Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-2157 | moodle/moodle | Moodle cross-site request forgery (CSRF) vulnerability | high | 8.8 | 1% |
| CVE-2013-3251 | qtranslate (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the qTranslate plugin 2.5.34 and earlier for WordPress allows remote attackers to hijack | medium | 6.8 | 1% |
| CVE-2021-39346 | google-maps-easy (WordPress plugin) | The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via | medium | 4.8 | 1% |
| CVE-2026-27823 | egroupware/egroupware | EGroupware has a Remote Code Execution Vulnerability | critical | 0.0 | 1% |
| CVE-2022-2558 | simple-job-board (WordPress plugin) | The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes | medium | 5.3 | 1% |
| CVE-2025-64050 | redaxo/source | REDAXO CMS is vulnerable to RCE attack through its template management component | high | 7.2 | 1% |
| CVE-2023-38209 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 6.5 | 1% |
| CVE-2026-26273 | idno/known | Known affected by Account Takeover via Password Reset Token Leakage | critical | 9.8 | 1% |
| CVE-2016-7038 | moodle/moodle | Moodle Weak Password Recovery Mechanism for Forgotten Password | high | 7.3 | 1% |
| CVE-2018-20970 | pdf-print (WordPress plugin) | The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2022-2554 | enable-media-replace (WordPress plugin) | The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow | medium | 4.9 | 1% |
| CVE-2025-69210 | facturascripts/facturascripts | FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload | high | 0.0 | 1% |
| CVE-2023-0311 | thorsten/phpmyfaq | phpMyFAQ Improper Authentication vulnerability | critical | 9.8 | 1% |
| CVE-2024-34070 | froxlor/froxlor | Blind XSS Leading to Froxlor Application Compromise | critical | 9.6 | 1% |
| CVE-2023-1016 | intuitive-custom-post-order (WordPress plugin) | The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.4.1, due to insuff | medium | 6.6 | 1% |
| CVE-2020-36721 | activello (WordPress plugin), affluent (WordPress plugin), allegiant (WordPress plugin) +12 more | The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. | medium | 6.5 | 1% |
| CVE-2015-9357 | akismet (WordPress plugin) | The akismet plugin before 3.1.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-15116 | easy-digital-downloads (WordPress plugin) | The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging. | medium | 6.1 | 1% |
| CVE-2025-2512 | file-away (WordPress plugin) | The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validatio | critical | 9.8 | 1% |
| CVE-2013-2701 | social-sharing-toolkit-plugin (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Social Sharing Toolkit plugin 2.1.1 for WordPress allows remote attackers to hijack t | medium | 6.8 | 1% |
| CVE-2013-2708 | content-slide (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers to hijack the authen | medium | 6.8 | 1% |
| CVE-2014-5199 | wp-file-upload (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remot | medium | 6.8 | 1% |
| CVE-2021-38320 | simplesamlphp-authentication (WordPress plugin) | The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] va | medium | 6.1 | 1% |
| CVE-2017-15811 | pootle-button (WordPress plugin) | The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admi | medium | 5.4 | 1% |
| CVE-2019-7855 | magento/community-edition, magento/product-community-edition | Magento 2 Community Cryptographic Flaw | medium | 5.3 | 1% |
| CVE-2022-2470 | microweber/microweber | Microweber before 1.2.21 vulnerable to reflected XSS | medium | 6.1 | 1% |
| CVE-2022-2891 | wp-2fa (WordPress plugin) | The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak inf | medium | 5.9 | 1% |
| CVE-2021-43409 | wordpress-\+-azure-ad-\/-microsoft-office-365 (WordPress plugin) | The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (X | critical | 9.3 | 1% |
| CVE-2024-28107 | phpmyfaq/phpmyfaq | phpMyFAQ SQL injections at insertentry & saveentry | high | 8.8 | 1% |
| CVE-2023-4279 | user-activity-log (WordPress plugin) | This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker | high | 7.5 | 1% |
| CVE-2024-8352 | social-web-suite (WordPress plugin) | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all ve | high | 7.5 | 1% |
| CVE-2019-19984 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plug | medium | 6.3 | 1% |
| CVE-2026-77136 | in2code/powermail | TYPO3-EXT-SA-2026-022: Server-Side Template Injection in extension "powermail" (powermail) | unknown | 0.0 | 1% |
| CVE-2024-1773 | pdf-invoices-and-packing-slips-for-woocommerce (WordPress plugin) | The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc | high | 8.8 | 1% |
| CVE-2024-9022 | poll-wp (WordPress plugin) | The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in | high | 7.2 | 1% |
| CVE-2018-1045 | moodle/moodle | Moodle XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2013-5002 | phpmyadmin/phpmyadmin | phpMyAdmin Cross-site scripting (XSS) vulnerability via pageNumber value | low | 0.0 | 1% |
| CVE-2014-2571 | moodle/moodle | Moodle cross-site scripting (XSS) vulnerability | low | 0.0 | 1% |
| CVE-2023-3956 | instawp-connect (WordPress plugin) | The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missin | critical | 9.8 | 1% |
| CVE-2022-33960 | social-share-buttons-by-supsystic (WordPress plugin) | Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= | high | 8.5 | 1% |
| CVE-2015-10105 | ip-blacklist-cloud (WordPress plugin) | A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function | medium | 6.3 | 1% |
| CVE-2017-18612 | wp-whois-domain (WordPress plugin) | The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter. | medium | 6.1 | 1% |
| CVE-2017-18613 | trust-form (WordPress plugin) | The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter. | medium | 6.1 | 1% |
| CVE-2019-17236 | igniteup (WordPress plugin) | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS. | medium | 6.1 | 1% |
| CVE-2020-8226 | phpbb/phpbb | phpBB Server-Side Request Forgery Vulnerability | medium | 5.8 | 1% |
| CVE-2020-15241 | typo3/cms, typo3/cms-core, typo3fluid/fluid | Cross-Site Scripting in ternary conditional operator | medium | 4.7 | 1% |
| CVE-2024-26483 | getkirby/cms | Kirby vulnerable to unrestricted file upload of user avatar images | medium | 4.6 | 1% |
| CVE-2025-68455 | craftcms/cms | Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | high | 0.0 | 1% |
| CVE-2023-29530 | laminas/laminas-diactoros | HTTP Multiline Header Termination | high | 7.5 | 1% |
| CVE-2025-4828 | support-board (WordPress plugin) | The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_dele | critical | 9.8 | 1% |