Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4350 | concrete5/concrete5 | Concrete CMS Stored Cross-site Scripting vulnerability | low | 3.0 | 0% |
| CVE-2024-8978 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerabl | medium | 5.7 | 0% |
| CVE-2024-13613 | wise-chat (WordPress plugin) | The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uplo | high | 7.5 | 0% |
| CVE-2024-10050 | header-footer-elementor (WordPress plugin) | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6 | medium | 4.3 | 0% |
| CVE-2024-41109 | pimcore/admin-ui-classic-bundle | Pimcore vulnerable to disclosure of system and database information behind /admin firewall | medium | 6.3 | 0% |
| CVE-2024-0616 | content-protector (WordPress plugin) | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to | medium | 5.3 | 0% |
| CVE-2024-0620 | password-protect-page (WordPress plugin) | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 0% |
| CVE-2024-7412 | no-update-nag (WordPress plugin) | The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to th | medium | 5.3 | 0% |
| CVE-2024-4003 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St | medium | 6.4 | 0% |
| CVE-2023-51406 | fastdup (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.Th | medium | 5.3 | 0% |
| CVE-2023-51688 | ecommerce-product-catalog (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This is | medium | 5.3 | 0% |
| CVE-2024-11291 | paid-member-subscriptions (WordPress plugin) | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to S | medium | 5.3 | 0% |
| CVE-2024-7630 | relevanssi (WordPress plugin) | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Fr | medium | 5.3 | 0% |
| CVE-2026-1196 | mineadmin/mineadmin | MineAdmin May Expose Sensitive Information to an Unauthorized Actor | low | 3.1 | 0% |
| CVE-2024-34002 | moodle/moodle | Moodle Authenticated LFI risk in some misconfigured shared hosting environments | medium | 6.5 | 0% |
| CVE-2024-34005 | moodle/moodle | Moodle Authenticated LFI risk in some misconfigured shared hosting environments | medium | 6.5 | 0% |
| CVE-2025-8573 | concrete5/concrete5 | Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page | low | 0.0 | 0% |
| CVE-2024-13638 | order-attachments-for-woocommerce (WordPress plugin) | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ | medium | 5.9 | 0% |
| CVE-2024-13641 | woo-refund-and-exchange-lite (WordPress plugin) | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPre | medium | 5.9 | 0% |
| CVE-2019-14671 | grumpydictator/firefly-iii | Improper Input Validation in Firefly III | low | 3.3 | 0% |
| CVE-2024-50342 | symfony/http-client, symfony/symfony | Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient | low | 3.1 | 0% |
| CVE-2024-34358 | typo3/cms-core | TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController | medium | 5.3 | 0% |
| CVE-2024-0906 | fx-private-site (WordPress plugin) | The f(x) Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via t | medium | 5.3 | 0% |
| CVE-2026-2894 | funadmin/funadmin | funadmin exposes sensitive information via getMember function | medium | 5.3 | 0% |
| CVE-2025-1022 | spatie/browsershot | Browsershot Path Traversal | high | 8.2 | 0% |
| CVE-2025-1322 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and | medium | 4.3 | 0% |
| CVE-2024-8106 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 6.5 | 0% |
| CVE-2026-84307 | filament/filament | Filament: Password validity disclosure for accounts denied panel access on login page | low | 3.7 | 0% |
| CVE-2026-56341 | wwbn/avideo | AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records | high | 7.5 | 0% |
| CVE-2024-34004 | moodle/moodle | Moodle Authenticated LFI risk in some misconfigured shared hosting environments | medium | 6.5 | 0% |
| CVE-2026-52837 | alextselegidis/easyappointments | Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page | medium | 0.0 | 0% |
| CVE-2026-48009 | shopware/core, shopware/platform | Shopware: Admin Account Takeover via User Recovery Hash Exposure | medium | 6.8 | 0% |
| CVE-2026-39850 | yiisoft/yii2 | Yii 2: Local file inclusion via view parameter name collision | high | 7.4 | 0% |
| CVE-2024-11090 | restrict-content (WordPress plugin) | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc | medium | 5.3 | 0% |
| CVE-2024-50343 | symfony/symfony, symfony/validator | Symfony has an incorrect response from Validator when input ends with `\n` | low | 3.1 | 0% |
| CVE-2024-0708 | landing-page-cat (WordPress plugin) | The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposu | medium | 5.3 | 0% |
| CVE-2023-52185 | everest-backup (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration | medium | 5.3 | 0% |
| CVE-2024-1246 | concrete5/concrete5 | Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature | low | 2.0 | 0% |
| CVE-2024-0910 | restrict-for-elementor (WordPress plugin) | The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 | medium | 5.3 | 0% |
| CVE-2024-5615 | opengraph (WordPress plugin) | The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'op | medium | 5.3 | 0% |
| CVE-2024-6448 | mollie-payments-for-woocommerce (WordPress plugin) | The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. | medium | 5.3 | 0% |
| CVE-2024-6554 | branda-white-labeling (WordPress plugin) | The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions | medium | 5.3 | 0% |
| CVE-2024-7426 | peepso-core (WordPress plugin) | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure | medium | 5.3 | 0% |
| CVE-2026-55554 | dompdf/dompdf | Dompdf: Chroot Validation Bypass | low | 0.0 | 0% |
| CVE-2024-6567 | ebook-store (WordPress plugin) | The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the | medium | 5.3 | 0% |
| CVE-2026-56722 | dompdf/dompdf | Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI | medium | 0.0 | 0% |
| CVE-2026-54543 | froxlor/froxlor | Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields | medium | 5.4 | 0% |
| CVE-2024-13525 | emails-verification-for-woocommerce (WordPress plugin) | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 6.5 | 0% |
| CVE-2026-54768 | wp-graphql/wp-graphql | WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeratio | medium | 0.0 | 0% |
| CVE-2023-49162 | bigcommerce (WordPress plugin) | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BigCommerce BigCommerce For WordPress.This issue affects BigComm | medium | 5.3 | 0% |