages (WordPress plugin) | The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and incl | high | 8.8 | 1% |
| CVE-2026-45162 | pimcore/pimcore | Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction | high | 8.0 | 1% |
| CVE-2015-9355 | two-factor-authentication (WordPress plugin) | The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area. | medium | 6.1 | 1% |
| CVE-2018-7274 | yab/quarx | Yab Quarx persistent cross-site scripting vulnerability | medium | 6.1 | 1% |
| CVE-2021-27902 | craftcms/cms | Craft CMS Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2017-6370 | typo3/cms | TYPO3 Information Disclosure Vulnerability | medium | 5.3 | 1% |
| CVE-2023-4636 | user-private-files (WordPress plugin) | The WordPress File Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, an | medium | 4.4 | 1% |
| CVE-2012-6629 | newsletter-manager (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote att | medium | 6.8 | 1% |
| CVE-2021-24318 | listeo (WordPress plugin) | The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allo | medium | 6.5 | 1% |
| CVE-2015-9270 | the-holiday-calendar (WordPress plugin) | XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter. | medium | 6.1 | 1% |
| CVE-2023-23617 | openmage/magento-lts | DoS vulnerability in MaliciousCode filter | medium | 4.9 | 1% |
| CVE-2023-4311 | vrm360 (WordPress plugin) | The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin sho | high | 8.8 | 1% |
| CVE-2021-37517 | dolibarr/dolibarr | Access Control vulnerability in Dolibarr | high | 7.5 | 1% |
| CVE-2015-9384 | relevant (WordPress plugin) | The relevant plugin before 1.0.8 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9385 | quotes-and-tips (WordPress plugin) | The quotes-and-tips plugin before 1.20 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9396 | auto-thickbox-plus (WordPress plugin) | The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS. | medium | 6.1 | 1% |