Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-7877 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2024-34106 | magento/community-edition | Magento Open Source Incorrect Authorization vulnerability | medium | 5.3 | 1% |
| CVE-2021-25109 | futurio-extra (WordPress plugin) | The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to e | low | 2.7 | 1% |
| CVE-2020-5391 | wp-auth0 (WordPress plugin) | Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field. | high | 8.8 | 1% |
| CVE-2022-3747 | becustom (WordPress plugin) | The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to miss | high | 8.8 | 1% |
| CVE-2024-36528 | nukeviet/nukeviet | nukeviet Deserialization of Untrusted Data vulnerability | high | 8.8 | 1% |
| CVE-2023-2309 | wpforo-forum (WordPress plugin) | The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Sit | medium | 6.1 | 1% |
| CVE-2023-4148 | ditty (WordPress plugin) | The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attr | medium | 6.1 | 1% |
| CVE-2019-10271 | ultimate-member (WordPress plugin) | An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It | medium | 4.3 | 1% |
| CVE-2019-12466 | mediawiki/core | Wikimedia MediaWiki allows CSRF | high | 8.8 | 1% |
| CVE-2022-21648 | latte/latte | Sandbox bypass in Latte templates | high | 8.2 | 1% |
| CVE-2024-13908 | bws-smtp (WordPress plugin) | The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_option | high | 7.2 | 1% |
| CVE-2018-17946 | slideshow-gallery (WordPress plugin) | The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupda | medium | 6.1 | 1% |
| CVE-2020-23263 | forkcms/forkcms | Cross-site scripting in forkcms | medium | 6.1 | 1% |
| CVE-2020-6578 | zencart/zencart | Reflected XSS in Zen Cart before 1.5.7a | medium | 6.1 | 1% |
| CVE-2021-34652 | media-usage (WordPress plugin) | The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allo | medium | 6.1 | 1% |
| CVE-2021-34655 | wp-songbook (WordPress plugin) | The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter found in the ~/inc/class.ajax.php fil | medium | 6.1 | 1% |
| CVE-2021-34657 | typofr (WordPress plugin) | The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the ~/vendor/Org_Heigl/Hyphenato | medium | 6.1 | 1% |
| CVE-2021-34665 | wp-seo-tags (WordPress plugin) | The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saq_txt_the_filter parameter in the ~/wp-seo-tags.p | medium | 6.1 | 1% |
| CVE-2021-34666 | sidebar-adder (WordPress plugin) | The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file whic | medium | 6.1 | 1% |
| CVE-2022-24746 | shopware/core, shopware/platform, shopware/storefront | HTML injection possibility in voucher code form in Shopware | medium | 6.1 | 1% |
| CVE-2017-1000488 | mautic/core | Inline JS XSS vulnerability in Mautic | medium | 6.1 | 1% |
| CVE-2025-22871 | spiral/roadrunner | RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency | critical | 9.1 | 1% |
| CVE-2026-84374 | maatwebsite/excel | Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path | high | 7.5 | 1% |
| CVE-2023-2446 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and includ | medium | 6.5 | 1% |
| CVE-2018-0574 | baserproject/basercms | XSS in baserCMS | medium | 6.1 | 1% |
| CVE-2009-4159 | directmailteam/direct-mail | TYPO3 Direct Mail Extension Vulnerable to Cross-Site Scripting (XSS) | low | 0.0 | 1% |
| CVE-2021-36392 | moodle/moodle | Moodle SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2023-3084 | nilsteampassnet/teampass | TeamPass vulnerable to stored Cross-site Scripting | high | 8.1 | 1% |
| CVE-2023-2607 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions | high | 7.2 | 1% |
| CVE-2022-4306 | panda-pods-repeater-field (WordPress plugin) | The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, | medium | 5.4 | 1% |
| CVE-2019-14216 | wp-svg-icons (WordPress plugin) | An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg- | high | 8.8 | 1% |
| CVE-2022-3846 | workreap (WordPress plugin) | The Workreap WordPress theme before 2.6.3 has a vulnerability with the notifications feature as it's possible to read any user's notificatio | high | 7.5 | 1% |
| CVE-2018-10125 | contao/contao, contao/core, contao/core-bundle | Cross-site Scripting in Contao | medium | 6.1 | 1% |
| CVE-2012-3529 | typo3/cms | Typo3 Backend Configuration XSS Vulnerability | low | 0.0 | 1% |
| CVE-2025-66297 | getgrav/grav | Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection | high | 0.0 | 1% |
| CVE-2022-1969 | mobile-browser-color-select (WordPress plugin) | The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. Th | high | 8.8 | 1% |
| CVE-2022-45833 | easy-wp-smtp (WordPress plugin) | Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. | medium | 6.8 | 1% |
| CVE-2017-8384 | craftcms/cms | Craft CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2019-17496 | craftcms/cms | Craft CMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-0964 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2024-13627 | owl-carousel-slider (WordPress plugin) | The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading | medium | 4.7 | 1% |
| CVE-2019-3809 | moodle/moodle | Moodle Blind SSRF Risk in /badges/mybackpack.php | critical | 10.0 | 1% |
| CVE-2021-24981 | directorist (WordPress plugin) | The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP | high | 7.5 | 1% |
| CVE-2022-23503 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework | high | 7.5 | 1% |
| CVE-2022-35692 | magento/community-edition, magento/project-community-edition | Magento Open Source has Improper Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2022-35587 | forkcms/forkcms | ForkCMS XSS via `publish_on_date` parameter | medium | 4.8 | 1% |
| CVE-2014-5072 | wp-security-audit-log (WordPress plugin) | Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack | high | 8.8 | 1% |
| CVE-2023-3604 | all-in-one-login (WordPress plugin) | The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing t | high | 7.5 | 1% |
| CVE-2019-7890 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition IDOR Vulnerability | high | 7.3 | 1% |