Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-1000247 | codeigniter4/framework | CodeIgniter HTTP Header Injection | high | 7.5 | 1% |
| CVE-2022-2927 | notrinos/notrinos-erp | Missing password strength check in notrinos/notrinos-erp | high | 7.3 | 1% |
| CVE-2015-9299 | events-manager (WordPress plugin) | The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS. | medium | 6.1 | 1% |
| CVE-2020-35748 | fv-flowplayer-video-player (WordPress plugin) | Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress a | medium | 5.4 | 1% |
| CVE-2012-5889 | in2code/powermail | powermail extension for TYPO3 has Cross-site Scripting vulnerability | low | 0.0 | 1% |
| CVE-2013-1844 | matomo/matomo, piwik/piwik | Piwik (now Matomo) Vulnerable to Cross-Site Scripting (XSS) | low | 0.0 | 1% |
| CVE-2014-6296 | jbartels/wec-map, web-tp3/wec_map | WEC Map (wec_map) extension for TYPO3 allows Cross-site Scripting | low | 0.0 | 1% |
| CVE-2015-3989 | concrete5/concrete5 | concrete5 vulnerable to Cross-site Scripting | low | 0.0 | 1% |
| CVE-2024-55636 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2023-3459 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | high | 7.2 | 1% |
| CVE-2024-7484 | crm-perks-forms (WordPress plugin) | The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded | high | 7.2 | 1% |
| CVE-2026-54177 | backpack/crud | Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver | medium | 6.6 | 1% |
| CVE-2016-10879 | wp-live-chat-support (WordPress plugin) | The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-15842 | easy-pdf-restaurant-menu-upload (WordPress plugin) | The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2022-2252 | microweber/microweber | Open Redirect in microweber | medium | 6.1 | 1% |
| CVE-2022-36108 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper | medium | 5.4 | 1% |
| CVE-2018-11579 | banner-management-for-woocommerce (WordPress plugin) | class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Se | medium | 5.3 | 1% |
| CVE-2021-39340 | notification (WordPress plugin) | The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via sev | medium | 4.8 | 1% |
| CVE-2021-39136 | baserproject/basercms | Cross-site scripting vulnerability in file upload | high | 8.7 | 1% |
| CVE-2022-41623 | dropshipping-and-fulfillment-for-aliexpress-and-woocommerce (WordPress plugin) | Sensitive Data Exposure in Villatheme ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 on WordPress. | high | 7.5 | 1% |
| CVE-2019-11871 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins. | medium | 5.4 | 1% |
| CVE-2022-4154 | contest-gallery (WordPress plugin) | The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query | medium | 4.9 | 1% |
| CVE-2017-6973 | mantisbt/mantisbt | MantisBT XSS via adm_config_report.php's action parameter | medium | 4.8 | 1% |
| CVE-2017-7241 | mantisbt/mantisbt | MantisBT XSS via move_attachments_page.php | medium | 4.8 | 1% |
| CVE-2022-0083 | remdex/livehelperchat | User enumeration in livehelperchat | medium | 0.0 | 1% |
| CVE-2021-36625 | dolibarr/dolibarr | SQL Injection in Dolibarr | high | 8.8 | 1% |
| CVE-2023-22247 | magento/community-edition, magento/project-community-edition | Magento Open Source allows XML Injection | high | 7.5 | 1% |
| CVE-2022-2429 | ultimate-sms-notifications (WordPress plugin) | The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 v | medium | 6.5 | 1% |
| CVE-2014-10377 | cforms2 (WordPress plugin) | The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php. | medium | 6.1 | 1% |
| CVE-2018-10704 | yidashi/yii2cmf | Cross-site Scripting in yii2cmf | medium | 6.1 | 1% |
| CVE-2019-16130 | yii2mod/yii2-cms | Cross-site Scripting in YII2-CMS | medium | 6.1 | 1% |
| CVE-2019-19210 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2019-7852 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Path Disclosure | medium | 5.3 | 1% |
| CVE-2019-7898 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Information Disclosure | medium | 5.3 | 1% |
| CVE-2019-7899 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Information Disclosure | medium | 5.3 | 1% |
| CVE-2020-13667 | drupal/core, drupal/drupal | The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be e | medium | 5.3 | 1% |
| CVE-2022-36427 | about-rentals (WordPress plugin) | Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress. | high | 7.3 | 1% |
| CVE-2012-6718 | sharebar (WordPress plugin) | The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491. | medium | 6.1 | 1% |
| CVE-2015-9293 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature. | medium | 6.1 | 1% |
| CVE-2021-41252 | getkirby/cms | Cross-site scripting (XSS) from writer field content in the site frontend | medium | 5.4 | 1% |
| CVE-2018-11244 | bbe-theme (WordPress theme) | The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor. | medium | 5.3 | 1% |
| CVE-2023-6049 | estatik (WordPress plugin) | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthentica | critical | 9.8 | 1% |
| CVE-2023-28663 | formidable-pro2pdf (WordPress plugin) | The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ param | high | 8.8 | 1% |
| CVE-2021-32474 | moodle/moodle | Moodle Blind SQL injection possible via MNet authentication | high | 7.2 | 1% |
| CVE-2021-4026 | ssddanbrown/bookstack | bookstack is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2023-0262 | wp-airbnb-review-slider (WordPress plugin) | The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement | high | 8.8 | 1% |
| CVE-2023-4999 | horizontal-scrolling-announcement (WordPress plugin) | The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-scrolling] shortcode | high | 8.8 | 1% |
| CVE-2023-1835 | ninja-forms (WordPress plugin) | The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, | medium | 6.1 | 1% |
| CVE-2022-0688 | microweber/microweber | Business Logic Errors in microweber | low | 2.7 | 1% |
| CVE-2018-25095 | duplicator (WordPress plugin) | The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configur | critical | 9.8 | 1% |