Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-39200 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | medium | 5.3 | 2% |
| CVE-2014-8491 | grand-flagallery (WordPress plugin) | The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagaller | medium | 5.3 | 2% |
| CVE-2016-0724 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 2% |
| CVE-2019-14365 | intercom (WordPress plugin) | The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about | high | 7.5 | 2% |
| CVE-2022-31090 | guzzlehttp/guzzle | Authorization header leaked to a different origin on cross-origin redirect (curl handler) | high | 7.7 | 2% |
| CVE-2016-9449 | drupal/core, drupal/drupal | Drupal sensitive information disclosure | medium | 4.3 | 2% |
| CVE-2020-36848 | boldgrid-backup (WordPress plugin) | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Ex | high | 7.5 | 2% |
| CVE-2014-0217 | moodle/moodle | Moodle does not check for the moodle/course:viewhiddencourses capability | medium | 0.0 | 2% |
| CVE-2015-3176 | moodle/moodle | Moodle allows attackers obtain full-name information | medium | 0.0 | 2% |
| CVE-2020-13764 | gravityforms (WordPress plugin), wp-premium/gravityforms | common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special ca | high | 7.5 | 2% |
| CVE-2013-2080 | moodle/moodle | Moodle is vulnerable to Sensitive Information Disclosure | medium | 0.0 | 2% |
| CVE-2021-24948 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJ | high | 7.5 | 2% |
| CVE-2020-6164 | silverstripe/cms, silverstripe/framework | Silverstripe CMS information disclosure | high | 7.5 | 2% |
| CVE-2020-15099 | typo3/cms, typo3/cms-core | Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS | high | 8.1 | 2% |
| CVE-2019-16738 | mediawiki/core | MediaWiki information disclosure | medium | 5.3 | 2% |
| CVE-2018-21011 | charitable (WordPress plugin) | The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details. | high | 7.5 | 2% |
| CVE-2014-0215 | moodle/moodle | Moodle Reveals Student Information Meant To Be Anonymous | medium | 0.0 | 2% |
| CVE-2016-6612 | phpmyadmin/phpmyadmin | phpMyAdmin Local file exposure | medium | 6.5 | 2% |
| CVE-2013-1835 | moodle/moodle | Moodle's login_as feature leaks information from external repositories | low | 0.0 | 2% |
| CVE-2016-2158 | moodle/moodle | Moodle allows attackers to obtain sensitive category-detail information | medium | 4.3 | 2% |
| CVE-2012-5657 | zendframework/zendframework1 | Zend Framework XXE Vulnerability | medium | 0.0 | 2% |
| CVE-2016-2154 | moodle/moodle | Moodle allows attackers to discover hidden course names | medium | 4.3 | 2% |
| CVE-2016-2156 | moodle/moodle | Moodle provides calendar-event data without considering whether an activity is hidden | medium | 4.3 | 2% |
| CVE-2019-14366 | wp-slacksync (WordPress plugin) | WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about | high | 7.5 | 2% |
| CVE-2011-4289 | moodle/moodle | Moodle does not recogniz configuration setting that makes e-mail addresses visible only to course members | medium | 0.0 | 2% |
| CVE-2014-7831 | moodle/moodle | Moodle exposes hidden grades to students | medium | 0.0 | 2% |
| CVE-2014-7833 | moodle/moodle | Moodle allows attackers to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2015-0211 | moodle/moodle | Moodle allows attackers to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2015-0215 | moodle/moodle | Moodle allows attackers to obtain sensitive calendar-event information | medium | 0.0 | 2% |
| CVE-2015-2266 | moodle/moodle | Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information | medium | 0.0 | 2% |
| CVE-2015-3180 | moodle/moodle | Moodle allows attackers to obtain sensitive course-structure information | medium | 0.0 | 2% |
| CVE-2013-7400 | directmailteam/direct-mail | The Direct Mail (direct_mail) TYPO3 extension improperly discloses sensitive information | high | 7.5 | 2% |
| CVE-2010-5104 | typo3/cms-core | TYPO3 Sensitive Information Disclosure via escapeStrForLike method | medium | 0.0 | 2% |
| CVE-2021-21424 | lexik/jwt-authentication-bundle, symfony/maker-bundle, symfony/security +4 more | Prevent user enumeration using Guard or the new Authenticator-based Security | medium | 5.3 | 2% |
| CVE-2024-13609 | 1-click-migration (WordPress plugin) | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure i | medium | 5.9 | 2% |
| CVE-2022-0709 | booking-package (WordPress plugin) | The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this | high | 7.5 | 2% |
| CVE-2020-36723 | listingpro (WordPress plugin) | The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the | medium | 5.3 | 2% |
| CVE-2013-1831 | moodle/moodle | Moodle reveals absolute path in exception message | medium | 0.0 | 2% |
| CVE-2014-8328 | t3/dce | DCE extension for Typo3 Discloses Environment Information | medium | 5.3 | 2% |
| CVE-2011-3712 | cakephp/cakephp | CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file | medium | 0.0 | 2% |
| CVE-2016-2151 | moodle/moodle | Moodle allows attackers to discover student e-mail addresses | medium | 4.3 | 2% |
| CVE-2017-2643 | moodle/moodle | Moodle Global search displays user names for unauthenticated users | medium | 5.3 | 2% |
| CVE-2022-31091 | guzzlehttp/guzzle | Change in port not treated as a change in origin; sensitive headers leaked on redirect | high | 8.1 | 2% |
| CVE-2019-18886 | symfony/security-http, symfony/symfony | User enumeration leak using switch user functionality in Symfony | medium | 5.3 | 2% |
| CVE-2016-3732 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 2% |
| CVE-2021-41120 | sylius/paypal-plugin | Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS | high | 7.5 | 2% |
| CVE-2020-25703 | moodle/moodle | Exposure of Sensitive Information to an Unauthorized Actor in Moodle | medium | 5.3 | 2% |
| CVE-2013-4522 | moodle/moodle | Moodle vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | medium | 0.0 | 2% |
| CVE-2019-14800 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via | medium | 5.3 | 2% |
| CVE-2016-6613 | phpmyadmin/phpmyadmin | phpMyAdmin Local file exposure through symlinks with UploadDir | medium | 5.3 | 2% |