Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.1, updated 2026-11-01. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1203 | enhanced-e-commerce-for-woocommerce-store (WordPress plugin) | The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQ | high | 8.8 | 1% |
| CVE-2024-1990 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQ | high | 8.8 | 1% |
| CVE-2024-3055 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via th | high | 8.8 | 1% |
| CVE-2020-4061 | october/backend | Cross-site Scripting in October | low | 3.7 | 1% |
| CVE-2023-40606 | kanban-boards-for-wordpress (WordPress plugin) | Improper Control of Generation of Code ('Code Injection') vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affec | critical | 9.1 | 1% |
| CVE-2023-1615 | ultimate-addons-for-contact-form-7 (WordPress plugin) | The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and inc | high | 8.8 | 1% |
| CVE-2021-39202 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | high | 7.6 | 1% |
| CVE-2017-9067 | modx/revolution | MODX Revolution Directory Traversal Vulnerability | high | 7.0 | 1% |
| CVE-2023-4294 | url-shortify (WordPress plugin) | The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated at | medium | 6.1 | 1% |
| CVE-2018-18919 | wp-editor.md (WordPress plugin) | The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area. | medium | 4.8 | 1% |
| CVE-2020-25817 | silverstripe/framework | SilverStripe XXE Vulnerability in CSSContentParser | medium | 4.8 | 1% |
| CVE-2022-25617 | code-snippets (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter. | medium | 4.7 | 1% |
| CVE-2015-9380 | photo-gallery (WordPress plugin) | The photo-gallery plugin before 1.2.42 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2023-0812 | active-directory-integration-\/-ldap-integration (WordPress plugin) | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for som | high | 7.5 | 1% |
| CVE-2021-34660 | wp-fusion-lite (WordPress plugin) | The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admi | medium | 6.1 | 1% |
| CVE-2021-38359 | refer-a-friend-widget-for-wp (WordPress plugin) | The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the | medium | 6.1 | 1% |
| CVE-2022-0946 | showdoc/showdoc | Cross-site Scripting in ShowDoc | medium | 5.4 | 1% |
| CVE-2019-19714 | contao/contao, contao/core-bundle | Insert tag injection in the Contao login module | medium | 5.3 | 1% |
| CVE-2020-25768 | contao/contao, contao/core-bundle | Contao Insert tag injection in forms | medium | 5.3 | 1% |
| CVE-2012-4579 | phpmyadmin/phpmyadmin | phpMyAdmin Multiple XSS Vulnerabilities | low | 0.0 | 1% |
| CVE-2024-10800 | user-extra-fields (WordPress plugin) | The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_sav | high | 8.8 | 1% |
| CVE-2024-13770 | puzzles (WordPress plugin) | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all version | high | 8.1 | 1% |
| CVE-2021-24881 | passter (WordPress plugin) | The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing | high | 7.5 | 1% |
| CVE-2019-16682 | sfroemken/url_redirect | url_redirect for Typo3 SQLi Vulnerability | high | 7.3 | 1% |
| CVE-2022-1849 | filegator/filegator | Improper user session handling in filegator | medium | 4.3 | 1% |
| CVE-2022-21652 | shopware/shopware | Insufficient Session Expiration in shopware | low | 3.5 | 1% |
| CVE-2022-0215 | login\/signup-popup (WordPress plugin), side-cart-woocommerce (WordPress plugin), waitlist-woocommerce (WordPress plugin) | The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vu | high | 8.8 | 1% |
| CVE-2024-6451 | ai-engine (WordPress plugin) | AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to vali | high | 7.2 | 1% |
| CVE-2019-17576 | dolibarr/dolibarr | Dolibarr Cross-site Scripting via outgoing email setup feature | medium | 5.4 | 1% |
| CVE-2019-17577 | dolibarr/dolibarr | Dolibarr Cross-site Scripting via outgoing email setup feature | medium | 5.4 | 1% |
| CVE-2019-17578 | dolibarr/dolibarr | Dolibarr Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2024-1165 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id' | medium | 4.3 | 1% |
| CVE-2025-54370 | phpoffice/phpspreadsheet | PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser | high | 0.0 | 1% |
| CVE-2023-5931 | rtmedia (WordPress plugin) | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow a | high | 8.8 | 1% |
| CVE-2024-1859 | slider-responsive-slideshow (WordPress plugin) | The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions | high | 8.8 | 1% |
| CVE-2024-3032 | builder (WordPress plugin) | Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Red | medium | 6.1 | 1% |
| CVE-2025-51586 | prestashop/prestashop | Presta Shop vulnerable to email enumeration | medium | 4.2 | 1% |
| CVE-2022-45822 | advanced-booking-calendar (WordPress plugin) | Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress. | critical | 10.0 | 1% |
| CVE-2024-3729 | acf-frontend-form-element (WordPress plugin) | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' | critical | 9.8 | 1% |
| CVE-2025-12493 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | critical | 9.8 | 1% |
| CVE-2023-2201 | web-directory-free (WordPress plugin) | The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.6.8 due | high | 8.8 | 1% |
| CVE-2025-7504 | friends (WordPress plugin) | The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the query_ | high | 7.5 | 1% |
| CVE-2024-29477 | dolibarr/dolibarr | Dolibarr ERP CRM Code Injection vulnerability during installation | medium | 6.8 | 1% |
| CVE-2023-23921 | moodle/moodle | Moodle Cross-site Scripting vulnerability | medium | 6.1 | 1% |
| CVE-2023-24780 | funadmin/funadmin | SQL Injection in Funadmin | critical | 9.8 | 1% |
| CVE-2024-6589 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6 | high | 8.8 | 1% |
| CVE-2019-25139 | coming-soon-page-\&-maintenance-mode (WordPress plugin) | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and includin | medium | 6.5 | 1% |
| CVE-2017-14077 | dapphp/securimage | Securimage HTML Injection | medium | 6.1 | 1% |
| CVE-2022-2092 | woocommerce-pdf-invoices\&-packing-slips (WordPress plugin) | The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possib | medium | 6.1 | 1% |
| CVE-2022-35585 | forkcms/forkcms | ForkCMS stored XSS via `start_date` parameter | medium | 4.8 | 1% |