Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-34251 | getgrav/grav | Grav Server Side Template Injection (SSTI) vulnerability | critical | 9.1 | 2% |
| CVE-2022-0149 | woocommerce-exporter (WordPress plugin) | The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the wo | medium | 6.1 | 2% |
| CVE-2015-7989 | WordPress core | Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitr | medium | 5.4 | 2% |
| CVE-2011-5308 | cdnvote (WordPress plugin) | Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote plugin before 0.4.2 for WordPress allow remote attackers to execut | high | 7.5 | 2% |
| CVE-2014-10017 | e-commerce (WordPress plugin) | Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL | high | 7.5 | 2% |
| CVE-2024-2771 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege es | critical | 9.8 | 2% |
| CVE-2022-0653 | profile-builder (WordPress plugin) | The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient esca | medium | 6.1 | 2% |
| CVE-2015-1394 | photo-gallery (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users | medium | 5.4 | 2% |
| CVE-2021-45416 | francoisjacquet/rosariosis | RosarioSIS XSS Vulnerability | medium | 0.0 | 2% |
| CVE-2016-15033 | delete-all-comments (WordPress plugin) | The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the dele | critical | 9.8 | 2% |
| CVE-2019-25138 | user-submitted-posts (WordPress plugin) | The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_i | critical | 9.8 | 2% |
| CVE-2018-16854 | moodle/moodle | Moodle Login CSRF vulnerability in login form | high | 8.8 | 2% |
| CVE-2019-20180 | tablepress (WordPress plugin) | The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and ar | medium | 6.8 | 2% |
| CVE-2014-3947 | in2code/powermail | TYPO3 powermail extension has unrestricted file upload vulnerability | high | 0.0 | 2% |
| CVE-2021-39320 | underconstruction (WordPress plugin) | The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain | medium | 6.1 | 2% |
| CVE-2024-8625 | ts-poll (WordPress plugin) | The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to p | high | 7.2 | 2% |
| CVE-2020-11028 | WordPress core | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specif | medium | 5.8 | 2% |
| CVE-2026-21861 | baserproject/basercms | baserCMS has OS Command Injection Leading to Remote Code Execution (RCE) | critical | 9.1 | 2% |
| CVE-2020-10806 | ezsystems/ezpublish-kernel, ezsystems/ezpublish-legacy | eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type | critical | 9.8 | 2% |
| CVE-2018-15845 | gleez/cms | Gleez CMS CSRF Allows Adding of Administrator Accounts | high | 8.8 | 2% |
| CVE-2019-15326 | import-users-from-csv-with-meta (WordPress plugin) | The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal. | high | 7.5 | 2% |
| CVE-2020-24401 | magento/community-edition, magento/project-community-edition | Magento 2 Community Edition Incorrect Authorization | medium | 6.5 | 2% |
| CVE-2022-0220 | wordpress-gdpr\&ccpa (WordPress plugin) | The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authentic | medium | 6.1 | 2% |
| CVE-2023-40035 | craftcms/cms | Craft CMS vulnerable to Remote Code Execution via validatePath bypass | high | 7.2 | 2% |
| CVE-2008-0617 | dmsguestbook (WordPress plugin) | Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.7.0 plugin for WordPress allow remote attackers to inject arbitrar | medium | 4.3 | 2% |
| CVE-2022-0188 | cmp-coming-soon-maintenance (WordPress plugin) | The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout. | medium | 5.3 | 2% |
| CVE-2021-24444 | taxopress (WordPress plugin) | The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description fi | medium | 4.8 | 2% |
| CVE-2018-10889 | moodle/moodle | Moodle sensitive information disclosure | medium | 5.3 | 2% |
| CVE-2013-4752 | symfony/http-foundation, symfony/symfony | Symfony Host Header Injection vulnerability in the HttpFoundation component | medium | 6.1 | 2% |
| CVE-2021-34640 | securimage-wp-fixed (WordPress plugin) | The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/sec | medium | 6.1 | 2% |
| CVE-2017-14251 | typo3/cms | TYPO3 Arbitrary Code Execution | high | 8.8 | 2% |
| CVE-2020-15277 | baserproject/basercms | Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0 | high | 7.2 | 2% |
| CVE-2019-12473 | mediawiki/core | Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple | high | 7.5 | 2% |
| CVE-2019-7726 | nukeviet/nukeviet | SQL Injection in NukeViet | critical | 9.8 | 2% |
| CVE-2021-20717 | ec-cube/ec-cube | EC-CUBE Cross-site scripting vulnerability | medium | 6.1 | 2% |
| CVE-2013-2082 | moodle/moodle | Moodle does not enforce capability requirements for reading blog comments | medium | 0.0 | 2% |
| CVE-2020-13125 | ultimate-addons-for-elementor (WordPress plugin) | An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in c | medium | 6.5 | 2% |
| CVE-2014-5180 | hdw-player-video-player-video-gallery (WordPress plugin) | SQL injection vulnerability in the videos page in the HDW Player Plugin (hdw-player-video-player-video-gallery) 2.4.2 for WordPress allows r | medium | 6.5 | 2% |
| CVE-2023-3320 | wp-sticky-social (WordPress plugin) | The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due | medium | 6.1 | 2% |
| CVE-2017-13137 | formcraft (WordPress plugin) | The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php. | critical | 9.8 | 2% |
| CVE-2022-1560 | amministrazione-aperta (WordPress plugin) | The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading | medium | 6.5 | 2% |
| CVE-2021-25033 | noptin (WordPress plugin) | The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given va | medium | 6.1 | 2% |
| CVE-2017-14126 | participants-database (WordPress plugin) | The Participants Database plugin before 1.7.5.10 for WordPress has XSS. | medium | 6.1 | 2% |
| CVE-2022-0212 | spidercalendar (WordPress plugin) | The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page | medium | 6.1 | 2% |
| CVE-2020-24400 | magento/community-edition | Magento SQL Injection vulnerability | high | 7.1 | 2% |
| CVE-2012-1608 | typo3/cms | Typo3 API XSS Vulnerabilities | medium | 0.0 | 2% |
| CVE-2015-4338 | xcloner (WordPress plugin) | Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code | medium | 6.5 | 2% |
| CVE-2016-6609 | phpmyadmin/phpmyadmin | phpMyAdmin PHP code injection | high | 8.8 | 2% |
| CVE-2005-1687 | WordPress core | SQL injection vulnerability in wp-trackback.php in Wordpress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via t | high | 7.5 | 2% |
| CVE-2024-13346 | avada (WordPress theme) | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions u | high | 7.3 | 2% |