Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-28334 | moodle/moodle | Moodle may allow authenticated users to enumerate other user's names via learning plans page | medium | 4.3 | 1% |
| CVE-2020-36835 | wpvivid-backuprestore (WordPress plugin) | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's databa | medium | 4.9 | 1% |
| CVE-2025-1026 | spatie/browsershot | Browsershot Local File Inclusion | high | 8.6 | 1% |
| CVE-2022-23504 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration | medium | 5.7 | 1% |
| CVE-2024-4266 | metform (WordPress plugin) | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Ex | medium | 5.3 | 1% |
| CVE-2024-25120 | typo3/cms-core | TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme | medium | 4.3 | 1% |
| CVE-2023-28421 | wp-email-capture (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Winwar Media WordPress Email Marketing Plugin – WP Email Capture | medium | 5.3 | 1% |
| CVE-2024-33999 | moodle/moodle | Moodle Improper Input Validation | high | 0.0 | 1% |
| CVE-2024-1083 | simple-restrict (WordPress plugin) | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the | medium | 5.3 | 1% |
| CVE-2026-25513 | facturascripts/facturascripts | FacturaScripts has SQL Injection in API ORDER BY Clause | high | 0.0 | 1% |
| CVE-2023-27447 | wp-sms (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, | medium | 5.3 | 1% |
| CVE-2024-9546 | wpide (WordPress plugin) | The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4. | medium | 5.3 | 1% |
| CVE-2026-25514 | facturascripts/facturascripts | FacturaScripts has SQL Injection in Autocomplete Actions | high | 0.0 | 1% |
| CVE-2022-36399 | booked (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendar | medium | 5.3 | 1% |
| CVE-2026-49211 | symfony/ux-autocomplete | symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil | medium | 0.0 | 1% |
| CVE-2021-48007 | pocketmine/pocketmine-mp | NaN/INF in serverbound movement packets can crash clients and servers | high | 7.5 | 1% |
| CVE-2022-51012 | pocketmine/pocketmine-mp | Insufficient type validation in pocketmine/pocketmine-mp | high | 7.5 | 1% |
| CVE-2024-45792 | mantisbt/mantisbt | MantisBT vulnerable to information disclosure with user profiles | medium | 4.3 | 1% |
| CVE-2024-13535 | actionwear-products-sync (WordPress plugin) | The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is | medium | 5.3 | 1% |
| CVE-2021-36402 | moodle/moodle | Moodle Improper Input Validation vulnerability | medium | 5.3 | 1% |
| CVE-2025-32238 | online-booking-\&-scheduling-calendar (WordPress plugin) | Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vc | medium | 4.3 | 1% |
| CVE-2024-8979 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | high | 8.0 | 1% |
| CVE-2024-34717 | prestashop/prestashop | Anonymous PrestaShop customer can download other customers' invoices | medium | 5.3 | 1% |
| CVE-2024-6835 | add-search-to-menu (WordPress plugin) | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, | medium | 5.3 | 1% |
| CVE-2024-21627 | prestashop/prestashop | PrestaShop some attribute not escaped in Validate::isCleanHTML method | high | 8.1 | 1% |
| CVE-2025-32044 | moodle/moodle | Moodle allows unauthenticated REST API user data exposure | high | 7.5 | 1% |
| CVE-2024-1287 | paid-memberships-pro (WordPress plugin) | The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' | medium | 6.5 | 1% |
| CVE-2026-27891 | facturascripts/facturascripts | FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism | high | 7.2 | 1% |
| CVE-2024-2931 | wpfront-user-role-editor (WordPress plugin) | The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2. | medium | 4.3 | 1% |
| CVE-2025-24980 | pimcore/admin-ui-classic-bundle | Pimcore Admin Classic Bundle allows user enumeration | medium | 0.0 | 1% |
| CVE-2024-12255 | accept-stripe-payments-using-contact-form-7 (WordPress plugin) | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and includ | medium | 5.3 | 1% |
| CVE-2023-5134 | easy-registration-forms (WordPress plugin) | The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, a | medium | 4.3 | 1% |
| CVE-2023-4157 | omeka/omeka-s | omeka/omeka-s Improper Input Validation vulnerability | medium | 5.2 | 1% |
| CVE-2024-13622 | woo-addon-uploads (WordPress plugin) | The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | high | 7.5 | 1% |
| CVE-2023-48288 | jobwp (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.Thi | high | 7.5 | 1% |
| CVE-2026-55555 | dompdf/dompdf | Dompdf: File existence oracle via font-face stylesheet declaration | low | 0.0 | 1% |
| CVE-2021-46876 | ezsystems/ezpublish-kernel | /user/sessions endpoint allows detecting valid accounts | medium | 5.3 | 1% |
| CVE-2026-50157 | auth0/symfony | Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter | medium | 6.5 | 1% |
| CVE-2024-2950 | boldgrid-easy-seo (WordPress plugin) | The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inclu | medium | 5.3 | 1% |
| CVE-2024-13600 | majestic-support (WordPress plugin) | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Expo | high | 7.5 | 0% |
| CVE-2024-13611 | bp-better-messages (WordPress plugin) | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitiv | high | 7.5 | 0% |
| CVE-2024-25121 | typo3/cms-core | TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler | high | 7.1 | 0% |
| CVE-2024-2974 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Se | medium | 5.3 | 0% |
| CVE-2024-3733 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Se | medium | 5.3 | 0% |
| CVE-2022-46158 | prestashop/prestashop | PrestaShop has potential Information exposure in the upload directory | medium | 5.3 | 0% |
| CVE-2024-7418 | the-post-grid (WordPress plugin) | The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Sensitive Informatio | medium | 4.3 | 0% |
| CVE-2024-54141 | thorsten/phpmyfaq | phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available | high | 8.6 | 0% |
| CVE-2023-6922 | coming-soon-maintenance-mode-from-acurax (WordPress plugin) | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to | medium | 4.3 | 0% |
| CVE-2026-79773 | winter/wn-system-module | Winter: Local File Inclusion through =include directives in JavaScript asset compilation | medium | 4.9 | 0% |
| CVE-2024-2966 | bdthemes-element-pack-lite (WordPress plugin) | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerab | medium | 5.3 | 0% |