Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2011-4284 | moodle/moodle | Moodle allows remote attackers to obtain sensitive information from myprofile block by visiting user-context page | medium | 0.0 | 2% |
| CVE-2011-4300 | moodle/moodle | Moodle does not properly restrict access to category and course data | medium | 0.0 | 2% |
| CVE-2014-0216 | moodle/moodle | Moodle does not properly restrict file access | medium | 0.0 | 2% |
| CVE-2014-7848 | moodle/moodle | Moodle allows attacks to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2014-9060 | moodle/moodle | Moodle allows attackers to trigger the generation of arbitrary messages | medium | 0.0 | 2% |
| CVE-2021-23682 | appwrite/server-ce | Prototype Pollution in litespeed.js and appwrite/server-ce | critical | 9.8 | 2% |
| CVE-2021-36036 | magento/community-edition, magento/project-community-edition | Magento improper access control vulnerability within Magento's Media Gallery Upload workflow | critical | 9.1 | 2% |
| CVE-2013-2201 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML | medium | 4.3 | 2% |
| CVE-2017-17898 | dolibarr/dolibarr | Dolibarr sensitive information disclosure | high | 7.5 | 2% |
| CVE-2020-35932 | newsletter (WordPress plugin) | Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges ( | high | 7.5 | 2% |
| CVE-2020-35938 | post-grid (WordPress plugin), team-showcase (WordPress plugin) | PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbi | high | 7.5 | 2% |
| CVE-2020-35939 | post-grid (WordPress plugin), team-showcase (WordPress plugin) | PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject | high | 7.5 | 2% |
| CVE-2013-3478 | video-gallery-plugin (WordPress plugin) | SQL injection vulnerability in Apptha WordPress Video Gallery 2.0, 1.6, and earlier for WordPress allows remote attackers to execute arbitra | high | 7.5 | 2% |
| CVE-2017-6924 | drupal/core, drupal/drupal | Drupal REST API can bypass comment approval | high | 7.4 | 2% |
| CVE-2011-4301 | moodle/moodle | Moodle Allows Modification of Constants | medium | 0.0 | 2% |
| CVE-2014-7297 | enfold (WordPress theme) | Unspecified vulnerability in the folder framework in the Enfold theme before 3.0.1 for WordPress has unknown impact and attack vectors. | high | 10.0 | 2% |
| CVE-2021-34623 | profilepress (WordPress plugin) | A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made | critical | 9.8 | 2% |
| CVE-2022-40314 | moodle/moodle | Moodle remote code execution | critical | 9.8 | 2% |
| CVE-2019-1000005 | mpdf/mpdf | mPDF Unsafe Deserialization | high | 8.8 | 2% |
| CVE-2019-11200 | dolibarr/dolibarr | Dolibarr ERP and CRM malicious executable loading | high | 8.8 | 2% |
| CVE-2009-3891 | WordPress core | Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject ar | low | 3.5 | 2% |
| CVE-2015-9298 | events-manager (WordPress plugin) | The events-manager plugin before 5.6 for WordPress has code injection. | critical | 9.8 | 2% |
| CVE-2021-36880 | ulisting (WordPress plugin) | Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom. | high | 8.6 | 2% |
| CVE-2014-7959 | bulletproof-security (WordPress plugin) | SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote auth | medium | 6.5 | 2% |
| CVE-2015-8353 | role-scoper (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary w | medium | 6.1 | 2% |
| CVE-2015-8354 | ultimate-member (WordPress plugin) | Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inje | medium | 6.1 | 2% |
| CVE-2016-10922 | woocommerce-store-toolkit (WordPress plugin) | The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation. | critical | 9.8 | 2% |
| CVE-2022-4939 | wc-multivendor-membership (WordPress plugin) | THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing cap | critical | 9.8 | 2% |
| CVE-2019-20203 | postie (WordPress plugin) | The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From inf | medium | 5.3 | 2% |
| CVE-2015-0269 | contao/core | Contao Core directory traversal vulnerability | medium | 4.3 | 2% |
| CVE-2022-28700 | give (WordPress plugin) | Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. | critical | 9.1 | 2% |
| CVE-2008-6762 | WordPress core | Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web | medium | 4.3 | 2% |
| CVE-2022-42092 | backdrop/backdrop | Backdrop CMS Unrestricted File Upload vulnerability | high | 7.2 | 2% |
| CVE-2021-29450 | WordPress core | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts a | medium | 6.5 | 2% |
| CVE-2020-11026 | WordPress core | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon | high | 8.7 | 2% |
| CVE-2016-3170 | drupal/core, drupal/drupal | Drupal sensitive information disclosure | medium | 5.3 | 2% |
| CVE-2019-15774 | nd-booking (WordPress plugin) | The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | medium | 6.1 | 2% |
| CVE-2013-7483 | slidedeck2 (WordPress plugin) | The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion. | critical | 9.8 | 2% |
| CVE-2021-32650 | october/system | october/system arbitrary code execution | high | 8.8 | 2% |
| CVE-2021-24814 | wordpress-gdpr\&ccpa (WordPress plugin) | The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authentic | critical | 9.6 | 2% |
| CVE-2022-0316 | aidreform (WordPress plugin), bolster (WordPress plugin), club-theme (WordPress plugin) +7 more | The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPre | critical | 9.8 | 2% |
| CVE-2019-19209 | dolibarr/dolibarr | Dolibarr ERP and CRM SQLi | high | 7.5 | 2% |
| CVE-2013-3264 | wp-ultimate-email-marketer-plugin (WordPress plugin) | The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2 | medium | 6.4 | 2% |
| CVE-2017-14720 | WordPress core | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. | medium | 6.1 | 2% |
| CVE-2018-14631 | moodle/moodle | Moodle Cross-site Scripting | medium | 6.1 | 2% |
| CVE-2007-4153 | WordPress core | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web scr | low | 2.1 | 2% |
| CVE-2022-41711 | badaso/core | Badaso vulnerable to Remote Code Execution via malicious file upload | critical | 9.8 | 2% |
| CVE-2021-25063 | contact-form-7-skins (WordPress plugin) | The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an ad | medium | 6.1 | 2% |
| CVE-2024-4180 | the-events-calendar (WordPress plugin) | The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX. | critical | 9.1 | 2% |
| CVE-2022-23793 | joomla/archive | Path Traversal within joomla/archive tar class | high | 7.5 | 2% |