Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-3895 | wp-datepicker (WordPress plugin) | The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_ | high | 8.8 | 1% |
| CVE-2024-39399 | magento/community-edition, magento/project-community-edition | Magento Path Traversal vulnerability | high | 7.7 | 1% |
| CVE-2024-2654 | wp-file-manager (WordPress plugin) | The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_b | medium | 6.8 | 1% |
| CVE-2021-3133 | sb-elementor-contact-form-db (WordPress plugin) | The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages. | medium | 6.5 | 1% |
| CVE-2023-4505 | ldap-ad-staff-employee-directory-search (WordPress plugin) | The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and incl | low | 2.2 | 1% |
| CVE-2023-4506 | ldap-login-for-intranet-sites (WordPress plugin) | The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4. | low | 2.2 | 1% |
| CVE-2023-2338 | pimcore/pimcore | SQL Injection in AssetController | high | 8.8 | 1% |
| CVE-2024-34103 | magento/community-edition | Magento Open Source Improper Authentication vulnerability | high | 8.1 | 1% |
| CVE-2022-4384 | stream (WordPress plugin) | The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert c | medium | 6.5 | 1% |
| CVE-2017-6103 | anyvar (WordPress plugin) | Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1. | medium | 6.1 | 1% |
| CVE-2024-10960 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploa | critical | 9.9 | 1% |
| CVE-2022-44584 | watchtowerhq (WordPress plugin) | Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress. | critical | 9.1 | 1% |
| CVE-2023-3086 | nilsteampassnet/teampass | TeamPass vulnerable to stored Cross-site Scripting | critical | 9.0 | 1% |
| CVE-2022-0983 | moodle/moodle | SQL Injection in Moodle | high | 8.8 | 1% |
| CVE-2023-0277 | wc-fields-factory (WordPress plugin) | The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, l | high | 7.2 | 1% |
| CVE-2021-25041 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_bre | medium | 6.1 | 1% |
| CVE-2021-39334 | job-board-vanilla (WordPress plugin) | The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via | medium | 5.5 | 1% |
| CVE-2021-39335 | wpgenious-job-listing (WordPress plugin) | The WpGenius Job Listing WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization | medium | 5.5 | 1% |
| CVE-2021-39336 | job-manager (WordPress plugin) | The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via seve | medium | 5.5 | 1% |
| CVE-2021-39337 | job-portal (WordPress plugin) | The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via sever | medium | 5.5 | 1% |
| CVE-2024-0593 | simple-job-board (WordPress plugin) | The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fe | medium | 5.3 | 1% |
| CVE-2022-0930 | microweber/microweber | Cross-site Scripting in microweber | medium | 4.8 | 1% |
| CVE-2023-2224 | seo (WordPress plugin) | The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users suc | medium | 4.8 | 1% |
| CVE-2020-5298 | october/backend | Reflected XSS when importing CSV in OctoberCMS | medium | 4.0 | 1% |
| CVE-2022-27235 | social-share-buttons-by-supsystic (WordPress plugin) | Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. | medium | 6.3 | 1% |
| CVE-2015-3257 | zendframework/zend-diactoros | zend-diactoros Cross-site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2023-5558 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a R | medium | 6.1 | 1% |
| CVE-2022-2060 | dolibarr/dolibarr | Cross site scripting in dolibarr | medium | 5.4 | 1% |
| CVE-2022-25649 | affiliate-for-woocommerce (WordPress plugin) | Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress. | medium | 5.0 | 1% |
| CVE-2015-10009 | nonfiction/nterchange | nterchange Code Injection vulnerability | critical | 9.8 | 1% |
| CVE-2023-0875 | wp-meta-seo (WordPress plugin) | The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injectio | high | 8.8 | 1% |
| CVE-2023-4776 | wpschoolpress (WordPress plugin) | The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did | high | 8.8 | 1% |
| CVE-2024-6311 | funnelforms-free (WordPress plugin) | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' | high | 7.2 | 1% |
| CVE-2015-9502 | auberge-theme (WordPress theme) | The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier. | medium | 6.1 | 1% |
| CVE-2015-9503 | modern-theme (WordPress theme) | The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier. | medium | 6.1 | 1% |
| CVE-2017-18599 | pinfinity (WordPress theme) | The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter. | medium | 6.1 | 1% |
| CVE-2017-18606 | avada (WordPress theme) | The avada theme before 5.1.5 for WordPress has stored XSS. | medium | 6.1 | 1% |
| CVE-2020-36172 | advanced-custom-fields (WordPress plugin) | The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading t | medium | 6.1 | 1% |
| CVE-2022-1005 | wp-statistics (WordPress plugin) | The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, | medium | 6.1 | 1% |
| CVE-2022-1269 | fastflow (WordPress plugin) | The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an ad | medium | 6.1 | 1% |
| CVE-2022-24733 | sylius/sylius | Improper Restriction of Rendered UI Layers or Frames in Sylius | medium | 6.1 | 1% |
| CVE-2019-7411 | launcher (WordPress plugin) | Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject | medium | 5.4 | 1% |
| CVE-2024-2497 | billz/raspap-webgui | RaspAP Vulnerable to Code Injection via an Unknown Process in File `includes/provider.php` | medium | 4.7 | 1% |
| CVE-2017-7531 | moodle/moodle | Moodle Information Disclosure | medium | 4.3 | 1% |
| CVE-2023-0557 | contentstudio (WordPress plugin) | The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could a | high | 7.5 | 1% |
| CVE-2021-4139 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.6 | 1% |
| CVE-2018-20028 | contao/contao | Contao Information Disclosure via Access Control Flaws | medium | 6.5 | 1% |
| CVE-2022-4295 | show-all-comments (WordPress plugin) | The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 1% |
| CVE-2022-30596 | moodle/moodle | Cross-site Scripting in moodle | medium | 5.4 | 1% |
| CVE-2020-36666 | directory-pro (WordPress plugin), final-user (WordPress plugin), fitness-trainer (WordPress plugin) +8 more | The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordP | high | 8.8 | 1% |