Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-29287 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Information Exposure | medium | 5.3 | 1% |
| CVE-2018-17102 | quickapps/cms | QuickAppsCMS Cross-Site Request Forgery (CSRF) | high | 8.8 | 1% |
| CVE-2019-15781 | facebook-by-weblizar (WordPress plugin) | The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2019-15834 | webp-converter-for-media (WordPress plugin) | The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2022-29425 | checkout-files-upload-woocommerce (WordPress plugin) | Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress. | medium | 6.1 | 1% |
| CVE-2015-9393 | users-ultra (WordPress plugin) | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter. | medium | 5.4 | 1% |
| CVE-2019-14879 | moodle/moodle | Moodle does not revoke role capabilities correctly | medium | 5.4 | 1% |
| CVE-2022-38724 | silverstripe/assets, silverstripe/framework | Silverstripe XSS in shortcodes | medium | 5.4 | 1% |
| CVE-2019-19110 | wpforo (WordPress plugin) | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. | medium | 4.8 | 1% |
| CVE-2022-29408 | advanced-cf7-db (WordPress plugin) | Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress. | medium | 4.7 | 1% |
| CVE-2015-10018 | dbrisinajumi/d2files | DBRisinajumi d2files SQL Injection vulnerability | critical | 9.8 | 1% |
| CVE-2016-10882 | google-document-embedder (WordPress plugin) | The google-document-embedder plugin before 2.6.2 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2024-1317 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to SQL I | high | 8.8 | 1% |
| CVE-2024-28235 | contao/core-bundle | Contao: Possible cookie sharing with external domains while checking protected pages for broken links | high | 8.3 | 1% |
| CVE-2024-13921 | order-export-\&-order-import-for-woocommerce (WordPress plugin) | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includ | high | 7.2 | 1% |
| CVE-2021-24249 | business-directory-plugin---easy-listing-directories (WordPress plugin) | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request For | medium | 6.5 | 1% |
| CVE-2024-13098 | wordpress-email-newsletter (WordPress plugin) | The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, | medium | 5.4 | 1% |
| CVE-2023-7037 | automad/automad | Authenticated Blind SSRF in automad/automad | low | 3.7 | 1% |
| CVE-2023-0793 | thorsten/phpmyfaq | Weak Password Requirements in thorsten/phpmyfaq | high | 8.8 | 1% |
| CVE-2024-7435 | attire (WordPress plugin) | The Attire theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.6 via deserialization of untr | high | 8.8 | 1% |
| CVE-2023-5865 | thorsten/phpmyfaq | Insufficient Session Expiration in thorsten/phpmyfaq | high | 7.6 | 1% |
| CVE-2023-5672 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to loc | medium | 6.5 | 1% |
| CVE-2024-4484 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 6.4 | 1% |
| CVE-2012-10011 | hd-flv-player (WordPress plugin) | A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the funct | medium | 6.3 | 1% |
| CVE-2014-125101 | portfolio-gallery (WordPress plugin) | A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. Th | medium | 6.3 | 1% |
| CVE-2015-10111 | watu-quiz (WordPress plugin) | A vulnerability was found in Watu Quiz Plugin up to 2.6.7 on WordPress. It has been rated as critical. This issue affects the function watu_ | medium | 6.3 | 1% |
| CVE-2015-10124 | most-popular-posts-widget (WordPress plugin) | A vulnerability was found in Most Popular Posts Widget Plugin up to 0.8 on WordPress. It has been classified as critical. Affected is the fu | medium | 6.3 | 1% |
| CVE-2021-24871 | get-custom-field-values (WordPress plugin) | The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allo | medium | 5.4 | 1% |
| CVE-2022-25238 | silverstripe/framework | Stored XSS via HTML fields in SilverStripe Framework | medium | 5.4 | 1% |
| CVE-2022-4471 | yet-another-related-posts-plugin (WordPress plugin) | The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page | medium | 5.4 | 1% |
| CVE-2022-4488 | widgets-on-pages (WordPress plugin) | The Widgets on Pages WordPress plugin before 1.8.0 does not validate and escape its shortcode attributes before outputting them back in the | medium | 5.4 | 1% |
| CVE-2022-4682 | lightbox-gallery (WordPress plugin) | The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back | medium | 5.4 | 1% |
| CVE-2022-4759 | gigpress (WordPress plugin) | The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a p | medium | 5.4 | 1% |
| CVE-2022-25336 | ezsystems/ezplatform-kernel | Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel | medium | 5.3 | 1% |
| CVE-2017-20208 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Obje | critical | 9.8 | 1% |
| CVE-2021-24649 | wp-user-frontend (WordPress plugin) | The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains t | critical | 9.8 | 1% |
| CVE-2023-2240 | microweber/microweber | Improper Privilege Management in microweber | high | 8.8 | 1% |
| CVE-2024-0852 | coreactivity (WordPress plugin) | The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin | high | 8.8 | 1% |
| CVE-2024-8268 | frontend-dashboard (WordPress plugin) | The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/f | high | 8.8 | 1% |
| CVE-2023-29096 | contact-form-to-db (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by Best | high | 8.5 | 1% |
| CVE-2023-30860 | wwbn/avideo | WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account | high | 8.0 | 1% |
| CVE-2024-24815 | ckeditor/ckeditor | CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection | medium | 6.1 | 1% |
| CVE-2023-37611 | neos/media-browser | Neos CMS Cross Site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2018-5657 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_ | medium | 4.8 | 1% |
| CVE-2018-5659 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_ti | medium | 4.8 | 1% |
| CVE-2018-5661 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width par | medium | 4.8 | 1% |
| CVE-2018-5664 | responsive-coming-soon-page (WordPress plugin) | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 | medium | 4.8 | 1% |
| CVE-2023-5315 | wp-gmappity-easy-google-maps (WordPress plugin) | The Google Maps made Simple plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, | high | 8.8 | 1% |
| CVE-2026-34728 | phpmyfaq/phpmyfaq | phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController | high | 8.7 | 1% |
| CVE-2022-51015 | pocketmine/pocketmine-mp | Unchecked validity of Facing values in PlayerActionPacket | high | 7.5 | 1% |