Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-15864 | breadcrumbs-by-menu (WordPress plugin) | The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2022-1250 | lifterlms (WordPress plugin) | The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before ou | medium | 6.1 | 1% |
| CVE-2022-36106 | typo3/cms, typo3/cms-core | TYPO3 CMS missing check for expiration time of password reset token for backend users | medium | 5.4 | 1% |
| CVE-2009-3633 | typo3/cms-core | TYPO3 API function vulnerable to Cross-site Scripting | medium | 0.0 | 1% |
| CVE-2024-12562 | s2member (WordPress plugin) | The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization | critical | 9.8 | 1% |
| CVE-2019-20389 | intelliants/subrion | Subrion CMS XSS | medium | 6.1 | 1% |
| CVE-2015-9469 | content-grabber (WordPress plugin) | The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id. | medium | 4.8 | 1% |
| CVE-2023-4914 | cecil/cecil | Cecil Path Traversal vulnerability | high | 7.5 | 1% |
| CVE-2017-7887 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2017-15278 | nilsteampassnet/teampass | TeamPass Cross-Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2018-20986 | advanced-custom-fields (WordPress plugin) | The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors. | medium | 5.4 | 1% |
| CVE-2022-33910 | mantisbt/mantisbt | MantisBT XSS through crafted SVG documents in file_download.php | medium | 5.4 | 1% |
| CVE-2018-20853 | wysija-newsletters (WordPress plugin) | An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to | medium | 5.3 | 1% |
| CVE-2019-16251 | yith-advanced-refund-system-for-woocommerce (WordPress plugin), yith-color-and-label-variations-for-woocommerce (WordPress plugin), yith-custom-thank-you-page-for-woocommerce (WordPress plugin) +35 more | plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. | medium | 4.3 | 1% |
| CVE-2019-3850 | moodle/moodle | Moodle Stored HTML in assignment submission comments allowed links to be opened directly | medium | 6.1 | 1% |
| CVE-2022-41951 | oro/platform | OroPlatform vulnerable to path traversal during temporary file manipulations | high | 8.5 | 1% |
| CVE-2022-25838 | laravel/fortify | Multi-Factor Authentication issue in Laravel Fortify | high | 8.1 | 1% |
| CVE-2021-4339 | ulisting (WordPress plugin) | The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.ph | high | 7.5 | 1% |
| CVE-2024-8126 | file-manager-advanced (WordPress plugin) | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all version | high | 7.5 | 1% |
| CVE-2019-14949 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 5.1.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2021-39338 | mybb-cross-poster (WordPress plugin) | The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization vi | medium | 5.5 | 1% |
| CVE-2018-7035 | gleez/cms | Gleez CMS Stored XSS | medium | 5.4 | 1% |
| CVE-2024-0709 | cryptocurrency-price-ticker-widget (WordPress plugin) | The Cryptocurrency Widgets – Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the 'coinslist' parameter in | critical | 9.8 | 1% |
| CVE-2024-21547 | spatie/browsershot | Spatie Browsershot Directory Traversal vulnerability | high | 7.5 | 1% |
| CVE-2005-10002 | secure-files (WordPress plugin) | A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the | medium | 5.5 | 1% |
| CVE-2016-4878 | baserproject/basercms | baserCMS Cross Site Request Forgery vulnerability | high | 8.8 | 1% |
| CVE-2016-4881 | baserproject/basercms | CSRF in baserCMS 3.0.10 and earlier | high | 8.8 | 1% |
| CVE-2022-3907 | clerk.io (WordPress plugin) | The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage o | high | 7.5 | 1% |
| CVE-2024-25978 | moodle/moodle | Uncontrolled Resource Consumption in moodle | high | 7.5 | 1% |
| CVE-2025-4799 | wp-downloadmanager (WordPress plugin) | The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can | high | 7.2 | 1% |
| CVE-2018-0585 | ultimate-member (WordPress plugin) | Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrar | medium | 5.4 | 1% |
| CVE-2019-19206 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2022-3072 | francoisjacquet/rosariosis | francoisjacquet/rosariosis vulnerable to Cross-Site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2020-35950 | xcloner (WordPress plugin) | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint). | critical | 9.8 | 1% |
| CVE-2023-0098 | simple-urls (WordPress plugin) | The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions | high | 8.8 | 1% |
| CVE-2016-10998 | ocim-mp3 (WordPress plugin) | The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS. | medium | 6.1 | 1% |
| CVE-2016-10999 | goodnews (WordPress theme) | The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter. | medium | 6.1 | 1% |
| CVE-2019-12823 | craftcms/cms | Craft CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2025-10042 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due | medium | 5.9 | 1% |
| CVE-2020-14961 | concrete5/concrete5 | Unrestricted Uploads in Concrete5 | medium | 5.3 | 1% |
| CVE-2021-3271 | pressbooks/pressbooks | Stored cross-site scripting in PressBooks | medium | 4.8 | 1% |
| CVE-2021-24851 | insert-pages (WordPress plugin) | The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary | medium | 4.3 | 1% |
| CVE-2025-68454 | craftcms/cms | Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI | medium | 0.0 | 1% |
| CVE-2022-0409 | showdoc/showdoc | Unrestricted Upload of File with Dangerous Type in showdoc | high | 7.8 | 1% |
| CVE-2021-24808 | bp-better-messages (WordPress plugin) | The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter befo | medium | 6.1 | 1% |
| CVE-2022-4215 | chained-quiz (WordPress plugin) | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' pag | medium | 6.1 | 1% |
| CVE-2025-57811 | craftcms/cms | Craft CMS Potential Remote Code Execution via Twig SSTI | medium | 0.0 | 1% |
| CVE-2024-45116 | magento/community-edition | Magento Open Source Cross-Site Scripting (XSS) vulnerability | high | 8.1 | 1% |
| CVE-2023-7027 | post-smtp (WordPress plugin) | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stor | high | 7.2 | 1% |
| CVE-2021-39203 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | medium | 6.8 | 1% |