Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9411 | postmatic (WordPress plugin) | The Postmatic plugin before 1.4.6 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9468 | broken-link-manager (WordPress plugin) | The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action. | medium | 6.1 | 1% |
| CVE-2016-11013 | wp-listings (WordPress plugin) | The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS. | medium | 6.1 | 1% |
| CVE-2019-15833 | simple-mail-address-encoder (WordPress plugin) | The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS. | medium | 6.1 | 1% |
| CVE-2020-29556 | getgrav/grav | Grav CMS Local File Injection | medium | 5.5 | 1% |
| CVE-2023-1888 | directorist (WordPress plugin) | The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due | high | 8.8 | 1% |
| CVE-2023-3133 | tutor (WordPress plugin) | The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated a | high | 7.5 | 1% |
| CVE-2011-4902 | typo3/cms | Typo3 Arbitrary File Delete | medium | 6.5 | 1% |
| CVE-2013-7472 | count-per-day (WordPress plugin) | The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter. | medium | 6.1 | 1% |
| CVE-2020-25628 | moodle/moodle | Cross site-scripting (XSS) moodle | medium | 6.1 | 1% |
| CVE-2025-4302 | stop-user-enumeration (WordPress plugin) | The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. How | medium | 5.3 | 1% |
| CVE-2024-55638 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2022-1551 | sp-project-\&-document-manager (WordPress plugin) | The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that | medium | 6.5 | 1% |
| CVE-2020-27356 | debug-meta-data (WordPress plugin) | The debug-meta-data plugin 1.1.2 for WordPress allows XSS. | medium | 5.4 | 1% |
| CVE-2013-4320 | typo3/cms-core | TYPO3 Improper Access Management in the File Abstraction Layer | medium | 0.0 | 1% |
| CVE-2022-40200 | wpforo (WordPress plugin) | Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. | critical | 9.9 | 1% |
| CVE-2020-35773 | site-offline (WordPress plugin) | The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF. | high | 8.8 | 1% |
| CVE-2023-25240 | pimcore/pimcore | SameSite Attribute vulnerability in pimCore | high | 8.8 | 1% |
| CVE-2022-3342 | zero-bs-crm (WordPress plugin) | The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLi | high | 7.5 | 1% |
| CVE-2021-22966 | concrete5/core | Improper Privilege Management in Concrete CMS | high | 8.8 | 1% |
| CVE-2023-5505 | backwpup (WordPress plugin) | The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup f | medium | 6.8 | 1% |
| CVE-2017-1002011 | image-gallery-with-slideshow (WordPress plugin) | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and | medium | 5.4 | 1% |
| CVE-2022-38070 | pop-up-pop-up (WordPress plugin) | Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress. | medium | 5.4 | 1% |
| CVE-2021-24379 | comments-like-dislike (WordPress plugin) | The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from rep | medium | 5.3 | 1% |
| CVE-2015-9439 | addthis (WordPress plugin) | The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget p | medium | 4.8 | 1% |
| CVE-2023-2027 | zm-ajax-login-register (WordPress plugin) | The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is du | critical | 9.8 | 1% |
| CVE-2015-9497 | ad-inserter (WordPress plugin) | The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php. | high | 8.8 | 1% |
| CVE-2025-7694 | woffice (WordPress plugin) | The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_ | medium | 6.8 | 1% |
| CVE-2017-7251 | pi/pi | Pi Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2018-16808 | dolibarr/dolibarr | Dolibarr Stored Cross-site Scripting in expensereport/card.php | medium | 6.1 | 1% |
| CVE-2019-1010016 | dolibarr/dolibarr | Dolibarr Cross Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2021-42220 | dolibarr/dolibarr | Dolibarr Cross Site Scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2021-43257 | mantisbt/mantisbt | MantisBT CSV Injection unprivileged user access in csv_export.php | high | 7.8 | 1% |
| CVE-2017-7532 | moodle/moodle | Moodle Improper Privilege Management | medium | 6.5 | 1% |
| CVE-2024-52596 | simplesamlphp/xml-common | SimpleSAMLphp xml-common XXE vulnerability | high | 0.0 | 1% |
| CVE-2016-10878 | wp-google-map-plugin (WordPress plugin) | The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2018-20154 | wp-maintenance-mode (WordPress plugin) | The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses. | medium | 4.3 | 1% |
| CVE-2022-36394 | contest-gallery (WordPress plugin) | Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress. | high | 7.6 | 1% |
| CVE-2025-1648 | yawave (WordPress plugin) | The Yawave plugin for WordPress is vulnerable to SQL Injection via the 'lbid' parameter in all versions up to, and including, 2.9.1 due to i | high | 7.5 | 1% |
| CVE-2015-9493 | my-wish-list (WordPress plugin) | The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2015-9501 | artificial-intelligence (WordPress theme) | The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web ro | medium | 6.1 | 1% |
| CVE-2017-18608 | spotim-comments (WordPress plugin) | The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2020-25033 | subscribe-sidebar (WordPress plugin) | The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS. | medium | 6.1 | 1% |
| CVE-2021-30458 | wikimedia/parsoid | Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2022-43500 | WordPress core | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scri | medium | 6.1 | 1% |
| CVE-2016-5014 | moodle/moodle | Moodle sensitive information disclosure | medium | 5.4 | 1% |
| CVE-2026-23524 | laravel/reverb | Laravel Redis Horizontal Scaling Insecure Deserialization | critical | 9.8 | 1% |
| CVE-2024-9669 | filester (WordPress plugin) | The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, | high | 7.2 | 1% |
| CVE-2022-0565 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.4 | 1% |
| CVE-2019-20455 | globalpayments/php-sdk | Improper Certificate Validation in Heartland & Global Payments PHP SDK | medium | 5.9 | 1% |