Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.03.1, updated 2026-11-02. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-5335 | moodle/moodle | Moodle cross-site request forgery (CSRF) vulnerability | medium | 4.3 | 1% |
| CVE-2017-20187 | floriangaerber/magnesium | Magnesium-PHP Injection vulnerability | low | 3.5 | 1% |
| CVE-2026-47156 | mantisbt/mantisbt | MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator | critical | 0.0 | 1% |
| CVE-2023-35910 | quasar-form (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Cont | high | 8.5 | 1% |
| CVE-2023-22487 | flarum/mentions | Flarum post mentions can be used to read any post on the forum without access control | high | 7.7 | 1% |
| CVE-2024-1935 | rafflepress (WordPress plugin) | The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulner | high | 7.2 | 1% |
| CVE-2019-14679 | arprice-responsive-pricing-table (WordPress plugin) | core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF. | medium | 6.5 | 1% |
| CVE-2019-12748 | typo3/cms, typo3/cms-core | Typo3 Cross-Site Scripting in Link Handling | medium | 6.1 | 1% |
| CVE-2019-19325 | silverstripe/framework | Reflected XSS in SilverStripe | medium | 6.1 | 1% |
| CVE-2020-26523 | froala/wysiwyg-editor | Froala WYSIWYG Editor XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-4747 | download-post-category-image-with-grid-and-slider (WordPress plugin) | The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes bef | medium | 5.4 | 1% |
| CVE-2023-0072 | wc-vendors-marketplace (WordPress plugin) | The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting the | medium | 5.4 | 1% |
| CVE-2019-16698 | directmailteam/direct-mail | direct_mail for Typo3 sensitive data exposure | medium | 4.3 | 1% |
| CVE-2022-4868 | froxlor/froxlor | Froxlor Improper Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2024-10215 | wpbookit (WordPress plugin) | The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to th | critical | 9.8 | 1% |
| CVE-2020-23960 | forkcms/forkcms | Cross-Site Request Forgery in ForkCMS | high | 8.8 | 1% |
| CVE-2024-1710 | addon-library (WordPress plugin) | The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction fu | high | 8.8 | 1% |
| CVE-2024-3067 | wp-product-feed-manager (WordPress plugin) | The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and in | high | 7.2 | 1% |
| CVE-2022-45077 | betheme (WordPress plugin) | Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress. | medium | 6.3 | 1% |
| CVE-2022-2167 | newspaper (WordPress plugin) | The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, lea | medium | 6.1 | 1% |
| CVE-2022-3070 | generate-pdf-using-contact-form-7 (WordPress plugin) | The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perfo | medium | 4.8 | 1% |
| CVE-2024-1075 | minimal-coming-soon-maintenance-mode (WordPress plugin) | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all v | low | 3.7 | 1% |
| CVE-2026-45304 | symfony/symfony, symfony/yaml | Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") | low | 0.0 | 1% |
| CVE-2026-45305 | symfony/symfony, symfony/yaml | Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex | low | 0.0 | 1% |
| CVE-2019-15645 | zoho-salesiq (WordPress plugin) | The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2021-25073 | wp125 (WordPress plugin) | The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to | high | 8.8 | 1% |
| CVE-2021-25115 | wp-photo-album-plus (WordPress plugin) | The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled im | medium | 6.4 | 1% |
| CVE-2017-14761 | genix/cms | GeniXCMS Cross-site Scripting (XSS) vulnerability via id parameter | medium | 6.1 | 1% |
| CVE-2017-14762 | genix/cms | GeniXCMS Cross-site Scripting (XSS) via id parameter | medium | 6.1 | 1% |
| CVE-2017-14765 | genix/cms | GeniXCMS Cross-site Scripting (XSS) via the Menu ID field | medium | 6.1 | 1% |
| CVE-2017-17431 | genix/cms | GeniXCMS XSS Vulnerability | medium | 6.1 | 1% |
| CVE-2022-3794 | jeg-elementor-kit (WordPress plugin) | The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2 | medium | 5.4 | 1% |
| CVE-2023-3009 | nilsteampassnet/teampass | nilsteampassnet/teampass vulnerable to cross-site scripting | medium | 5.4 | 1% |
| CVE-2021-24702 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow | medium | 4.8 | 1% |
| CVE-2022-32061 | snipe/snipe-it | Snipe-IT 6.0.2 vulnerable to Cross-site Scripting | medium | 4.8 | 1% |
| CVE-2022-3690 | popup-maker (WordPress plugin) | The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role | medium | 4.8 | 1% |
| CVE-2024-25625 | pimcore/admin-ui-classic-bundle | Pimcore Host Header Injection in user invitation link | high | 8.1 | 1% |
| CVE-2017-20178 | codiad/codiad | Codiad information disclosure vulnerability | high | 7.5 | 1% |
| CVE-2023-4139 | wp-ultimate-csv-importer (WordPress plugin) | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing rest | high | 7.5 | 1% |
| CVE-2020-20523 | gilacms/gila | Gila CMS Cross-site Scripting Vulnerability | medium | 6.1 | 1% |
| CVE-2015-9425 | social-locker (WordPress plugin) | The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license | medium | 5.4 | 1% |
| CVE-2026-81887 | livewire/livewire | Livewire DOM-based cross-site scripting during client-side state handling | medium | 0.0 | 1% |
| CVE-2024-13824 | ciyashop (WordPress plugin) | The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including | critical | 9.8 | 1% |
| CVE-2024-25738 | vufind/vufind | VuFind Server-Side Request Forgery (SSRF) vulnerability | critical | 9.1 | 1% |
| CVE-2018-20964 | contact-form-to-email (WordPress plugin) | The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2018-21002 | js-support-ticket (WordPress plugin) | The js-support-ticket plugin before 2.0.6 for WordPress has CSRF. | high | 8.8 | 1% |
| CVE-2020-9394 | pricing-table-by-supsystic (WordPress plugin) | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF. | high | 8.8 | 1% |
| CVE-2022-2540 | link-optimizer-lite (WordPress plugin) | The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and incl | high | 8.8 | 1% |
| CVE-2024-9305 | apppresser (WordPress plugin) | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, | high | 8.1 | 1% |
| CVE-2026-54593 | pterodactyl/panel | Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions | high | 8.1 | 1% |