Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-32106 | icecoder/icecoder | Cross-site scripting in ICEcoder | medium | 5.4 | 1% |
| CVE-2022-31290 | idno/known | Known v1.3.1 Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2021-22969 | concrete5/core | Server-Side Request Forgery in Concrete CMS | medium | 0.0 | 1% |
| CVE-2020-12468 | intelliants/subrion | Subrion CMS CSV injection via Export Language | high | 7.8 | 1% |
| CVE-2023-6133 | forminator (WordPress plugin) | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime | medium | 6.6 | 1% |
| CVE-2021-24742 | logo-slider-and-showcase (WordPress plugin) | The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX a | medium | 6.5 | 1% |
| CVE-2022-4897 | backupbuddy (WordPress plugin) | The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, le | medium | 6.1 | 1% |
| CVE-2022-0746 | dolibarr/dolibarr | Logic error in dolibarr/dolibarr | medium | 4.3 | 1% |
| CVE-2014-125029 | ttskch/pagination-service-provider | PaginationServiceProvider SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2024-12853 | modula-best-grid-gallery (WordPress plugin) | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload | high | 8.8 | 1% |
| CVE-2018-20755 | modx/revolution | MODX Revolution vulnerable to XSS attack through its User Photo field | medium | 6.1 | 1% |
| CVE-2018-20756 | modx/revolution | MODX Revolution allows XSS via document resources | medium | 6.1 | 1% |
| CVE-2018-20757 | modx/revolution | MODX Revolution allows XSS through extended user fields | medium | 6.1 | 1% |
| CVE-2015-2324 | photo-gallery (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authentica | medium | 5.4 | 1% |
| CVE-2022-42097 | backdrop/backdrop | Cross-site Scripting in Backdrop CMS | medium | 4.8 | 1% |
| CVE-2026-40187 | egroupware/egroupware | EGroupware has Authenticated RCE via Malicious eTemplate Upload | high | 0.0 | 1% |
| CVE-2023-3636 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficien | high | 8.8 | 1% |
| CVE-2024-6467 | bookingpress-appointment-booking (WordPress plugin) | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Rea | high | 8.8 | 1% |
| CVE-2022-31158 | packbackbooks/lti-1-3-php-library | LTI 1.3 Tool Library's Nonce Claim Value not validated against nonce value sent in Authentication Request before v5.0 | high | 7.5 | 1% |
| CVE-2024-28754 | billz/raspap-webgui | raspap-webgui vulnerable to denial of service | high | 7.5 | 1% |
| CVE-2023-39530 | prestashop/prestashop | PrestaShop file deletion via CustomerMessage | medium | 6.5 | 1% |
| CVE-2023-28438 | pimcore/pimcore | Pimcore vulnerable to improper quoting of filters in Custom Reports | medium | 6.2 | 1% |
| CVE-2022-0379 | microweber/microweber | Cross-site Scripting in microweber | medium | 5.4 | 1% |
| CVE-2022-0232 | custom-landing-pages-leadmagic (WordPress plugin) | The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via | medium | 4.8 | 1% |
| CVE-2023-28108 | pimcore/pimcore | Improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model | high | 7.9 | 1% |
| CVE-2018-19280 | centreon/centreon | Centreon XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2021-24599 | email-encoder (WordPress plugin) | The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a | medium | 6.1 | 1% |
| CVE-2022-4108 | wholesale-market-for-woocommerce (WordPress plugin) | The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high | medium | 4.9 | 1% |
| CVE-2019-12617 | silverstripe/framework | SilverStripe Priviledge escalation through cache pollution | low | 2.7 | 1% |
| CVE-2024-3229 | salon-booking-system (WordPress plugin) | The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_ | critical | 9.8 | 1% |
| CVE-2019-8109 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability via CSRF | high | 8.0 | 1% |
| CVE-2023-2984 | pimcore/pimcore | Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter | medium | 6.3 | 1% |
| CVE-2023-23922 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2024-10627 | woocommerce-support-ticket-system (WordPress plugin) | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th | critical | 9.8 | 1% |
| CVE-2024-13091 | wpot (WordPress plugin) | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcl | critical | 9.8 | 1% |
| CVE-2022-0960 | showdoc/showdoc | Cross-site Scripting in showdoc/showdoc | critical | 9.0 | 1% |
| CVE-2019-5992 | wordpress-ultra-simple-paypal-shopping-cart (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to h | high | 8.8 | 1% |
| CVE-2023-6035 | eazydocs (WordPress plugin) | The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an | high | 8.8 | 1% |
| CVE-2022-1584 | microweber/microweber | Cross-site Scripting in Microweber | medium | 6.3 | 1% |
| CVE-2021-36150 | silverstripe/admin | Cross-site Scripting in SilverStripe Framework | medium | 6.1 | 1% |
| CVE-2021-40695 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2024-8480 | sirv (WordPress plugin) | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil | high | 8.8 | 1% |
| CVE-2021-24770 | stylish-price-list (WordPress plugin) | The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to | medium | 6.5 | 1% |
| CVE-2024-1731 | auto-refresh-single-page (WordPress plugin) | The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deseri | high | 8.8 | 1% |
| CVE-2024-7559 | file-manager-pro (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks | high | 8.8 | 1% |
| CVE-2020-36697 | wp-gdpr (WordPress plugin) | The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2 | high | 7.3 | 1% |
| CVE-2019-8232 | magento/community-edition | Magento 2 Community Edition RCE Vulnerability | medium | 6.6 | 1% |
| CVE-2022-2108 | review-buddypress-groups (WordPress plugin) | The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due | medium | 6.5 | 1% |
| CVE-2023-27577 | flarum/core | Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files | medium | 6.5 | 1% |
| CVE-2018-6520 | simplesamlphp/simplesamlphp | SimpleSAMLphp Open redirection protection bypass | medium | 6.1 | 1% |