Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.02.2, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-43687 | concrete5/concrete5 | Concrete CMS vulnerable to Session Fixation | medium | 5.4 | 1% |
| CVE-2024-37821 | dolibarr/dolibarr | Dolibarr arbitrary file upload vulnerability | high | 8.8 | 1% |
| CVE-2025-6379 | vidmov (WordPress plugin) | The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the | high | 8.8 | 1% |
| CVE-2025-6381 | vidmov (WordPress plugin) | The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the hand | high | 8.8 | 1% |
| CVE-2024-47873 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XmlScanner bypass leads to XXE | high | 7.5 | 1% |
| CVE-2024-13888 | wpappninja (WordPress plugin) | The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficien | high | 7.2 | 1% |
| CVE-2025-31693 | drupal/ai | The AI Automators module (a submodule of AI) enables you to create different automated tasks that fills out a field data | medium | 6.6 | 1% |
| CVE-2024-10857 | product-input-fields-for-woocommerce (WordPress plugin) | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 | medium | 6.5 | 1% |
| CVE-2022-38061 | export-post-info (WordPress plugin) | Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress. | medium | 6.2 | 1% |
| CVE-2017-10991 | wp-statistics (WordPress plugin) | The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page. | medium | 6.1 | 1% |
| CVE-2018-7280 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.2.14 for WordPress has XSS. | medium | 6.1 | 1% |
| CVE-2021-24339 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XS | medium | 5.4 | 1% |
| CVE-2024-13920 | order-export-\&-order-import-for-woocommerce (WordPress plugin) | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi | medium | 4.9 | 1% |
| CVE-2014-125107 | corveda/phpsandbox | Corveda PHPSandbox Protection Mechanism Failure vulnerability | medium | 4.3 | 1% |
| CVE-2024-13882 | aiomatic (WordPress plugin) | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbit | high | 8.8 | 1% |
| CVE-2022-24748 | shopware/core | Incorrect Authentication in shopware | medium | 6.8 | 1% |
| CVE-2023-4284 | post-timeline (WordPress plugin) | The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, | medium | 6.1 | 1% |
| CVE-2023-45818 | tinymce/tinymce | TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin | medium | 6.1 | 1% |
| CVE-2024-20718 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Cross-Site Request Forgery (CSRF) | medium | 4.3 | 1% |
| CVE-2023-49750 | couponis (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoonthemes Couponis - Affiliate & Sub | critical | 9.3 | 1% |
| CVE-2026-24425 | twig/twig | Twig: Possible sandbox bypass when using a source policy | high | 8.8 | 1% |
| CVE-2021-4365 | nmedia-user-file-uploader (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including | high | 7.2 | 1% |
| CVE-2024-0697 | backuply (WordPress plugin) | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and inclu | medium | 6.5 | 1% |
| CVE-2011-10004 | reciply (WordPress plugin) | A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress. It has been rated as critical. This issue affects some unknown process | medium | 6.3 | 1% |
| CVE-2022-1682 | facturascripts/facturascripts | Cross-site Scripting in facturascripts | medium | 6.1 | 1% |
| CVE-2019-19326 | silverstripe/framework | SilverStripe Web Cache Poisoning through HTTPRequestBuilder | medium | 5.9 | 1% |
| CVE-2022-2877 | titan-anti-spam-\&-security (WordPress plugin) | The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP addres | medium | 5.3 | 1% |
| CVE-2023-38251 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Uncontrolled Resource Consumption | medium | 5.3 | 1% |
| CVE-2022-30536 | wp-maintenance (WordPress plugin) | Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress. | low | 3.4 | 1% |
| CVE-2025-6207 | wp-import-export-lite (WordPress plugin) | The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_temp | high | 7.5 | 1% |
| CVE-2025-5322 | vikrentcar (WordPress plugin) | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation | high | 7.2 | 1% |
| CVE-2017-12948 | pressforward (WordPress plugin) | Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, relate | medium | 6.1 | 1% |
| CVE-2017-9337 | markdown-on-save-improved (WordPress plugin) | The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post. | medium | 6.1 | 1% |
| CVE-2022-29415 | ravpage (WordPress plugin) | Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress. | medium | 6.1 | 1% |
| CVE-2021-24841 | helpful (WordPress plugin) | The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings, which could allow high privilege users to perf | medium | 4.8 | 1% |
| CVE-2021-36895 | tripetto (WordPress plugin) | Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload. | medium | 4.7 | 1% |
| CVE-2022-29421 | countdown-builder (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in Adam Skaat's Countdown & Clock plugin on WordPress via &ycd_type vulnerable parameter. | medium | 4.7 | 1% |
| CVE-2022-2913 | login-no-captcha-recaptcha (WordPress plugin) | The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on t | medium | 4.3 | 1% |
| CVE-2025-46337 | adodb/adodb-php | SQL injection in ADOdb PostgreSQL driver pg_insert_id() method | critical | 10.0 | 1% |
| CVE-2024-1505 | academy (WordPress plugin) | The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versi | high | 8.8 | 1% |
| CVE-2023-6947 | foogallery (WordPress plugin) | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includin | high | 7.7 | 1% |
| CVE-2023-5949 | smartcrawl (WordPress plugin) | The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content. | high | 7.5 | 1% |
| CVE-2024-1068 | 404-solution (WordPress plugin) | The 404 Solution WordPress plugin before 2.35.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leadin | high | 7.2 | 1% |
| CVE-2024-8294 | feehi/cms | FeehiCMS file upload vulnerability | medium | 6.3 | 1% |
| CVE-2024-8295 | feehi/cms | FeehiCMS BannerForm[img] unrestricted upload | medium | 6.3 | 1% |
| CVE-2024-8296 | feehi/cms | FeehiCMS User[avatar] unrestricted upload | medium | 6.3 | 1% |
| CVE-2016-10953 | headway (WordPress theme) | The Headway theme before 3.8.9 for WordPress has XSS via the license key field. | medium | 5.4 | 1% |
| CVE-2023-28473 | concrete5/concrete5 | Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section | critical | 9.8 | 1% |
| CVE-2021-3961 | snipe/snipe-it | Cross-site Scripting in snipe/snipe-it | high | 8.0 | 1% |
| CVE-2023-39528 | prestashop/prestashop | PrestaShop file access through path traversal | medium | 6.8 | 1% |