Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-17074 | wordpress-feed-statistics (WordPress plugin) | The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter. | medium | 6.1 | 1% |
| CVE-2019-11016 | elgg/elgg | Elgg open redirect | medium | 6.1 | 1% |
| CVE-2011-4582 | moodle/moodle | Moodle Open Redirect in Calendar Set Page | medium | 0.0 | 1% |
| CVE-2017-6932 | drupal/core, drupal/drupal | Drupal external link injection vulnerability | medium | 4.7 | 1% |
| CVE-2018-11408 | symfony/security-bundle, symfony/symfony | Symfony Open Redirect | medium | 6.1 | 1% |
| CVE-2021-21338 | typo3/cms, typo3/cms-core | Open Redirection in Login Handling | medium | 6.1 | 1% |
| CVE-2022-35652 | moodle/moodle | Moodle Open redirect risk in mobile auto-login feature | medium | 6.1 | 1% |
| CVE-2019-14882 | moodle/moodle | Moodle open redirect vulnerability | medium | 6.1 | 1% |
| CVE-2024-21641 | flarum/core, flarum/framework | Flarum's logout Route allows open redirects | medium | 6.5 | 1% |
| CVE-2017-1000013 | phpmyadmin/phpmyadmin | phpMyAdmin Open Redirect | medium | 6.1 | 1% |
| CVE-2022-0560 | microweber/microweber | Open redirect in microweber | medium | 6.1 | 1% |
| CVE-2021-32645 | hyn/multi-tenant | Open Redirect | medium | 4.3 | 1% |
| CVE-2020-15241 | typo3/cms, typo3/cms-core, typo3fluid/fluid | Cross-Site Scripting in ternary conditional operator | medium | 4.7 | 1% |
| CVE-2018-14381 | pagekit/pagekit | Pagekit open redirect vulnerability | medium | 6.1 | 1% |
| CVE-2019-3850 | moodle/moodle | Moodle Stored HTML in assignment submission comments allowed links to be opened directly | medium | 6.1 | 1% |
| CVE-2022-2252 | microweber/microweber | Open Redirect in microweber | medium | 6.1 | 1% |
| CVE-2022-24739 | rudloff/alltube | Server-Side Request Forgery and Open Redirect in AllTube Download | high | 7.3 | 1% |
| CVE-2024-6289 | wps-hide-login (WordPress plugin) | The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, a | medium | 6.1 | 1% |
| CVE-2010-3661 | typo3/cms-backend | TYPO3 Open Redirection vulnerability on the backend | medium | 6.1 | 1% |
| CVE-2019-10133 | moodle/moodle | Moodle Open Redirect Vulnerability | medium | 6.1 | 1% |
| CVE-2024-0337 | travelpayouts (WordPress plugin) | The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validat | medium | 6.1 | 1% |
| CVE-2020-13662 | drupal/core, drupal/drupal | Drupal Core Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2017-1000434 | furikake (WordPress plugin) | Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to | medium | 6.1 | 1% |
| CVE-2018-6520 | simplesamlphp/simplesamlphp | SimpleSAMLphp Open redirection protection bypass | medium | 6.1 | 1% |
| CVE-2021-4000 | showdoc/showdoc | Open Redirect in showdoc | medium | 6.5 | 1% |
| CVE-2021-38343 | nested-pages (WordPress plugin) | The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulk | medium | 4.7 | 1% |
| CVE-2024-3032 | builder (WordPress plugin) | Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Red | medium | 6.1 | 1% |
| CVE-2020-12699 | directmailteam/direct-mail | Open redirect in direct_mail | medium | 6.1 | 1% |
| CVE-2022-21651 | shopware/shopware | Open redirect in shopware | medium | 6.8 | 1% |
| CVE-2021-3989 | showdoc/showdoc | showdoc is vulnerable to URL Redirection to Untrusted Site | medium | 6.1 | 1% |
| CVE-2017-16652 | symfony/security, symfony/security-http, symfony/symfony | Symfony Open Redirect | medium | 6.1 | 1% |
| CVE-2024-13888 | wpappninja (WordPress plugin) | The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficien | high | 7.2 | 1% |
| CVE-2023-3139 | protect-wp-admin (WordPress plugin) | The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the prot | medium | 6.1 | 1% |
| CVE-2022-1209 | ultimate-member (WordPress plugin) | The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social | medium | 4.3 | 1% |
| CVE-2015-10115 | sidebar-manager-to-woosidebars-converter (WordPress plugin) | A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. Th | medium | 4.3 | 1% |
| CVE-2020-13486 | verbb/knock-knock | Knock Knock plugin Open redirection vulnerability | medium | 6.1 | 1% |
| CVE-2015-10114 | woosidebars (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue | medium | 4.3 | 1% |
| CVE-2015-10112 | wooframework-branding (WordPress plugin) | A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress. Affected is the function | medium | 4.3 | 1% |
| CVE-2021-4348 | ultimate-gdpr-\&-ccpa-compliance-toolkit (WordPress plugin) | The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_s | high | 7.5 | 1% |
| CVE-2020-36663 | artesaos/seotools | Artesãos SEOTools Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2020-36664 | artesaos/seotools | Artesãos SEOTools Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2022-27463 | wwbn/avideo | Open redirect in wwbn/avideo | medium | 6.1 | 1% |
| CVE-2020-36665 | artesaos/seotools | Artesãos SEOTools Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2024-50345 | symfony/http-foundation, symfony/symfony | Symfony vulnerable to open redirect via browser-sanitized URLs | low | 3.1 | 1% |
| CVE-2021-3851 | grumpydictator/firefly-iii | Open Redirect in firefly-iii | medium | 5.0 | 1% |
| CVE-2015-10104 | icons-for-features (WordPress plugin) | A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue | low | 3.5 | 1% |
| CVE-2017-20164 | symbiote/silverstripe-seed | Symbiote Seed Open Redirect vulnerability | medium | 6.1 | 1% |
| CVE-2026-54588 | poweradmin/poweradmin | Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. | critical | 9.6 | 1% |
| CVE-2023-3771 | t1 (WordPress plugin) | The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary w | medium | 6.1 | 1% |
| CVE-2024-6690 | wp-content-copy-protection-\&-no-right-click (WordPress plugin) | The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to extern | medium | 6.1 | 1% |