Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-8385 | craftcms/cms | Craft CMS subject to URL forgery | medium | 5.3 | 1% |
| CVE-2019-8124 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Insufficient Logging | medium | 4.9 | 1% |
| CVE-2024-9307 | mfolio-lite (WordPress plugin) | The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1 | critical | 9.9 | 1% |
| CVE-2024-3242 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the valida | high | 8.8 | 1% |
| CVE-2023-4797 | newsletters (WordPress plugin) | The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and | high | 7.2 | 1% |
| CVE-2023-26154 | pubnub/pubnub | pubnub Insufficient Entropy vulnerability | medium | 5.9 | 1% |
| CVE-2022-4157 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id PO | medium | 4.9 | 1% |
| CVE-2023-5099 | hk-filter-and-search (WordPress plugin) | The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the | high | 8.8 | 1% |
| CVE-2024-23830 | mantisbt/mantisbt | MantisBT Host Header Injection vulnerability | high | 8.3 | 1% |
| CVE-2022-4158 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST | high | 7.5 | 1% |
| CVE-2023-0924 | popup (WordPress plugin) | The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged | high | 7.2 | 1% |
| CVE-2021-3915 | ssddanbrown/bookstack | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type | high | 7.6 | 1% |
| CVE-2021-38623 | webcoast/deferred-image-processing | Improper Resource Shutdown or Release in TYPO3 extension | high | 7.5 | 1% |
| CVE-2020-9514 | idx-broker-platinum (WordPress plugin) | An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subs | medium | 6.5 | 1% |
| CVE-2016-10706 | jetpack (WordPress plugin) | The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. | medium | 6.1 | 1% |
| CVE-2022-29429 | code-snippets-extended (WordPress plugin) | Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery. | high | 8.8 | 1% |
| CVE-2022-3691 | deepl-pro-api-translation (WordPress plugin) | The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files th | high | 7.5 | 1% |
| CVE-2025-24408 | magento/community-edition, magento/project-community-edition | Magento Information Exposure vulnerability | medium | 6.5 | 1% |
| CVE-2020-14206 | divebook (WordPress plugin) | The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter). | medium | 6.1 | 1% |
| CVE-2023-3279 | nextgen-gallery (WordPress plugin) | The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed | medium | 4.9 | 1% |
| CVE-2012-4921 | dvs-custom-notification (WordPress plugin) | Multiple cross-site request forgery (CSRF) vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remot | medium | 6.8 | 1% |
| CVE-2023-2448 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_te | medium | 6.5 | 1% |
| CVE-2017-9303 | illuminate/auth, laravel/framework, laravel/laravel | Laravel does not properly constrain the host portion of a password-reset URL | medium | 6.1 | 1% |
| CVE-2023-49599 | wwbn/avideo | WWBN AVideo Insufficient Entropy vulnerbaility | critical | 9.8 | 1% |
| CVE-2023-0714 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in | high | 8.1 | 1% |
| CVE-2024-7384 | acymailing (WordPress plugin) | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitra | high | 7.5 | 1% |
| CVE-2023-5108 | easy-newsletter-signups (WordPress plugin) | The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statem | high | 7.2 | 1% |
| CVE-2024-6529 | ultimate-classified-listings (WordPress plugin) | The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, | high | 7.1 | 1% |
| CVE-2015-9303 | simple-share-buttons-adder (WordPress plugin) | The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9306 | wp-ultimate-csv-importer (WordPress plugin) | The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2024-8104 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includ | high | 8.8 | 1% |
| CVE-2023-23923 | moodle/moodle | Moodle Improper Access Control vulnerability | high | 8.2 | 1% |
| CVE-2017-16870 | updraftplus (WordPress plugin) | The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin. | high | 8.1 | 1% |
| CVE-2021-36804 | akaunting/akaunting | Malicious password-reset in Akaunting | high | 8.1 | 1% |
| CVE-2024-0842 | backuply (WordPress plugin) | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and includi | high | 7.5 | 1% |
| CVE-2022-4546 | mapwiz (WordPress plugin) | The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a | high | 7.2 | 1% |
| CVE-2017-5942 | wp-mail (WordPress plugin) | An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected X | medium | 6.1 | 1% |
| CVE-2018-14381 | pagekit/pagekit | Pagekit open redirect vulnerability | medium | 6.1 | 1% |
| CVE-2023-22250 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Access Control | medium | 5.3 | 1% |
| CVE-2024-1799 | gamipress (WordPress plugin) | The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to | high | 8.8 | 1% |
| CVE-2016-10975 | fluid-responsive-slideshow (WordPress plugin) | The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter. | medium | 6.1 | 1% |
| CVE-2016-10980 | kento-post-view-counter (WordPress plugin) | The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo. | medium | 6.1 | 1% |
| CVE-2016-10981 | kento-post-view-counter (WordPress plugin) | The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_t | medium | 6.1 | 1% |
| CVE-2024-21910 | tinymce/tinymce | Cross-site scripting vulnerability in TinyMCE plugins | medium | 6.1 | 1% |
| CVE-2024-5349 | lastudio-element-kit (WordPress plugin) | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3 | high | 8.8 | 1% |
| CVE-2016-5431 | gree/jose | PHP JOSE Library by Gree Inc. Uses a Broken or Risky Cryptographic Algorithm | high | 7.5 | 1% |
| CVE-2022-4547 | conditional-payment-methods-for-woocommerce (WordPress plugin) | The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using | high | 7.2 | 1% |
| CVE-2022-2066 | facturascripts/facturascripts | Cross site scripting in facturascripts | medium | 6.1 | 1% |
| CVE-2017-15051 | nilsteampassnet/teampass | TeamPass stored cross-site scripting (XSS) vulnerability | medium | 5.4 | 1% |
| CVE-2022-2834 | helpful (WordPress plugin) | The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which | medium | 5.3 | 1% |