Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0818 | woocommerce-affiliate (WordPress plugin) | The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, | medium | 6.1 | 1% |
| CVE-2022-23912 | ap-custom-testimonial (WordPress plugin) | The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an | medium | 6.1 | 1% |
| CVE-2024-46212 | redaxo/source | Path traversal in redaxo | medium | 4.9 | 1% |
| CVE-2017-20063 | elefant/cms | Unrestricted Upload of File with Dangerous Type in Elefant CMS | high | 8.8 | 1% |
| CVE-2020-35933 | newsletter (WordPress plugin) | A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attacke | medium | 6.5 | 1% |
| CVE-2014-8607 | xcloner (WordPress plugin) | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows loca | low | 2.1 | 1% |
| CVE-2023-6026 | elijaa/phpmemcacheadmin | PHPMemcachedAdmin Path Traversal vulnerability | critical | 9.8 | 1% |
| CVE-2025-2257 | boldgrid-backup (WordPress plugin) | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in | high | 7.2 | 1% |
| CVE-2020-12469 | intelliants/subrion | Subrion CMS PHP Object Injection | medium | 6.5 | 1% |
| CVE-2023-39525 | prestashop/prestashop | PrestaShop path traversal | medium | 6.5 | 1% |
| CVE-2024-45291 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled | medium | 6.3 | 1% |
| CVE-2018-1000640 | villagedefrance/opencart-overclocked | OpenCart-Overclocked Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2018-16257 | wp-all-import (WordPress plugin) | There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is | medium | 6.1 | 1% |
| CVE-2020-13662 | drupal/core, drupal/drupal | Drupal Core Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2025-51501 | microweber/microweber | Microweber has Reflected XSS Vulnerability in the id Parameter | medium | 6.1 | 1% |
| CVE-2014-125093 | ad-blocking-detector (WordPress plugin) | A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability aff | medium | 4.3 | 1% |
| CVE-2019-10187 | moodle/moodle | Moodle Ability to delete glossary entries that belong to another glossary | medium | 4.3 | 1% |
| CVE-2019-10188 | moodle/moodle | moodle Improper Access Control | medium | 4.0 | 1% |
| CVE-2019-10189 | moodle/moodle | moodle Improper Access Control | medium | 4.0 | 1% |
| CVE-2023-6699 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includin | critical | 9.1 | 1% |
| CVE-2019-17386 | animate-it (WordPress plugin) | The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php. | high | 8.8 | 1% |
| CVE-2024-42355 | shopware/core, shopware/platform | Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag | high | 8.3 | 1% |
| CVE-2023-30545 | prestashop/prestashop | Arbitrary file read via SQL injection | high | 7.7 | 1% |
| CVE-2024-11956 | pimcore/customer-management-framework-bundle | pimcore/customer-data-framework vulnerable to SQL Injection | high | 7.2 | 1% |
| CVE-2017-1000434 | furikake (WordPress plugin) | Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to | medium | 6.1 | 1% |
| CVE-2026-31857 | craftcms/cms | CraftCMS has an RCE vulnerability via relational conditionals in the control panel | high | 0.0 | 1% |
| CVE-2026-84190 | librenms/librenms | LibreNMS Vulnerable to Remote Code Execution via AboutController | medium | 0.0 | 1% |
| CVE-2025-48200 | sjbr/sr-feuser-register | The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution | critical | 10.0 | 1% |
| CVE-2022-48365 | ezsystems/ezplatform-kernel, ezsystems/ezpublish-kernel | Company admin role gives excessive privileges in eZ Platform Ibexa | high | 7.2 | 1% |
| CVE-2017-2578 | moodle/moodle | Moodle Cross-site Scripting in assignment submission page | medium | 6.1 | 1% |
| CVE-2022-1465 | wpc-smart-wishlist-for-woocommerce (WordPress plugin) | The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in a | medium | 6.1 | 1% |
| CVE-2022-1527 | wp-2fa (WordPress plugin) | The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a R | medium | 6.1 | 1% |
| CVE-2023-26366 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 6.8 | 1% |
| CVE-2019-15481 | kevinpapst/kimai2 | Kimai v2 is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | 1% |
| CVE-2019-15483 | bolt/bolt | Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log | medium | 6.1 | 1% |
| CVE-2019-15484 | bolt/bolt | Bolt Cross-site Scripting (XSS) via an image's alt or title field | medium | 6.1 | 1% |
| CVE-2019-15485 | bolt/bolt | Cross-site Scripting in Bolt | medium | 6.1 | 1% |
| CVE-2021-28145 | concrete5/concrete5 | Concrete CMS Cross-site Scripting via Survey Blocks | medium | 5.4 | 1% |
| CVE-2024-8615 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch | critical | 10.0 | 1% |
| CVE-2024-39398 | magento/community-edition, magento/project-community-edition | Magento does not properly restrict excessive authentication attempts | high | 7.4 | 1% |
| CVE-2022-1267 | bmi-bmr-calculator (WordPress plugin) | The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting it back in the respon | medium | 6.1 | 1% |
| CVE-2022-4260 | wp-ban (WordPress plugin) | The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | 1% |
| CVE-2024-9756 | order-attachments-for-woocommerce (WordPress plugin) | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing cap | medium | 4.3 | 1% |
| CVE-2019-19915 | 301-redirects (WordPress plugin) | The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, del | critical | 9.0 | 1% |
| CVE-2026-75827 | getgrav/grav | Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write | high | 8.8 | 1% |
| CVE-2015-9422 | plugnedit (WordPress plugin) | The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields | medium | 6.5 | 1% |
| CVE-2015-9433 | wp-social-bookmarking-light (WordPress plugin) | The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twit | medium | 6.5 | 1% |
| CVE-2016-10938 | copy-me (WordPress plugin) | The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location. | medium | 6.5 | 1% |
| CVE-2025-51502 | microweber/microweber | Microweber has Reflected XSS Vulnerability in the layout Parameter | medium | 6.1 | 1% |
| CVE-2020-20633 | gdpr-cookie-consent (WordPress plugin) | ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) | medium | 5.4 | 1% |