Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-6167 | minimal-coming-soon-maintenance-mode (WordPress plugin) | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject | high | 8.8 | 1% |
| CVE-2022-29305 | helloxz/imgurl | SQL injection in helloxz/imgurl | high | 8.1 | 1% |
| CVE-2023-38488 | getkirby/cms | Field injection in the KirbyData text storage handler | high | 7.1 | 1% |
| CVE-2015-9297 | events-manager (WordPress plugin) | The events-manager plugin before 5.6 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9320 | option-tree (WordPress plugin) | The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg. | medium | 6.1 | 1% |
| CVE-2016-10867 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages. | medium | 6.1 | 1% |
| CVE-2016-10873 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 4.3.3 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10875 | wp-database-backup (WordPress plugin) | The wp-database-backup plugin before 4.3.1 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18032 | download-manager (WordPress plugin) | The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-aj | medium | 6.1 | 1% |
| CVE-2019-17239 | download-plugins-dashboard (WordPress plugin) | includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple | medium | 6.1 | 1% |
| CVE-2022-23794 | joomla/filesystem | Path Disclosure within joomla/filesystem class | medium | 5.3 | 1% |
| CVE-2023-6009 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restricti | high | 8.8 | 1% |
| CVE-2024-36694 | opencart/opencart | openCart Server-Side Template Injection (SSTI) vulnerability | high | 8.0 | 1% |
| CVE-2021-4075 | snipe/snipe-it | Server-Side Request Forgery in snipe/snipe-it | high | 7.2 | 1% |
| CVE-2009-5158 | google-analyticator (WordPress plugin) | The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text. | medium | 6.1 | 1% |
| CVE-2011-5329 | redirection (WordPress plugin) | The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562. | medium | 6.1 | 1% |
| CVE-2012-6713 | job-manager (WordPress plugin) | The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2012-6717 | redirection (WordPress plugin) | The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562. | medium | 6.1 | 1% |
| CVE-2013-7475 | contact-form-plugin (WordPress plugin) | The contact-form-plugin plugin before 3.52 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2013-7481 | contact-form-plugin (WordPress plugin) | The contact-form-plugin plugin before 3.3.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2014-10385 | memphis-documents-library (WordPress plugin) | The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST. | medium | 6.1 | 1% |
| CVE-2015-9294 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances. | medium | 6.1 | 1% |
| CVE-2015-9295 | contact-form-plugin (WordPress plugin) | The contact-form-plugin plugin before 3.96 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2015-9296 | download-monitor (WordPress plugin) | The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg. | medium | 6.1 | 1% |
| CVE-2015-9300 | events-manager (WordPress plugin) | The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2015-9311 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.0.6 for WordPress has reflected XSS. | medium | 6.1 | 1% |
| CVE-2015-9314 | newstatpress (WordPress plugin) | The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header. | medium | 6.1 | 1% |
| CVE-2015-9336 | clean-login (WordPress plugin) | The clean-login plugin before 1.5.1 for WordPress has reflected XSS. | medium | 6.1 | 1% |
| CVE-2015-9358 | feedwordpress (WordPress plugin) | The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9362 | post-connector (WordPress plugin) | The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg(). | medium | 6.1 | 1% |
| CVE-2015-9505 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x befo | medium | 6.1 | 1% |
| CVE-2015-9506 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 | medium | 6.1 | 1% |
| CVE-2015-9507 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10 | medium | 6.1 | 1% |
| CVE-2015-9508 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | 1% |
| CVE-2015-9509 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0. | medium | 6.1 | 1% |
| CVE-2015-9510 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x | medium | 6.1 | 1% |
| CVE-2015-9511 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1. | medium | 6.1 | 1% |
| CVE-2015-9512 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | 1% |
| CVE-2015-9513 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 | medium | 6.1 | 1% |
| CVE-2015-9514 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x bef | medium | 6.1 | 1% |
| CVE-2015-9515 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x be | medium | 6.1 | 1% |
| CVE-2015-9516 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2. | medium | 6.1 | 1% |
| CVE-2015-9517 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x b | medium | 6.1 | 1% |
| CVE-2015-9518 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) PDF Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x befor | medium | 6.1 | 1% |
| CVE-2015-9519 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | 1% |
| CVE-2015-9520 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x | medium | 6.1 | 1% |
| CVE-2015-9521 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2 | medium | 6.1 | 1% |
| CVE-2015-9522 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0 | medium | 6.1 | 1% |
| CVE-2015-9523 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0 | medium | 6.1 | 1% |
| CVE-2015-9524 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x b | medium | 6.1 | 1% |