Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.01.2, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-9525 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x | medium | 6.1 | 1% |
| CVE-2015-9526 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0 | medium | 6.1 | 1% |
| CVE-2015-9527 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x be | medium | 6.1 | 1% |
| CVE-2015-9528 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Software Licensing extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x | medium | 6.1 | 1% |
| CVE-2015-9529 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0. | medium | 6.1 | 1% |
| CVE-2015-9530 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Upload File extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | 1% |
| CVE-2015-9531 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads (EDD) Wish Lists extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | 1% |
| CVE-2015-9532 | easy-digital-downloads (WordPress theme) | The Easy Digital Downloads (EDD) Digital Store theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 | medium | 6.1 | 1% |
| CVE-2015-9533 | easy-digital-downloads (WordPress theme) | The Easy Digital Downloads (EDD) Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, | medium | 6.1 | 1% |
| CVE-2015-9534 | easy-digital-downloads (WordPress theme) | The Easy Digital Downloads (EDD) Quota theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2. | medium | 6.1 | 1% |
| CVE-2015-9535 | easy-digital-downloads (WordPress theme) | The Easy Digital Downloads (EDD) Shoppette theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5 | medium | 6.1 | 1% |
| CVE-2015-9536 | easy-digital-downloads (WordPress theme) | The Easy Digital Downloads (EDD) Twenty-Twelve theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 | medium | 6.1 | 1% |
| CVE-2016-10866 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2016-10868 | all-in-one-wp-security-and-firewall (WordPress plugin) | The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection s | medium | 6.1 | 1% |
| CVE-2016-10869 | contact-form-plugin (WordPress plugin) | The contact-form-plugin plugin before 4.0.2 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2016-10871 | mailchimp-for-wp (WordPress plugin) | The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page. | medium | 6.1 | 1% |
| CVE-2016-10892 | chained-quiz (WordPress plugin) | The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues. | medium | 6.1 | 1% |
| CVE-2016-10919 | wassup (WordPress plugin) | The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerabilit | medium | 6.1 | 1% |
| CVE-2016-10925 | peters-login-redirect (WordPress plugin) | The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs. | medium | 6.1 | 1% |
| CVE-2017-12200 | ultimate-product-catalog (WordPress plugin) | The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component. | medium | 6.1 | 1% |
| CVE-2017-18593 | updraftplus (WordPress plugin) | The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file. | medium | 6.1 | 1% |
| CVE-2022-4155 | contest-gallery (WordPress plugin) | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET | medium | 4.9 | 1% |
| CVE-2026-23500 | dolibarr/dolibarr | Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration | critical | 9.1 | 1% |
| CVE-2017-18503 | twitter-cards-meta (WordPress plugin) | The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2017-18506 | woocommerce-pdf-invoices-packing-slips (WordPress plugin) | The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens. | medium | 6.1 | 1% |
| CVE-2019-15644 | zoho-salesiq (WordPress plugin) | The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS. | medium | 6.1 | 1% |
| CVE-2020-5301 | simplesamlphp/simplesamlphp | Information disclosure of source code in SimpleSAMLphp | low | 3.0 | 1% |
| CVE-2024-13333 | file-manager-advanced (WordPress plugin) | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local | high | 7.5 | 1% |
| CVE-2023-0254 | simple-membership-wp-user-import (WordPress plugin) | The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and | high | 7.2 | 1% |
| CVE-2022-24444 | silverstripe/hybridsessions | Hybridsessions does not expire session id on logout | medium | 6.5 | 1% |
| CVE-2022-36037 | getkirby/cms | Cross-site scripting from dynamic options in the multiselect field | medium | 5.9 | 1% |
| CVE-2016-4880 | baserproject/basercms | baserCMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2022-43468 | wordpress-popular-posts (WordPress plugin) | External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the | high | 7.5 | 1% |
| CVE-2015-9328 | profile-builder (WordPress plugin) | The profile-builder plugin before 2.2.5 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2019-8113 | magento/community-edition, magento/product-community-edition | Magento 2 Community Weak PRNG | medium | 5.3 | 1% |
| CVE-2025-61923 | prestashop/ps_checkout | PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure | medium | 4.1 | 1% |
| CVE-2012-4383 | contao/core | Contao core SQL Injection Vulnerability | high | 8.8 | 1% |
| CVE-2018-16966 | wp-file-manager (WordPress plugin) | There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parame | high | 8.8 | 1% |
| CVE-2018-17584 | wp-fastest-cache (WordPress plugin) | The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page. | high | 8.8 | 1% |
| CVE-2023-0259 | wp-google-review-slider (WordPress plugin) | The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statemen | high | 8.8 | 1% |
| CVE-2023-0260 | wp-review-slider (WordPress plugin) | The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, lead | high | 8.8 | 1% |
| CVE-2023-0263 | wp-yelp-review-slider (WordPress plugin) | The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, | high | 8.8 | 1% |
| CVE-2023-2983 | pimcore/pimcore | Pimcore Privilege Defined With Unsafe Actions vulnerability | medium | 6.5 | 1% |
| CVE-2023-4723 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 v | medium | 5.3 | 1% |
| CVE-2019-3848 | moodle/moodle | Moodle Logged in users could view all calendar events | medium | 4.3 | 1% |
| CVE-2023-5504 | backwpup (WordPress plugin) | The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This | high | 8.7 | 1% |
| CVE-2022-4106 | wholesale-market-for-woocommerce (WordPress plugin) | The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user inpu | high | 7.5 | 1% |
| CVE-2021-21339 | typo3/cms, typo3/cms-core | Cleartext storage of session identifier | medium | 5.9 | 1% |
| CVE-2022-3860 | visual-email-designer-for-woocommerce (WordPress plugin) | The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in | high | 8.8 | 1% |
| CVE-2023-4214 | apppresser (WordPress plugin) | The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the | high | 8.1 | 1% |