Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-9016 | dolibarr/dolibarr | Dolibarr ERP and CRM contain XSS Vulnerability | medium | 5.4 | 1% |
| CVE-2023-6030 | logdash-activity-log (WordPress plugin) | The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed | medium | 5.4 | 1% |
| CVE-2021-4241 | phpservermon/phpservermon | PHPServerMon PRNG has Insufficient Entropy | medium | 5.3 | 1% |
| CVE-2023-5256 | drupal/core | In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause se | critical | 0.0 | 1% |
| CVE-2019-25217 | speed-optimizer (WordPress plugin) | The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusio | critical | 9.8 | 1% |
| CVE-2024-1895 | event-monster (WordPress plugin) | The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all vers | high | 7.5 | 1% |
| CVE-2023-1425 | groundhogg (WordPress plugin) | The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly | high | 7.2 | 1% |
| CVE-2023-2482 | responsive-css-editor (WordPress plugin) | The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, | high | 7.2 | 1% |
| CVE-2023-2592 | formcraft (WordPress plugin) | The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to | high | 7.2 | 1% |
| CVE-2023-2805 | supportcandy (WordPress plugin) | The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX | high | 7.2 | 1% |
| CVE-2023-5082 | sitemap-by-click5 (WordPress plugin) | The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statemen | high | 7.2 | 1% |
| CVE-2023-5907 | file-manager (WordPress plugin) | The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root out | medium | 6.5 | 1% |
| CVE-2023-0514 | membership-database (WordPress plugin) | The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 6.1 | 1% |
| CVE-2023-0948 | japanized-for-woocommerce (WordPress plugin) | The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to | medium | 6.1 | 1% |
| CVE-2023-1546 | mycryptocheckout (WordPress plugin) | The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cros | medium | 6.1 | 1% |
| CVE-2023-2122 | image-optimizer (WordPress plugin) | The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it | medium | 6.1 | 1% |
| CVE-2023-2272 | tiempo (WordPress plugin) | The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading | medium | 6.1 | 1% |
| CVE-2022-24953 | pear/crypt_gpg | Crypt_GPG does not prevent additional options in GPG calls | medium | 5.3 | 1% |
| CVE-2021-20781 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions pri | high | 8.8 | 1% |
| CVE-2025-2780 | woffice (WordPress plugin) | The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validatio | high | 8.8 | 1% |
| CVE-2024-45411 | twig/twig | Twig has a possible sandbox bypass | high | 8.5 | 1% |
| CVE-2023-0331 | correos-oficial (WordPress plugin) | The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, | high | 7.5 | 1% |
| CVE-2021-4000 | showdoc/showdoc | Open Redirect in showdoc | medium | 6.5 | 1% |
| CVE-2022-1474 | wp-event-manager (WordPress plugin) | The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the | medium | 6.1 | 1% |
| CVE-2022-1532 | woocommerce-product-filter (WordPress plugin) | Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin | medium | 6.1 | 1% |
| CVE-2022-1604 | mailerlite-signup-forms (WordPress plugin) | The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re | medium | 6.1 | 1% |
| CVE-2015-10029 | kelvinmo/simplexrd | kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference | critical | 9.8 | 1% |
| CVE-2015-10012 | sumocoders/framework-user-bundle | FrameworkUserBundle Generates Error Message Containing Sensitive Information | high | 7.5 | 1% |
| CVE-2024-10628 | quiz-maker (WordPress plugin) | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions u | high | 7.5 | 1% |
| CVE-2024-7714 | chatgpt-assistant (WordPress plugin) | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthen | high | 7.5 | 1% |
| CVE-2020-19626 | craftcms/cms | Craft CMS Cross-site Scripting Vulnerability | medium | 5.4 | 1% |
| CVE-2023-5709 | widget-twitter (WordPress plugin) | The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 | high | 8.8 | 1% |
| CVE-2023-2188 | colibri-page-builder (WordPress plugin) | The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 | high | 7.2 | 1% |
| CVE-2023-2484 | ldap-login-for-intranet-sites (WordPress plugin) | The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in vers | high | 7.2 | 1% |
| CVE-2019-10118 | snipe/snipe-it | Snipe-IT XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-45370 | wordpress-comments-import-and-export (WordPress plugin) | Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects W | medium | 6.1 | 1% |
| CVE-2020-35946 | all-in-one-seo-pack (WordPress plugin) | An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to | medium | 5.4 | 1% |
| CVE-2022-0575 | librenms/librenms | Cross-site Scripting in librenms | medium | 5.4 | 1% |
| CVE-2022-0589 | librenms/librenms | Cross-site Scripting in librenms | medium | 5.4 | 1% |
| CVE-2022-1380 | snipe/snipe-it | Cross-site Scripting in snipe-it | medium | 5.4 | 1% |
| CVE-2020-15513 | mittwald/typo3_forum | Incorrect access control in typo3_forum | medium | 5.3 | 1% |
| CVE-2021-4352 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsetti | medium | 5.3 | 1% |
| CVE-2024-45117 | magento/community-edition | Magento Open Source Improper Input Validation vulnerability | high | 7.6 | 1% |
| CVE-2016-6485 | magento/community-edition, magento/project-community-edition, magento/product-community-edition | Unauthenticated crypto and weak IV in Magento\Framework\Encryption | high | 7.5 | 1% |
| CVE-2023-3154 | nextgen-gallery (WordPress plugin) | The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation | high | 7.5 | 1% |
| CVE-2023-48122 | microweber/microweber | Microweber allows a remote attacker to obtain sensitive information via the HTTP GET method | high | 7.5 | 1% |
| CVE-2024-47823 | livewire/livewire | Livewire Remote Code Execution on File Uploads | high | 7.5 | 1% |
| CVE-2015-9442 | avenirsoft-directdownload (WordPress plugin) | The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin. | medium | 6.5 | 1% |
| CVE-2015-9443 | accurate-form-data-real-time-form-validation (WordPress plugin) | The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page= | medium | 6.5 | 1% |
| CVE-2019-12139 | ezsystems/ezplatform-admin-ui | ezplatform-admin-ui Cross-site Scripting (XSS) vulnerability | medium | 6.1 | 1% |