Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-3132 | mainwp-child (WordPress plugin) | The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insuf | medium | 5.9 | 1% |
| CVE-2023-3819 | pimcore/pimcore | Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | high | 7.6 | 1% |
| CVE-2023-47636 | pimcore/admin-ui-classic-bundle | pimcore/admin-ui-classic-bundle Full Path Disclosure via re-export document | medium | 5.3 | 1% |
| CVE-2021-32050 | mongodb/mongodb | MongoDB Driver may publish events containing authentication-related data | medium | 4.2 | 1% |
| CVE-2021-4111 | yetiforce/yetiforce-crm | YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number | high | 7.3 | 1% |
| CVE-2022-41706 | spatie/browsershot | Browsershot does not validate URL protocols passed to Browsershot URL method | high | 8.2 | 1% |
| CVE-2022-43984 | spatie/browsershot | Browsershot version 3.57.3 vulnerable to improper input validation | medium | 6.1 | 1% |
| CVE-2023-0901 | pixelfed/pixelfed | Pixelfed allows user enumeration via reset password functionality | medium | 5.3 | 1% |
| CVE-2020-36668 | backup (WordPress plugin) | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and i | medium | 4.3 | 1% |
| CVE-2025-48490 | lomkit/laravel-rest-api | Laravel Rest Api has a Search Validation Bypass | medium | 0.0 | 1% |
| CVE-2023-41336 | symfony/ux-autocomplete | Prevent injection of invalid entity ids for "autocomplete" fields | medium | 6.5 | 1% |
| CVE-2025-2689 | yiisoft/yii2-dev | yiisoft Yii2 Deserialization of Untrusted Data | medium | 6.3 | 1% |
| CVE-2023-22734 | shopware/core, shopware/platform | Shopware has Improper Input Validation issue in newsletter subscription | medium | 4.3 | 1% |
| CVE-2022-31046 | typo3/cms, typo3/cms-core | Information Disclosure via Export Module | medium | 4.3 | 1% |
| CVE-2024-45134 | magento/community-edition | Magento Open Source Information Exposure vulnerability | low | 2.7 | 1% |
| CVE-2024-13681 | uncode (WordPress theme) | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_admin_get_oembed' fu | high | 7.5 | 1% |
| CVE-2026-62988 | froxlor/froxlor | Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints | critical | 9.0 | 1% |
| CVE-2024-11088 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via t | medium | 5.3 | 1% |
| CVE-2024-13538 | bigbuy-wc-dropshipping-connector (WordPress plugin) | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and incl | medium | 5.3 | 1% |
| CVE-2023-39343 | sulu/sulu | Sulu Observable Response Discrepancy on Admin Login | medium | 4.3 | 1% |
| CVE-2023-46240 | codeigniter4/framework | CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment | high | 7.5 | 1% |
| CVE-2025-27517 | livewire/volt | Volt Allows RCE Via User-Crafted Requests | critical | 0.0 | 1% |
| CVE-2023-7072 | post-grid (WordPress plugin) | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i | high | 7.5 | 1% |
| CVE-2024-10285 | ce21-suite (WordPress plugin) | The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and includin | critical | 9.8 | 1% |
| CVE-2014-125102 | relevant (WordPress plugin) | A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability | medium | 4.3 | 1% |
| CVE-2023-6214 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | high | 7.5 | 1% |
| CVE-2023-34098 | shopware/shopware | Shopware dependency configuration exposed | medium | 5.3 | 1% |
| CVE-2024-1769 | jm-twitter-cards (WordPress plugin) | The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14 via the meta descri | medium | 5.3 | 1% |
| CVE-2024-11297 | page-and-post-restriction (WordPress plugin) | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers | medium | 5.3 | 1% |
| CVE-2024-0909 | anonymous-restricted-content (WordPress plugin) | The Anonymous Restricted Content plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.6.2. T | medium | 5.3 | 1% |
| CVE-2023-22476 | mantisbt/mantisbt | MantisBT may expose private issues' summaries to unauthorized users | medium | 4.3 | 1% |
| CVE-2024-21549 | spatie/browsershot | Browsershot Improper Input Validation vulnerability | high | 8.6 | 1% |
| CVE-2023-1754 | thorsten/phpmyfaq | phpMyFAQ vulnerable to improper input validation | medium | 4.7 | 1% |
| CVE-2022-41618 | media-library-assistant (WordPress plugin) | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. | low | 3.7 | 1% |
| CVE-2020-5218 | sylius/resource-bundle, sylius/sylius | Ability to expose data in Sylius by using an unintended serialisation group | medium | 4.4 | 1% |
| CVE-2023-3779 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including | medium | 5.3 | 1% |
| CVE-2025-8620 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and | medium | 5.3 | 1% |
| CVE-2025-29448 | alextselegidis/easyappointments | Easy!Appointments Denial of Service (DoS) | medium | 0.0 | 1% |
| CVE-2023-5545 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability | medium | 5.3 | 1% |
| CVE-2021-24945 | like-button-rating (WordPress plugin) | The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes | high | 8.0 | 1% |
| CVE-2023-3709 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 | medium | 5.3 | 1% |
| CVE-2024-21544 | spatie/browsershot | Browsershot Local File Inclusion | high | 8.6 | 1% |
| CVE-2022-25273 | drupal/core | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to impro | high | 7.5 | 1% |
| CVE-2024-11089 | anonymous-restricted-content (WordPress plugin) | The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 1% |
| CVE-2024-2541 | popup-builder (WordPress plugin) | The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the S | medium | 5.3 | 1% |
| CVE-2025-49554 | magento/community-edition, magento/project-community-edition | Magento vulnerable to denial of service | high | 7.5 | 1% |
| CVE-2024-25118 | typo3/cms-core | TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords | medium | 4.3 | 1% |
| CVE-2025-68456 | craftcms/cms | Unauthenticated Craft CMS users can trigger a database backup | high | 0.0 | 1% |
| CVE-2020-10945 | centreon/centreon | Centreon Sensitive Data Exposure vulnerability | medium | 4.3 | 1% |
| CVE-2024-8538 | tuxedo-big-file-uploads (WordPress plugin) | The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, a | medium | 4.3 | 1% |